On Monday, Theresa May announced that the government wants to encourage greater use of healthcare data to develop artificial intelligence technologies. Specifically, AI that can help in the early diagnosis of cancer. There is currently no sign of adequate consent, or any information, about how access to the healthcare data will work.

Today, NHS Digital launches a new data opt-out programme in response to recommendations from Fiona Caldicott, the National Data Guardian. The programme will let people state if they don’t want healthcare data about them to be used for reasons outside their individual care. Have you heard about it? I’m not surprised if you haven’t. There’s been very little published in the media, academic journals or…anywhere.

We’ve been here before.

Care.data ended in 2016, after the data sharing scheme was badly designed and its purpose poorly communicated.

Illustration by David Marques / IF CC BY-SA

At IF, our work has shown us that to treat consent as ‘all or nothing’ is not good enough. Care.data was not fit for purpose and I fear the data opt-out programme will suffer a similar fate.

That’s because an absolute opt-in and opt-out doesn’t give people enough choice, and it doesn’t represent how complex health data is. It also assumes people have the time and understanding necessary to make the decision, which they often don’t.

An opt-in or opt-out doesn’t give people the ability to easily or quickly change their mind as their health, or perception of risk, changes over time. There’s a lot of technical nuance here too, for instance it’s difficult to remove data about an individual from a learned system after the data was added.

By its very nature, the volume and variety of healthcare data increases when you are ill. People who have a chronic illness or multiple conditions have more healthcare data that describes them. A single opt-out doesn’t accommodate for changes to their health over time or give people the ability to share only certain kinds of data at different stages of their care. It’s also not compatible with the fact that lots of healthcare data describes more than one person (for example, a thyroid condition may describe a hereditary trait).

Designing consent as an individualistic action is also self-limiting. It relies on someone to make the choice for themselves, in a complex area, where people sometimes need to rely on support from organisations to make decisions. That’s important within healthcare, as people are asked for consent at times when they are most stressed or unwell.

With more and more data being collected across the healthcare system, including by home healthcare devices, and with more complex, data-hungry technologies being deployed in healthcare - we need something different.

Here are a few thoughts on how the NHS could take a different approach:

  • People must be given new ways to decide how healthcare data about them may be shared, when, who with and for what purpose - and they should be able to change their mind. This needs to happen in a way that represents their experience of healthcare and how they live their lives.

  • The NHS should seek the help of experts to design consent and data governance that works for patients, clinicians and society.

  • The public should be able to continually influence what consent choices they are given. Consent must work for healthcare data that doesn’t describe an individual but a family or a relationship.

  • There needs to be strong design leadership from the NHS Digital board to ensure the consent system is trusted and understood. That means taking a multidisciplinary approach to technology, research, design and policy.

  • Either the Care Quality Commission and NHS Digital need new capabilities, or a new organisation -should be setup. It must understand how technologies like AI work and it must be capable of verifying that consent choices are being respected.

  • Through well-designed services, it should be possible for third parties (or interested individuals) to verify how healthcare data is being used.

  • To enable the public to trust that their consent choices are being respected, privacy, accountability and transparency must be core principles in the design.

Data ethics is evolving, it’s challenging and public perception is shifting too. The NHS must do more to ensure data has consent choices that helps people make the right decision for them and those they care for.

The NHS has the opportunity to champion excellent data ethics and consent. They should start now.