Calderdale GP patients’ real-time medical data are being shared without their knowledge or consent

  • In order to identify how many patients can be allocated to new, less-skilled “additional” practitioners instead of GPs, Calderdale Primary Care Networks are analysing their patient lists using a commercial digital platform that requires the unconsented sharing of patients’ real-time personal GP medical records
  • Calderdale Clinical Commissioning Group says this is legal – no confidentiality is breached since the data is securely pseudononysed.
  • Because of this they do not inform patients and ask for their consent before their confidential medical records are used in this work.
  • They claim that they do not have to respect patients’ National and Type 1 data-sharing opt outs, because the data sharing doesn’t breach confidentiality.
  • And they add that “arguably” they can legally circumvent the national Caldicott policy that patients should be permitted to opt out of some kinds of processing – because: “the national policy focuses on disclosures of data, which processing using a data processor for internal purposes arguably is excluded.”

There are five Primary Care Networks in Calderdale, each serving around 30K-50k patients. They are introducing an accountable/managed care model that aims to cut unplanned hospital attendance and admissions for the most expensive categories of frail and chronically ill patients and to provide various kinds of care in the community.

The patient list analysis is key to this new care model. Using the Edenbridge Apex GP Practice online platform, Calderdale’s Primary Care Networks are sharing our confidential personal GP data among themselves, the Calderdale GP Federation, the Clinical Commissioning Group and “at Sustainability and Transformation Partnership level” – meaning both the Calderdale Sustainability and Transformation Partnership and the West Yorkshire and Harrogate Sustainability and Transformation Partnership (now Integrated Care System).

Planning for a new workforce and types of appointments

In a Freedom Of Information response, Calderdale Clinical Commissioning Group have justified GPs’ use of the commercial digital platform on the grounds that,

“The Apex Insight tool offers practices a comprehensive workload analysis and workforce planning capability (software and support) to make informed decisions about the future.”

Replacing GPs with “additional roles”

Asked about the tangible, measurable benefits of the use of the ApexInsight tool to patients and Primary Care Networks, Calderdale Clinical Commissioning Group told me,

“This tool supports PCNs to develop workforce plans, including effective use of the nationally supported Additional Roles Reimbursement Scheme. This aims to benefit patients through ensuring they see the right person at the right time, closer to home and also enables PCNs to understand how best to utilise the new roles. The tool also support practices to understand what types and level of demand and build the right capacity and type of appointments. This should improve access to general practice for patients”

The corporate blurb…

However some GPs and many NHS campaigners see the Additional Roles Reimbursement Scheme primarily as a means of replacing GPs with cheaper, less skilled and less qualified grades of practitioners – with the result that patients’ continuity of care becomes a thing of the past and GPs will only see patients with the most complex intractable ailments, leaving the rest to the attentions of the Additional Roles practitioners.

The Royal College of GPs Chair has drawn attention to:

“…a trend which has made the practice of relationship-based care more challenging for many GPs over decades. This trend has been driven by rising workload, performance-managed contracts and the protocolisation of care, as well as by societal and demographic changes…

I believe that the dilution or loss of the relational element of general practice would damage the quality of patient care, the efficiency of the NHS, and the specialty of general practice and that’s why it’s a priority for our College…relationship-based care is a fundamental feature of effective general practice and I think that our ability as GPs to deliver it is at risk.”

In September 2019, the Upper Calder Valley Primary Care Network Clinical Director Dr Nigel Taylor told a meeting of Hebden Royd Town Council that Hebden Bridge Group practice had had to make “difficult decisions” that included “diversified staffing”. This was the result of:

  • years of underfunding of GP practices
  • the loss of 5 out of 12 GPs for personal reasons since February 2018,
  • an increasing number of patient appointments

Unable to recruit to replace the 5 GPs, the Practice had engaged “alternative” staff who were providing patient contact. The Practice was having to work in a new way as a result. Dr Taylor said there were pros and cons of the new system but they can’t provide same service as they used to.

PA Consulting, which together with Edenridge Healthcare Ltd developed the Apex Insights tool, says its ‘business model framework’ provides the solution to such problems :

“In a recent analysis for a major provider, we found the need to achieve a 10-fold reduction in cost of care to meet the expected price. Such reductions are only possible by revisiting the care model assumptions and leveraging technology solutions, such as highly precise risk stratification, remote monitoring and telehealth.”

Such “care model assumptions and technology solutions” are key to the new “care closer to home” scheme that’s being set up in Calderdale and elsewhere.

This is shifting the NHS away from meeting patients’ clinical needs on the basis of doctors’ and patients’ joint decisions about the most appropriate treatment. Instead, actuarial methods common in the insurance and finance industries are increasingly used to determine patients’ treatments. Doctors’ clinical assessment is sidelined in favour of statistical methods that predict financial risks and rewards.

Be that as it may, Calderdale Clinical Commissioning Group are providing training and extra funding (amounting to £3/patient), so that Primary Care Networks are able to use the Apex Insights tool and carry out Population Health Management work that “risk stratifies” patients into cohorts, based on the likelihood or not that they are at risk of unplanned hospital attendance/admission.

This was approved by the Calderdale NHS Commissioners Primary Medical Services Committee when it met virtually last October (2020).

Under NHS England’s orders

Analysis of GP patient lists using the Apex Insights Tool is at the behest of NHS England (the National Commissioning Board). In 2018 the quango announced it intended to purchase licences for the Apex Insight Tool for all GP practices in the North of England. It seems that NHS England undertook “some assurance of” Edenbridge’s approach to establishing Information Governance and Data Sharing Agreements/ Data Protection Agreements. Apparently this saved the Clinical Commissioning Groups some work:

“With the data feeds being used by the Apex tool being common across CCGs and GP systems (EMIS and TPP), artefacts such as Privacy Impact Assessments should be able to be re-used by CCGs to support deployment activity.”

Commissioners say patients’ consent is not required as their data is pseudonomysed

Calderdale Clinical Commissioning Group told me the legal basis for Primary Care Networks sharing patients’ confidential medical data without their knowledge or consent is taken from the NHS Calderdale Data Protection Impact Assessment Screening Questions (19.07.19), which they cite:

“All patient-related data held in Apex is de-identified through pseudonymisation. The pseudonymisation process is performed within the Principle Clinical System environment. All directly identifiable fields are either removed (e.g. patient name), abbreviated (e.g. date of birth is abbreviated to year of birth) or hashed (e.g. NHS Number). All fields that may contain free text entered within the clinical system are removed. Data marked as Sensitive or whole records marked as confidential are removed.
The pseudonymisation process uses an open source standard created by The University of Nottingham called OpenPseudonymiser, full details are available online at This is a one-way salt encryption/hashing process that cannot be reversed.
No key/mapping tables are built, maintained or stored which would allow a data subject to be re-identified.”

They add that “arguably” this means they can legally circumvent the national Caldicott policy that patients should be permitted to opt out of some kinds of processing – because:

“the national policy focuses on disclosures of data, which processing using a data processor for internal purposes arguably is excluded.”

The Clinical Commissioning Group added,

“Regardless of this point, the policy makes clear that any disclosure or use that does not breach patient confidentiality is itself excluded from the opt-out requirements. The processing of pseudonymised data via APEX does not breach confidentiality so it is excluded. Note that the national opt-out test is based upon the common law, not GDPR, and the fact that the data remains personal data is not relevant to this test – it is simply whether or not a breach of confidentiality law is involved. The security provided by the pseudonymisation process is sufficient to maintain confidentiality.”

To back up their claim, Calderdale Clinical Commissioning Group provided an extract from the National data opt-out operational policy guidance, Section 2.2:

“The national data opt-out does not apply to information that is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice (CoP) on Anonymisation or is aggregate or count type data. It should be noted that the ICO Code of Practice covers a range of anonymised data including aggregate data for publication to the world at large through to de-identified data for limited access. De- identified data for limited access requires a suite of additional organisational and technical control measures to ensure that the risk of re-identification is remote, for example access controls, purpose limitation, staff confidentiality agreements, contractual controls etc”.

Follow the money

Apex Insight Tool was developed by PA Consulting Group Ltd and Edenbridge Healthcare Ltd.

PA Consulting Group Ltd (now 65% owned by US-based Jacobs ) is one of the NHS England-approved suppliers on the Health Systems Support Framework. This lists companies (and a handful of NHS Commissioning Support Units that subcontract to private companies) that Clinical Commissioning Groups can contract to provide the resources and carry out the commissioning functions needed to set up Integrated Care Systems (formerly known as Sustainability and Transformation Plans/Partnerships).

Population health management is key. As well as analysing patient data to risk-stratify patients according to the type and cost of care they need, population health management programmes analyse patients’ data in order to identify patterns of illness across an area and the resources needed to deal with these population patterns of illness. According to PA Consulting, their population health management tools use

“a comprehensive business design approach” that allows healthcare “providers” to “achieve specific financial results”, as they plan their “population health program starting with a revenue number in mind.”

Reducing “demand” to cut NHS costs – by £224m by 2023/4 across West Yorkshire and Harrogate

Calderdale Primary Care Networks need to plan their population health programme “with a revenue number in mind” because NHS England now requires Clinical Commissioning Groups to use a fixed payment method of paying NHS providers. This is to control spending in Integrated Care Systems.

Over the four years 2020/21 – 2023/4, West Yorkshire and Harrogate Integrated Care System have to secure £224m “efficiencies/productivity improvements” – based on the Comprehensive Spending review in November 2020. That means that they have to cut spending by £224m over that period – although the Integrated Care System told me,

“efficiencies don’t equate to cuts” but “can be secured”, for example by “changing clinical pathways…improving [hospital] discharge processes…or review of medications.”

However, according to this report,

“ the fixed-income contract approach is designed to control activity levels…rather than trying to find ‘savings’…How can we reduce demand, and therefore reduce costs?”

Comment has been invited from Upper Calder Valley Primary Care Network Clinical Director, the Hebden Bridge Group Practice Business Manager (whose out-of-office email said he is on holiday), four Hebden Royd Town Councillors who were closely involved in the September 2019 Town Council meeting with Dr Nigel Taylor, the Pennine GP Alliance Confederation and a Hebden Bridge Group Practice Patient Representation Group member. They did not reply (apart from the Business Manager’s out-of-office voice mail).

National Data Opt Out links

Bit of info here from 2016 about the early stages of making the national Caldicott policy on opt outs.

Info here on the National Data Opt Out, introduced in May 2018.


  1. I do not want my data to be used to triage me – and my family and my neighbours and my wider community – into those who will/will not receive care decided on the basis of cost, instead of on the basis of clinical need. This runs completely contrary to the NHS ethos of socialised care.

    The NHS has always had high level software to predict need at national level. The new “Apex Insight Workload and Workforce Planning for Primary Care” software pushes that planning down to regional level in order to put a noose around the neck of the fundholder(s) and force them to stop spending on particular groups of patients at local level. The fundholders are forced to (1) buy CONTROL software such as Apex” in order to (2) to stop them providing medical care! Apex and other associated software is stiffling the clinical judgement of GPs. No wonder GPs are tired of the unequal struggle against the “protocolising” machine and the US medical software purveyors.

    There is an increasingly sharp conflict between GPs and their fund providers.

    This is morally very offensive to me. I want to find a way, any way to resist it. We must show the public that this is a major part of privatisation of the NHS. Secondly the integrity of NHS data depends on our honesty. I may be forced to become dishonest and encourage my family and friends to do the same.


Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.