The medical records of every NHS hospital 
  patient in the country have been sold for 
  insurance purposes, The Telegraph can reveal.
  [...]
  a report by a major society of actuaries 
  discloses that it was able to obtain 13 
  years of hospital data [...] covering all 
  hospital in-patient stays between 1997 and 
  2010 to track the medical histories of 
  patients, identified by date of birth and 
  postcode. 

http://www.telegraph.co.uk/health/healthnews/10656893/Hospit...

And the best part? It only cost £2,200.

A one time occurance; since which the law has been chNged to make that not possible and for which people have apologised.

While patient data was released (and possibly poorly anonymised) that was not "patient records" which have a defined meaning.

So the very worst example of "selling off patient records" wasn't patient records, only happened once, has been acknowledged as a failure, and can't happen again because the law has been changed since.

The actual report is here. http://www.sias.org.uk/data/papers/SIASDec2013Paper/Download... It's reasonably obvious that inferences can be made from this that will affect private sector insurance premiums, but highly unlikely that anything they've done with the data could be linked to specific individuals, even though the original anonymisation was unlikely to have been sufficient

In the interests of balance, it's worth pointing out the non-profit organization linked to the insurance sector in question specifically denies some of the claims made in the Telegraph article: http://www.actuaries.org.uk/news/press-releases/articles/tel...

> highly unlikely that anything they've done with the data could be linked to specific individuals, even though the original anonymisation was unlikely to have been sufficient

So even if we take a professional body which represents the interests of the insurance industry at their word, we still have to trust that private companies with little or no public oversight will somehow decide to do the right thing?

It's blatantly obvious that a postcode and age is enough to match a record to an individual. Why are we expected to trust private industry not to mess with our privacy?

We have no more but also no less reason to trust individuals who are not NHS employees from breaching data protection law than individuals who are NHS employees, and have access to much more sensitive data.

On a pedantic note, the data was split by postcode district and age, with the average postcode district being 20,000 people. I still agree that's not data you'd want on a private insurers' database because they could de-anonymise outliers like the only 97 year old man, and others with partial knowledge of their hospital visit history, but it would be a lot of work making it usable for granting or denying insurance to particular individuals. Especially when it's probably easier to gain illicit access to the non-anonymised records than gain and make sense of illicit access to the anonymised records.

As it stands, we have the NHS having access to our personal data. What the Government wants to do is expand the number of organisations that have access to that data to include private companies that we have no oversight over. At least if the NHS has shit policy, we can complain and have our complaints heard. If a private company that has nothing to do with you has shit policy? Tough luck.

Additionally, there's many things that an organisation can do with data that are not in breach of data protection law,, but which I do not want them doing anyway, especially without me explicitly opting in to giving them that data. Data protection law mostly just says that they can't share it with other companies without your permission, they must let you know what it is if you ask, and you have the right to have it corrected if it's wrong. And even then, there's plenty enough companies in the UK that don't even meet those rules all the time!

This is not about individuals. This is about organisations.

Yet the NHS themselves confirmed that everything was true.

http://www.telegraph.co.uk/health/nhs/10659147/Patient-recor...

The original Telegraph article headline was "Hospital records of all NHS patients sold to insurers" (aside from the flatly false headline, the actual content of the article is pretty accurate). The IFoA that actually bought the data and did the research pointed out that they were not an insurer, nor providing any recommendations to insurers beyond the now-publicly-available macro data I linked to. In other words, no private firms - in the insurance industry or otherwise - legally have access to any medical records as a result of this sale, other than the macro research document I linked to, which you might want to read for yourself if you're concerned about what's getting into the public domain.

The link you've just posted has the NHS-linked body in question admitting "greater scrutiny should have been applied" in this instance, but actually reasserts all the points made by IFoA: they're not an insurer, it's a general study on frequencies of illnesses amongst certain demographics and there's no personally-identifiable data accessible to insurers as a result of this. The HSCIC making a hand-wavy non-apology != the NHS confirming that this is an example of a private firm they sold your medical records to

You are right. Upon inspection the incident was far less threatening than reported. I was wrong.

As an example of potential abuses by public departments selling data I think it still stands though.

Yes. Yes they are.

"However, a report by a major society of actuaries discloses that it was able to obtain 13 years of hospital data – covering 47 million patients – in order to help insurance companies “refine” their premiums. The report by the Institute and Faculty of Actuaries details how it was able to use NHS data covering all hospital in-patient stays between 1997 and 2010 to track the medical histories of patients, identified by date of birth and postcode.

The 274-page report describes the NHS Hospital Episode Statistics as a “valuable data source in developing pricing assumptions for 'critical illness’ cover.”

There is a point where your denial is farcical and where farcical is fallacious.