Want to see an NHS doctor? Prepare to cough up your data first.

To get a doctor’s appointment in the U.K. these days, you have to entrust more of your data to private companies — and there’s not a great deal you can do about it.

In part due to growing pressure from the government to meet a two-week limit for patient appointments, family doctors — or general practitioners (GPs) as they’re known in the U.K. — are turning to third-party software to facilitate appointments and prioritize cases based on urgency, a shift that has left patients with no option but to give private companies access to their personal data.

While the U.K.’s National Health Service (NHS) was once a bastion of state-funded care, where an individual’s economic disposition had little bearing on their access to medical services, today it’s a somewhat different matter — a victim of chronic underfunding and understaffing with record waiting times for routine hospital treatments and working conditions that have led to doctors, nurses and other clinicians striking en masse.

With the government pushing for further privatization, corporations have been circling for pieces of the billion-dollar health pie. The NHS has struck controversial data-sharing deals with the likes of Google’s DeepMind, while a slew of U.S. tech companies including Google, Microsoft, and Palantir were awarded contracts as part of the NHS’s COVID-19 datastore project four years ago.

At the same time, primary care has also been infiltrated, where for many it’s now impossible to get so much as a simple checkup at the local clinic without having to divulge personal information to private companies.

There is no singular body that tracks which GP clinics are using which software, as this type of data is not centralized in that way — NHS England told TechCrunch that because it is made up of different organizations, we would need to make individual requests to individual GP clinics or local integrated care boards (ICBs) that make up the NHS throughout the U.K. However, in our research, we found a growing number of clinics are using private companies to triage primary care appointments — with no way around it.

One such company is Klinik, which says it’s now live across 300 NHS GP clinics in the U.K., while Econsult says it’s used by 40%. And Patchs Health said it “supports over 10 million patients across the NHS.”

IT dependency in the NHS, as with many other sectors today, is becoming the norm. By way of example, a system used by two-in-five GP clinics to manage prescriptions, patients records, and appointments went down last year, leading to significant disruption in their operations — and this wasn’t an isolated incident, with local healthcare media taken to tracking the problem.

But while cozying up to the private technology sector is nothing new, what is new is the growing inability to get the most basic form of NHS healthcare without giving private companies access to your personal information. And if you don’t like it — tough.

Value of data

The more that data spreads, the higher the risk it will find its way into places where it can be used against patients’ interests. And regardless of what promises may exist in privacy policies or are otherwise enshrined in regulation, health data’s value is such that the incentives to share it may be too high to resist. For example, a recent investigation by the U.K.’s Observer newspaper revealed how sensitive health information belonging to half-a-million U.K. citizens that had been donated for medical research was eventually shared with insurance companies — not quite what the participants had agreed to.

It’s difficult to put a precise monetary value on NHS data, Ernst and Young (EY) says that the potential insights enabled by the vast NHS datasets could be worth as much as £9.6 billion ($12 billion) annually. Indeed, the NHS holds what is deemed by many to be the Holy Grail of health data for various reasons — this includes the comprehensiveness of its national coverage; its longitudinal data collection spanning decades; and also the way it has recorded and stored patient records in a consistent, standardized format that makes it easier for machines to parse.

For instance, doctors codify data using structured clinical terminology such as SNOMED, READ and CTV3.

“That means that this data is more easily and consistently machine-readable,” Marcus Baw, a locum GP, software developer and self-proclaimed ‘general hacktitioner,’ explained to TechCrunch. “In other countries, the clinical data is far more in free text, and therefore less easily analyzable.”

This is particularly important as AI encroaches further into the healthcare realm, as the current U.K. Government is very much in favor of. For AI to more accurately interpret a piece of data, the data collection needs to be standardized.

Baw juxtaposes the free-text data input “renal cell carcinoma was not found” with “renal cell carcinoma is the diagnosis” — a negative and positive diagnosis respectively. This difference, while obvious to the human eye, “would probably defeat AI, in that it could do it, but not consistently enough to be safe,” Baw said. “Keyword matching would tend to pick up ‘renal cell carcinoma,’ but the surrounding context, and in particular the negation, is not quite as easily computerized.”

Two-week target

This writer tried to request an online appointment through a GP’s website, and was directed to a third-party system developed by Klinik, a VC-backed Finnish startup that partners with clinics to provide “advanced AI triage and patient flow management solutions.”

The Klinik portal serves up various health-related questions about the nature of the condition, including symptoms.

This culminates in a form requesting several further pieces of personal data — name, date-of-birth, mobile number, address, and NHS number.

The GP clinic does provide an option to make an appointment by using the NHS login system, but that ends up at exactly the same place — the patient is requested to give Klinik access to their personal information.

For those unable or unwilling to use this form, the GP clinic’s automated telephone system informs the caller that they can stay on the line to be put directly through to a member of staff — however, the staff member will manually complete the exact same Klinik form on the patient’s behalf.

In other words, there was no way to make an appointment to see a GP without agreeing to give Klinik’s system access to your data. And the stated reason was the government’s appointment timescale target.

“Klinik was introduced in response to the government stating we need to provide patients an appointment within two weeks, and also to make the system fairer,” this writer was told by the clinic in question.

Automated triaging software is designed to ease a burdened NHS healthcare system, guiding patients toward self-help information for minor ailments — it promises to prioritize more urgent cases, saving GPs and their staff from having to converse with every single patient.

The benefits and risks of introducing more automation to clinical decision-making is a discussion in itself, but the big trade-off in the current environment is entrusting personal information to third-parties.

Klinik’s privacy notice confirms that it uses Google Cloud for hosting and storage in the U.K., as well as Microsoft for “data reporting” purposes around “pseudoanonymized personal data” — more specifically, Klinik said that it uses Power BI to create reports for its clients “on an aggregated level” that support managerial decision-making.

“Selected aggregated statistics are also necessary to be monitored on our side for post-marketing surveillance of the system due to medical device requirements,” Klinik told TechCrunch.

On the data privacy and control side, Klinik’s policy states that the third-party processors it uses, including Google and Microsoft, are “subject to clear contractual restrictions to only use your personal data as we instruct them to do so, and subject to appropriate security measures.”

The spokesperson added:

There are multi-level security layers in place for gaining access and combining different aspects of the data. In that sense, only parties that we allow access to certain data — as per customer request/allowance — can have access to it.

Google owns the physical premises and hardware for where the data is located — for that, we do not have any control upon except contractual agreements. As per Google procedures, however, having physical or technical access does not in any way mean that the data is accessible, as encryption keys and logic for combining scattered data is needed.

Regardless of what privacy policies might state, and whatever security measures might be in place, history is littered with examples of data being misused or mistreated (deliberately or otherwise). The more third-parties that have access to data, the more likely something will go awry somewhere.

Another London-based clinic TechCrunch contacted for this story said that it exclusively uses Patchs Health for appointments, again with no way around it. Patchs is developed by London-based AI and data science consultancy Spectra Analytics.

“We use Patchs for all patients’ requests and as a triage tool,” the clinic manager said. “The requests can be submitted by patients themselves or our reception staff can submit the requests on the patients behalf if they are unable to do so themselves by asking the few questions either over the phone or in person.”

The manager pointed to various reasons why it no longer accepts appointments without using triaging software, including reducing delays in urgent cases, preventing system overcrowding, improving patient safety and satisfaction, and identifying potential red flags through automation.

“Without triage, patients with critical conditions may have to wait longer for an appointment, potentially delaying their treatment and increasing the risk of adverse outcomes,” they said. “Triage plays a vital role in ensuring that our practice functions efficiently and effectively. By prioritizing urgent cases and managing patient flow, we can provide timely and appropriate care to all patients, improving their safety and satisfaction while optimizing our resources.”

Data ‘controllers’

Legally, GP clinics are deemed to be the data “controllers,” while intermediary software providers are data “processors.” And this is a point that Klinik was keen to stress, that patients don’t “give away” personal data, insofar as it doesn’t technically own the data — it’s more of a custodian.

“Yes we do store data, but only pseudonymised and, again, on behalf of the GP practice,” Klinik said. “The only way that any data is ‘used’ is to provide anonymised statistical data to the practices in dashboards, so they can better understand their demand to organise themselves better, and — only if the patient consents — we as a company use data that is anonymised to improve the calculations of our algorithm. But again, in that case no personal data is transferred to us.”

Things can get a little more complex though. Digging into Patchs’ privacy policy, for instance, reveals that it is in fact a data “sub-processor,” responsible for developing and maintaining the software. The main data processor contracted to deliver the service is actually Advanced, a private equity-backed company that develops various industry-specific software. The company was acquired and taken private by Vista Equity Partners in 2015, with BC Partners buying a portion of it four years later.

This is somewhat similar to Patient Access, which for millions of U.K. patients serves as the gateway to their local doctor, used to book appointments, order repeat prescriptions, and more. But Patient Access is in fact owned by EMIS Health, which five months ago was acquired by Bordeaux UK Holdings II Limited, an “affiliate” of Optum UK which in turn is a subsidiary of UnitedHealth Group — a $500 billion health and insurance multinational, one of the largest health care companies in the U.S. and the 11th largest company globally by revenue. On that note, a separate UnitedHealth Group subsidiary was recently hit with a ransomware attack, disrupting the U.S. healthcare system and sparking fears that patient data could spill online.

This brings into focus the value of the NHS brand, and how easy it is to inadvertently agree to open up access to data without really meaning to — the NHS logo can disguise multiple layers of corporate ownership. The Patient Access mobile app and website features the NHS logo prominently, even though it’s a private company and isn’t exclusively used for NHS services. When a patient is making an appointment with their GP, they’re not thinking in terms of “how can I protect my data here, and what am I signing up for?,” they’re just trying to see their doctor as quickly as possible.

So even if you’re happy to embrace technology and open access to a little data, it’s difficult to know exactly who you’re entrusting it to, and where even it might end up via a complex web of acquisitions and partnerships.

And then there is the issue of liability — who is actually responsible for safeguarding what, and what happens if things go wrong?

“In theory, it makes no difference most of the time as the NHS should have done appropriate checks, but in practice it makes no difference until suddenly it does, and the company the NHS thinks it can sue has no assets and claims no responsibility because of legal games,” Sam Smith from health data privacy advocacy group MedConfidential told TechCrunch.

Furthermore, while triaging software might help alleviate stress from an over-stretched workforce, it also opens the door to all manner of dubious behavior, where users inadvertently agree to sharing their data outside the confines of their direct care.

By way of example, during Patchs’ signup you have to opt-in to sharing (anonymised) data for research purposes, and must reenter the system afterwards to opt out. It says:

We may share anonymised data from yourself and those you care for with The University of Manchester for research purposes, and with other GPs for monitoring purposes, to make sure Patchs is safe and delivering its intended benefits. ‘Anonymised’ means you cannot be identified. At any time, you can stop sharing your anonymised data with The University of Manchester for research purposes on the ‘Data Privacy’ page accessible via the top menu after creating an account and logging in. This will not affect your ability to continue to use Patchs to access GP services.

Separately, the privacy policy also states that it will share patients’ contact details with the University of Manchester “when patients opt-in to sharing them,” however there is no obvious avenue in the registration process either for opting in, or out, of sharing these details with the University of Manchester.

TechCrunch reached out to both Patchs and Advanced to provide comment and clarification for this article, but they declined.

Sharp transition

None of this is an entirely new phenomenon, as the patient-doctor relationship has become increasingly digitized through the years. But what does seem to have changed is the sharp transition to an extreme where patients can no longer see their doctor without agreeing to use software belonging to — directly or indirectly — billion-dollar corporations and VC-backed startups.

“I think it’s recent that it’s gone to the extreme, but the general trend has been towards this for about 10-15 years,” Baw said. “These patient platforms have been coming slowly, but it’s only since COVID, really, that this uptick happened, where everything happens through a patient access platform.”

Your own individual experience of this will depend where you live — some practices still operate more traditional booking processes that don’t require giving data over to third-party software providers. But London in particular seems to be more heavily impacted by the shift, and it could be a bellweather for what’s to come elsewhere.

“It’s just a reflection of the relative digital impoverishment of the rest of the country,” Baw added. “London has been home to flagship GP digitisation programmes, which brought additional resourcing. This didn’t happen in the rest of the country.”

When asked whether it supports patients that aren’t comfortable giving private companies access to their data in order to see a doctor, NHS England issued a statement saying that GPs themselves, as the data controllers, are responsible for safeguarding data and must comply with the relevant laws.

“GPs are responsible for the protection of personal data that identifies patients and must comply with the General Data Protection Regulation (GDPR),” the statement read. “Patients are provided with information by their GP about how their data will be used, who will have access to it, and what security measures are put in place. They can exercise an opt-out to prevent their data being shared for purposes beyond their direct care. Digital platforms must employ secure communication methods to protect personal data used for online consultation, remote triage, appointment booking or other patient services.”

So there’s no automatic expectation that patients can see an NHS GP without giving over data to private companies.

Mining

There is nothing to suggest any misdeeds from these various companies as it pertains to patient data, but it’s emblematic of a broader trend that has seen the NHS engage more private data processing providers. This data is a huge commodity that many private companies would dearly love to mine (even if they aren’t yet) — and judging by new contracts being signed elsewhere in the NHS, it’s not going to end any time soon.

Palantir, co-founded by billionaire libertarian Peter Thiel in 2003 with funding from the CIA, is a big data analytics company used extensively by the U.S. government and security agencies including Immigration and Customers Enforcement (ICE) for detaining and deporting immigrants. The company was awarded a £25 million contract to help NHS England transition to a new Federated Data Platform (FDP) designed to merge and aggregate operational data from across myriad NHS silos in England. The problem, it seems, is that there are too many different patient-care entities using too many different systems, creating too many hurdles for timely collaboration and administration of patient care across England.

Palantir was subsequently awarded a further £330 million contract to run the actual FDP itself, much to the chagrin of general practitioners (GPs) and data privacy advocates across the country. As a side note, news swiftly emerged in January that the NHS was investigating claims that Palantir had launched an influencer marketing campaign to counter criticism of Palantir’s involvement in the data platform it was contracted to build — not a great start.

While optimizing the flow of operational data across the various entities that constitute the NHS is subject for debate in itself, what we’re seeing now is that it is becoming increasingly difficult to get even the most basic form of primary care without agreeing to give private companies access to personal data.

If the Facebook / Cambridge Analytics scandal taught us anything, once the damage is done, it’s done — no amount of punitive action can reverse the consequences of data devilry. The core mission of profit-making companies is to find ways to make as much money as possible, even if that might sometimes mean playing loose and fast with whatever rules might be in place — and that is why there is so much anxiety around the NHS’s current trajectory.

“The way that corporations work is that if your shareholders get wind of the fact that you have exploitable IP, and you’re not exploiting it, the board could sack the CEO and say, ‘why aren’t you you? We expect a return on that investment,’ Baw said. “That’s the kind of tension we’re dealing with. The NHS is quite an extreme socialist construct, and on the other extreme we’ve let in venture capital, which is extremely psychopathic — it sees only one thing as having value, and that is the bottom line.”