IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Some GPs risk violating GDPR by signing up to changes in childhood health data sharing

The BMA warns changes to a system that collects immunisation data risks breaching the 'data minimisation' principle

A photo of a doctor with GDPR overlayed in the foreground

As many as 3,300 GP practices in England risk violating data protection laws if they sign up to changes in a data sharing agreement for childhood vaccination.

Changes to the Child Health Information Service (CHIS), used by general practitioners in the West Midlands, parts of London and the South West of England, may have rendered it non-compliant with the EU's General Data Protection Regulation (GDPR).

GPs offered to register to a new data extraction system, which feeds childhood vaccination and immunisation data into a centralised database, should wait until these concerns are addressed, the British Medical Association (BMA) said in a newsletter on Friday.

The BMA told IT Pro the advice centres around concerns the new system does not meet the principle of 'data minimisation' outlined in GDPR and the Data Protection Act 2018.

According to data minimisation organisations, or data controllers must minimise data processing to an absolute minimum; that no more data is collected than is required to carry out the functions outlined.

"Having received legal advice, the GPs committee is concerned that practices using the new proposed extraction system to share childhood immunisation data may be placing themselves in breach of GDPR," said the BMA's GP committee chair Dr Richard Vautrey.

"We have now received assurances from the local commissioners of this service that no GP practice in the West and North Midlands will be asked to sign up to this process until the matter is resolved.

"Our advice when being approached to sign any new data sharing agreements pertaining to changes to the CHIS in England is that no GP practice should sign up to any new extraction system until our concerns have been addressed."

A CHIS is an NHS-commissioned service responsible for collating data from various organisations for all children aged 0 to 19 that fall under its remit, depending on which regions of the country are signed up to the system.

This data, ranging from a newborn blood spot to information about vaccinations, is extracted and merged into one single Child Health Record (CHR), according to Health Intelligence, the firm which developed the system.

Despite no involvement in the actual development of CHIS, GPs who nonetheless engage with the system risk violating data protection laws.

IT Pro approached Health Intelligence for a statement but had not received a response at the time of publication. 

Featured Resources

The state of Salesforce: Future of business

Three articles that look forward into the changing state of Salesforce and the future of business

Free Download

The mighty struggle to migrate SAP to the cloud may be over

A simplified and unified approach to delivering Enterprise Transformation in the cloud

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

The Total Economic Impact™ Of IBM FlashSystem

Cost savings and business benefits enabled by FlashSystem

Free Download

Most Popular

Why convenience is the biggest threat to your security
Sponsored

Why convenience is the biggest threat to your security

8 Aug 2022
How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

29 Jul 2022
Cyber attack on software supplier causes "major outage" across the NHS
cyber attacks

Cyber attack on software supplier causes "major outage" across the NHS

8 Aug 2022