From: nobody@REPLAY.COM (Anonymous)
Date: Mon, 27 Nov 1995 11:52:36 +0800
To: cypherpunks@toad.com
Subject: For sale: your secret medical records
Message-ID: <199511270120.CAA06893@utopia.hacktic.nl>
MIME-Version: 1.0
Content-Type: text/plain



The Sunday Times, Top page one, 26 Nov 1995

For sale: your secret medical records for L150

by Lois Rogers and David Leppard

Confidential medical records of politicians, celebrities
and millions of other National Health Service patients
can be bought on the information black market for L150.

The contents of the files comprising patients' most
personal health details dating back 30 years, are being
sold to order by high-street detective agencies
advertising in the Yellow Pages.

The Sunday Times has discovered that GP practices across
Britain are failing to safeguard files which contain
sexual, mental and physical histories of patients. Files
on sale last week revealed how named patients had
vasectomy operations, or had a family history of
Alzheimer's disease and precancerous growths. They also
included the type and dose of medication prescribed,
visits to casualty units, and injuries suffered in road
accidents.

The disclosures have prompted calls by opposition MPs and
doctors' leaders for urgent laws to protect the security
of the health records of Britain's 56.5m patients.

Alan Milburn, a Labour health spokesman, said he would be
asking Stephen Dorrell, the health secretary, to conduct
an urgent inquiry. "This is a violation of the special
relationship between doctors and their patients," said
Milburn. "I find it disturbing and deeply sinister.
Patients will be horrified to learn that their records
can be accessed by unknown organisations."

Alex Carlisle, the Liberal Democrat home affairs
spokesman and a lay member of the General Medical
Council, said: "It is ethically and morally outrageous
that organisations of any kind should obtain details like
that without consent. It is contrary to everything we are
told about the confidentiality of medical records. This
should be a crime punishable by imprisonment."

Milburn and Carlile were among more than a dozen people
who last week allowed The Sunday Times to expose the
security failures in the NHS records system by giving the
newspaper permission to access their confidential files
through commercial agencies.

The problem first came to light when one agency said it
was receiving more and more commissions from big
employers who wanted it to carry discreet checks on the
medical backgrounds of their employees. The agencies,
many of which advertise "private searches" in the Yellow
Pages, offer their services for fees ranging from L150 to
L800.

They offer to provide a written summary of anybody's
complete medical files within three hours. All they
require is the name, address and date of birth of the
patient they are investigating. They are thought to be
able to obtain the records by impersonating medical staff
and persuading them to disclose contents of the NHS files
over the telephone.

Last week a Sunday Times reporter posing as a prospective
client contacted 10 private detective agencies chosen at
random from the Yellow Pages. "Most of this stuff is on
manual records," said one employee of a London agency.
"It is pretty well protected. We're not officially
allowed [to do this] but it's perfectly possible." A
second private investigator said: "It's just a question
of knowing who and what to ask."

However, most declined to discuss the methods they used.
"What we are doing is illegal, and I'm not going into the
details over the telephone," said another agent in
Robertsbridge, East Sussex.

Dr Sandy Macara, chairman of the British Medical
Association council, which represents 105,000 doctors,
was among those who agreed to take part in the exercise.
Details of his medical and surgical history were provided
after a brief telephone call by a reporter to a private
agency. The information was faxed to the newspaper within
three hours, after a price of L150 was quoted. "This is
incredible. I cannot imagine how they have got this
information," Macara said.

The ease with which the health files could be obtained
posed a threat to the Electronic Patients' Records, a new
computer database which will soon contain the files of
all NHS patients in England and Wales, Macara said. "We
will have to ensure the new nationwide computer network
is as secure as humanly possible, and press for a
statutory right to confidentiality of patient
information."

Elizabeth France, the data protection registrar, said the
Criminal Justice Act had recently tightened the law
regarding information obtained by deception. But the
penalties apply only to information held on computer,
rather than medical notes, which at present are held
mainly on hand-written files. "This is something we take
very seriously," France said. "We are actively pursuing
it. It doesn't mean the problems have been solved."

John Wadham, director of Liberty, the civil rights group,
called on the government to introduce a new criminal
offence of obtaining information by deception. "Such
information can obviously include material about sexually
transmitted diseases and material about an individual's
physical and mental health," he said. "There clearly
needs to be a right to privacy so the courts can act
against this."

Baroness Cumberlege, the junior health minister, said
confidentiality remained a cornerstone of the NHS. "We
are about to issue strengthened guidelines for security
of records within hospitals and new measures for
unauthorised access from external sources," she said. "We
are having discussions with the BMA and the Data
Protection Agency specifically about these issues."

-----