NHS data breach exposing 150,000 patients' sensitive health details blamed on 'coding error'

Confidential health data of nearly 150,000 National Health Service HS patients was inadvertently shared without their permission due to a software coding error. The affected patients' data were categorized as "Type 2 objections", which means they had requested their data be kept private and only used to provide them with care.

However, due to a nearly three-year-long data processing and management error, this request was ignored and the information was used by a clinical audit and research project.

'Supplier defect'

In an official statement, Parliamentary Under-Secretary of State for Health Jackie Doyle-Price disclosed that the NHS identified a "supplier defect" in the processing of historical patient objections to the sharing of their data such as "Type 2 objections". The coding error was found in the SystmOne application, an NHS system provided by clinical software firm TPP.

"An error occurred when 150,000 Type 2 objections set between March 2015 and June 2018 in GP practices running TPP’s system were not sent to NHS Digital," Doyle-Price said. "As a result, these objections were not upheld by NHS Digital in its data disseminations between April 2016, when the NHS Digital process for enabling them to be upheld was introduced, and 26 June 2018.

"This means that data for these patients has been used in clinical audit and research that helps drive improvements in outcomes for patients."

NHS Digital said it was notified of the error by TPP and has since rectified the glitch. The Department of Health and Social Care were notified about the issue on June 28.

The Information Commissioner’s Office and the National Data Guardian for Health and Care were also informed of the breach and an investigation is underway.

"We are aware of an incident involving NHS Digital and are making inquiries," an ICO spokeswoman said.

TPP has said it "apologizes unreservedly" for the error and has "committed to work with NHS Digital so that errors of this nature do not occur again."

Doyle-Price said: "This will ensure that patients’ wishes on how their data is used are always respected and acted upon. There is not, and has never been, any risk to patient care as a result of this error."

New national data opt-out standard

As of May 25, 2018, the UK government introduced a new national data opt-out program to replace Type 2 objections. Doyle-Price said these new arrangements would prevent such a failure from happening again.

"This has simplified the process of registering an objection to data sharing for uses beyond an individual’s care," authorities said. "The new arrangements give patients direct control over setting their own preferences for the secondary use of their data and do not require the use of GP systems, and therefore will prevent a repeat of this kind of GP systems failure in the future.

She added: "The Government has the highest regard for data standards and is committed to ensuring patients can express a preference over how health data is shared for purposes beyond their own care."