Some GPs risk violating GDPR by signing up to changes in childhood health data sharing

The BMA warns changes to a system that collects immunisation data risks breaching the 'data minimisation' principle

A photo of a doctor with GDPR overlayed in the foreground

As many as 3,300 GP practices in England risk violating data protection laws if they sign up to changes in a data sharing agreement for childhood vaccination.

Changes to the Child Health Information Service (CHIS), used by general practitioners in the West Midlands, parts of London and the South West of England, may have rendered it non-compliant with the EU's General Data Protection Regulation (GDPR).

GPs offered to register to a new data extraction system, which feeds childhood vaccination and immunisation data into a centralised database, should wait until these concerns are addressed, the British Medical Association (BMA) said in a newsletter on Friday.

The BMA told IT Pro the advice centres around concerns the new system does not meet the principle of 'data minimisation' outlined in GDPR and the Data Protection Act 2018.

According to data minimisation organisations, or data controllers must minimise data processing to an absolute minimum; that no more data is collected than is required to carry out the functions outlined.

"Having received legal advice, the GPs committee is concerned that practices using the new proposed extraction system to share childhood immunisation data may be placing themselves in breach of GDPR," said the BMA's GP committee chair Dr Richard Vautrey.

"We have now received assurances from the local commissioners of this service that no GP practice in the West and North Midlands will be asked to sign up to this process until the matter is resolved.

"Our advice when being approached to sign any new data sharing agreements pertaining to changes to the CHIS in England is that no GP practice should sign up to any new extraction system until our concerns have been addressed."

A CHIS is an NHS-commissioned service responsible for collating data from various organisations for all children aged 0 to 19 that fall under its remit, depending on which regions of the country are signed up to the system.

This data, ranging from a newborn blood spot to information about vaccinations, is extracted and merged into one single Child Health Record (CHR), according to Health Intelligence, the firm which developed the system.

Despite no involvement in the actual development of CHIS, GPs who nonetheless engage with the system risk violating data protection laws.

IT Pro approached Health Intelligence for a statement but had not received a response at the time of publication. 

Featured Resources

Unleashing the power of AI initiatives with the right infrastructure

What key infrastructure requirements are needed to implement AI effectively?

Download now

Achieve today. Plan tomorrow. Making the hybrid multi-cloud journey

A Veritas webinar on implementing a hybrid multi-cloud strategy

Download now

A buyer’s guide for cloud-based phone solutions

Finding the right phone system for your modern business

Download now

The workers' experience report

How technology can spark motivation, enhance productivity and strengthen security

Download now

Recommended

Misconfigured Git servers lead to Nissan data leak
hacking

Misconfigured Git servers lead to Nissan data leak

7 Jan 2021
BackupAssist teams with Wasabi to offer cheaper backup for businesses
backup

BackupAssist teams with Wasabi to offer cheaper backup for businesses

6 Jan 2021
Data: A resource much too valuable to leave unprotected
Whitepaper

Data: A resource much too valuable to leave unprotected

2 Dec 2020
Webhose and Signal Corp boost data breach detection
Security

Webhose and Signal Corp boost data breach detection

7 Oct 2020

Most Popular

WhatsApp could face €50 million GDPR fine
General Data Protection Regulation (GDPR)

WhatsApp could face €50 million GDPR fine

25 Jan 2021
How to move Windows 10 from your old hard drive to SSD
operating systems

How to move Windows 10 from your old hard drive to SSD

21 Jan 2021
What is a 502 bad gateway and how do you fix it?
web hosting

What is a 502 bad gateway and how do you fix it?

12 Jan 2021