Coding error blamed for NHS data sharing mistake affecting 150,000 patients

A coding error in software used by doctors has led to confidential data of around 150,000 NHS patients being shared without their permission.

These patients had requested their health data should only be used to provide them with care -- a process known as a 'Type 2 opt-out'.

However, a software problem led to this request being ignored and the information being shared for clinical auditing and research.

In a written statement, junior health minister Jackie Doyle-Price said the Department for Health first became aware of the error on 28 June and that "there is not, and has never been, any risk to patient care as a result of this error".

All of the patients affected attend GP surgeries using SystmOne, an application by software-firm TPP which is designed to share patient data across NHS services.

But a problem being described as a "defect" meant that between April 2016 and June 2018, Type 2 objections in GP practices running TPP's system were not sent to NHS Digital, resulting in that information being shared despite requests to the contrary.

SEE ALSO: What is GDPR? Everything you need to know about the new general data protection regulations

Those who made Type 2 objections between March 2015 and June 2018 are thought to be affected and the NHS has said it is writing to those patients to let them know.

"We apologise unreservedly for this issue, which has been caused by a coding error by a GP system supplier (TPP) and means that some people's data preferences have not been upheld when we have disseminated data," said Nic Fox, director of primary and social care technology at NHS Digital.

"The TPP coding error meant that we did not receive these preferences and so have not been able to apply them to our data.

"We worked swiftly to put this right and the problem has been resolved for any future data disseminations," he added.

TPP has also issued an apology for the coding error -- the exact nature of which hasn't been specified. ZDNet has contacted the company for more information, but hasn't received a reply.

"TPP and NHS Digital have worked together to resolve this problem swiftly. The privacy of patient data is a key priority for TPP, and we continually make improvements to our system to ensure that patients have optimum control over information. In light of this, TPP apologises unreservedly for its role in this issue," said Dr John Parry, clinical director at TPP.

SEE: A winning strategy for cybersecurity (ZDNet special report) | Download the report as a PDF (TechRepublic)

NHS Digital has made both the Information Commissioner's Office and the National Data Guardian for Health and Care aware of the incident.

"We are aware of an incident involving NHS Digital and are making enquiries," an ICO spokesperson told ZDNet.

In order to make sure that this doesn't happen again, TPP and NHS Digital will "ensure that testing and assurance of patient data extracts is enhanced," NHS Digital said in a statement -- which adds how all opt-outs have now been properly recorded in the system.

The organisation has also moved to assure patients that since the introduction of its National Data Opt-Out on 25 May -- the same day as GDPR data protection legislation came into force across the European Union -- the error which led to the 'Type 2 opt-out' mistake can't happen again.

"The new arrangements give patients direct control over setting their own preferences for the secondary use of their data and do not require the use of GP systems, and therefore will prevent a repeat of this kind of GP systems failure in the future," said Doyle-Price.

READ MORE ON CYBER SECURITY

• Dixons Carphone hit by huge data breach: Attackers access 5.9 million card details
• DeepMind, NHS use anonymized patient data in AI to avoid regulatory hurdles (TechRepublic)
• Windows 10 upgrade: NHS gets deadline for making the jump
• Ticketmaster says credit card data may have been stolen in UK breach (CNET)
• Cyber security: Don't leave it to your tech team or you'll get breached, warns data protection chief