Dear NHS Coventry and Warwickshire Integrated Care Board,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as Wednesday 28th December 2022.

I note with interest your "Population Health Management" programme
https://www.happyhealthylives.uk/staying...

where clearly identifiable, confidential, medical information is uploaded form contributing data controllers - such as GP surgeries - and linked to datasets from other sources (such as NHS Trusts), and then processed for secondary purposes : de-identification, anonymisation (which is processing), linkage, data analysis, planning, commissioning etc.

"In some cases, the people working with the information will be able to look at anonymised information from citizens across all of Coventry and Warwickshire, for example, to look at health trends across the region. However, they wouldn’t be able to see personal information that could identify you."

"Population Health Management allows us to:

• understand patient needs that might have been overlooked
• design better health services
• prevent diseases
• predict future health issues"

And indeed, such processing even comes with a "right to object"
https://www.happyhealthylives.uk/staying...

Your Population Health Management programme is not direct medical care. That is what your shared care record is for.

It is data analysis, planning, commissioning, anonymisation.

The National Data Guardian has recently written to all ICBS stressing the need for a legal basis to avoid a breach of confidence, misuse of private information, and so breach of GDPR, when confidential medical information is processed outside of the GP surgery (out with "the data controller's boundary") for purposes other than direct medical care.
https://www.whatdotheyknow.com/request/9...

This follow previouis communication from NHSX:
https://www.nhsdatasharing.info/NHSXLett...

A legal basis that avoids an actionable breach might be:

• Explicit permission from the individual; or
• A legal obligation placed upon the contributing data controller to process in this way; or
• HRA/CAG approval under Reg 5 of COPI 2002 (so-called "s251 approval")

So:

• Please could you provide me with the legal basis for such processing that avoids a breach of confidence, misuse of private information, and so a breach of GDPR. Please note, I am not seeking the "GDPR" legal bases (Article 6 and 9), but how the common law of confidentiality is met.

• Please could you kindly send me the latest DPIA undertaken for this secondary uses purposes (processing)

• Please could you state the data processor used in this scheme, if not clear from the DPIA

• The SNOMED or Read Code that GP surgeries can apply to a patient record, that would prevent any such processing from taking place for that individual's confidential information

• Please could state whether the NHS Data Opt Out applies to such processing

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I wish to receive the information by email.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Yours faithfully,

Dr Neil Bhatia

Dear WARWICKSHIREICB (NHS ARDEN AND GREATER EAST MIDLANDS COMMISSIONING SUPPORT UNIT),

However ➡️you ⬅️ classify the way in which personal confidential information is used, I would like the DPIA for any and all processing undertaken as part of this project.

That was clearly the intention of my request, and I would appreciate if you could kindly provide me with that DPIA (or DPIAs).

Yours sincerely,

Dr Neil Bhatia
JP, GP, Information Governance Lead, Caldicott Guardian, Data Protection Officer, Data Autonomy Advocate

Dear WARWICKSHIREICB (NHS ARDEN AND GREATER EAST MIDLANDS COMMISSIONING SUPPORT UNIT),

Your response is now overdue - you are in breach of s10 of the Act.

My request was crystal clear - the DPIA for your Population Health project (as is required by Article 35 of UK GDPR). It is a simple and straightforward request.

I have no option now but to:

1) Refer this to the ICO as a breach
2) Start sending FOI requests to GP surgeries within yur ICB for the information. I will make explicit that the only reason I am having to FOI them is because of your inability to comply with the law.

Every GP surgery must have that DPIA.

Yours sincerely,

Dr Neil Bhatia

Dear WARWICKSHIREICB (NHS ARDEN AND GREATER EAST MIDLANDS COMMISSIONING SUPPORT UNIT),

OK, whatever.

I will start requesting this from GP practices. I'm sure they'll be delighted.

Yours sincerely,

Dr Neil Bhatia