Whose Property?

Paul Taylor writes about the trade in medical records

Patients often complain that their GP spends more time typing and looking at a computer screen than listening to them. This isn’t really new: doctors have kept records of their encounters with patients since the time of Hippocrates. But changes in record-keeping practices have both reflected and enabled the development of modern scientific medicine, which is less concerned with patients and more with their diseases. Today’s doctors are taught to get a comprehensive history from each patient and to document it in a highly structured way, beginning with the complaint and the patient’s account of it, followed by the doctor’s observations and assessment of the case and, finally, the management plan, whether that is the initiation of treatment, the ordering of tests or simply a note that the patient was reassured. Recording the history isn’t just a matter of documenting a few facts: it’s part of the process of working out the case. It is also, in a way that might not be immediately obvious, creative work. The doctor’s diagnosis and the information he or she records is new intellectual property – property that can be, and is, bought and sold.

Large collections of medical records are enormously valuable. How useful they can be was made clear in 2004, when researchers from the London School of Hygiene and Tropical Medicine were looking for evidence that might help restore confidence in the MMR vaccine in the aftermath of the alarm caused by the gastroenterologist Andrew Wakefield’s suggestion that the vaccine was linked to autism. They searched an earlier version of the database now known as the Clinical Practice Research Datalink, and identified 1294 children diagnosed with autism or pervasive developmental disorder (‘cases’) and 4469 children without such a diagnosis but matched for age, gender and GP practice (‘controls’). The database included the immunisation records of the two groups in the years leading up to the diagnosis, and the team was able to show that the vaccination rates of cases and controls were roughly comparable. This meant it was highly unlikely that the vaccine was causing autism. The paper appeared in the Lancet and its findings were widely reported in the media as demonstrating that MMR was safe. Thousands of studies have used the CPRD or similar databases to investigate the risks and benefits of common drugs (statins, biophosphates, low-dose aspirin), or to examine the relationship between risk factors and outcomes (the way the relationship between blood pressure and cardiovascular disease plays out in different age groups, at different levels of blood pressure or in different forms of cardiac complaint, for example), or to consider whether common diseases affect distinct subgroups of patients who might benefit from different treatments.

The CPRD began as a business idea. In the late 1980s a number of companies began selling IT to GPs. The trade was given an unexpected fillip in the early 1990s when the Thatcher government introduced GP fundholding, making GPs responsible for purchasing elective and non-urgent services for their patients. The new administrative burdens associated with this effectively required GPs to computerise their practice records. One firm, VAMP Health, seemed particularly attractive because it gave away the software and hardware for free. All the GP had to do was to agree that VAMP could collect the practice’s anonymised data about patients, data VAMP could then sell on. In 1993 Reuters Health Information acquired the company, but after discovering that some parts of the business were mired in expensive contracts, it gave the database to the Department of Health. The CPRD is now controlled by the Medicines and Healthcare Products Regulatory Agency. It will supply data, for a substantial fee, to researchers whose proposals must pass a strict test of scientific merit as well as reaching appropriate ethical standards. Commercial organisations can apply but will only be considered if their research is deemed to be in the public interest.

The CPRD holds some or all of the GP records for more than 20 million patients, from more than 800 GP practices in the UK. The data, which is uploaded automatically from the IT systems used by participating GPs, includes everything these GPs record about their patients: diagnoses, hospital referrals, prescriptions, vaccinations, test results, whether they smoke, how much they drink. All this information is added to the database without the patient’s consent. Although that may seem at odds with a patient’s rights, it is crucial to the data’s value: if you ask for consent not everyone will give it, and, worse, the people who do give consent aren’t typical, so the data no longer tells you what you need to know. The legal and ethical justification isn’t, however, based on the value of the resource or the science it enables, but on the idea that since the data is anonymised, the patient no longer has any rights over it.

The full text of this essay is only available to subscribers of the London Review of Books.

You are not logged in