What if people controlled their own health data?

It’s 2021. Gavin logs into NHS.uk to change his privacy settings.

He is concerned by several stories in the news about the way NHS services have been handling information about patients. He hesitates before removing the tick in the first box, which had given permission for all NHS staff to view his health record (restricting access to his GP). But he very quickly removes the tick in the box marked ‘access allowed for other organisations like universities and companies’. He’s one of many people exercising newly gained easy controls of their health data, with a host of consequences for the running of the health service and the future of health research. 

In the weeks since patients were given access to the online dashboard, there has been a steady dribble of stories about what happens to people’s health data. There’s no concrete evidence of harm in any of these stories, but a crisis of confidence has built up over time. One hospital has been the subject of a cyberattack, but it is not yet clear whether sensitive data has been stolen and deciphered. Elsewhere, a whistleblower has explained how NHS electronic health records have been accessed by security services without the knowledge of NHS providers and patients. An independent inquiry has been launched. The Health Secretary has been hauled in front of the Select Committee. 

Controversy about the use of health data is nothing new. Five years earlier in 2016, 2.2 per cent of patients had exercised their right to opt out of data being shared beyond the NHS information centre after a botched attempt to link up information from patients’ GP records and hospital activity records. They did this in a comparatively arduous way, by writing to their GP and registering their objections. All despite the fact that fewer than 0.25 per cent of all patients in England had been given online access to the records held by their GP.

Now, in 2021, it’s much easier to view that data, suggest changes to it, share it. And it’s also much easier to opt out. The new dashboard allows patients to instantly restrict the NHS’s ability to see, share, and use data that could be used to identify them. It works like changing privacy settings on a social network. At the peak of this crisis, something like one in five patients have, like Gavin, opted out of sharing data with non-NHS bodies and one in ten opted out of sharing with NHS staff beyond their GP practice. Such is the erosion of trust and confidence in the NHS’s treatment of data.

To the people who use this data for research, it’s like the lights are slowly going out. Organisations studying the benefits of health care and how they’re distributed, who need to have representative data, are left struggling to work out whether their conclusions will be at all useful. Researchers developing new treatments and technologies for use in health care are worried they have a biased picture of the patients they’re trying to develop better treatments for. Commissioners are left with a much less detailed picture of the health needs of their patients, eroding their ability to commission the most appropriate services, increasing the risk of waste and the risk of patients going without the care they need.

But that’s just one scenario. The future doesn’t have to be so pessimistic, antisocial and dystopian. People having control of their health data can be part of a better health system. 

'People having control of their health data can be part of a better health system.'

In the next few years, what we understand to be ‘health data’ is likely to change significantly. At the moment, patients’ medical records sit with GPs, who control them. They contain notes of consultations, diagnoses and treatments, mainly added by doctors and NHS staff, going back for most people to when they were born. But in future this data could sit alongside data generated by patients, made easy through cheaper and more ubiquitous digital technology. 

It could be biological data streamed from wearable monitors to the NHS. Or fitness trackers logging activity against an exercise plan. Or mood and symptom-tracking apps helping people track their mental health and wellbeing. Or video and sensor data recorded as people carry out rehabilitation exercises prescribed by a physio. Or genome data. All linked to the person’s unique NHS record. 

'[The] NHS in 2030 project imagines a world where citizens are able to easily share their health data in a standardised format and in real-time with studies operating on a large or a small-scale.'

In a different world, the same easy-to-use privacy system Gavin used could enable a new wave of contributions to our knowledge of health and good-quality care. Citizens could allow access to their data for specific research projects. Nesta’s NHS in 2030 project imagines a world where citizens are able to easily share their health data in a standardised format and in real time with studies operating on a large or a small scale, run by organisations of all types including communities of engaged people with particular conditions, building on the approach of existing organisations like PatientsLikeMe. 

The next step will be making such large and varied datasets useful to people and the professionals in the health system. This will require the NHS to develop the skills to interpret the data on an individual level, develop and use new tools to analyse the vast quantities of data (perhaps using machine-learning algorithms fed by millions of historical health data), and work on new research to understand what action people can take in response. All these attempts to increase our knowledge of good health and how to attain it require citizens to be comfortable with how their data is used. It will also require people and professionals to tackle age-old problems like how to make big but difficult changes to habits and choices to live a healthier life. 

As health services gradually move towards commissioning for improving overall population health, rather than just delivering health care, much of this data, once properly understood, could become a reliable part of objective outcome measures for some conditions. These measures could be designed to reward the organisations who help citizens to stay healthy, live well with long-term conditions, or deliver high-quality specialist care.

'Commissioners and providers need good-quality information about patients to develop better and fairer health services.'

We assume the political principles underlying the NHS will remain constant – that is, that it is a universal free health service. Patients who opt out of sharing their health data won’t and shouldn’t be disqualified from any treatment, in the same way as patients today don’t face restricted access to treatment due to past risky behaviours when it won’t affect their treatment’s likelihood of success. This sets it apart from other ‘free’ services like online social networks; tracking your health data can’t be part of an exchange for using the NHS, in the same way as tracking your web activity is when using networks like Facebook or Twitter. This makes it even more important to retain trust and make clear the benefits of sharing.

We can’t let the lights go out. Commissioners and providers need good-quality information about patients to develop better and fairer health services. Researchers need it to develop better treatments and technologies for use in health care. And charities, like The King’s Fund, need it to be reliable when trying to help improve the whole system. The consequence of giving people more control over their own data depends on the path taken before that point; a widespread breakdown in trust would have lasting consequences. 

It’s the right direction in which to go, but the health system needs to work hard to make sure the scenario achieved is one that realises the full potential of using health data, rather than seeing people opt out because they don’t see the benefits or their trust ebbs away.  That means building confidence that data won’t fall into the wrong hands, building trust by being even more transparent about what happens to health care data, how it’s processed and for what purposes. The system won’t get a second chance to do this.