The Department of Health says it cannot delete patient records on the Summary Care Records (SCRs) service once uploaded, because the cost would be prohibitive.
Its reply to GP Neil Bhatia under the Freedom of Information Act means that even if patients change their minds about their summary health records being uploaded to a central database, their details will not be permanently removed.
The department said to Bhatia in a letter:
"Whilst health ministers have determined that patients need not have an SCR if they do not want one, this should not be understood to mean that once created an SCR can be completely removed.
"Records can be made inaccessible to staff in a number of ways, but the cost of completely removing them would be prohibitive.
"As with all digital records systems, complete removal would require the hardware holding records to be completely sanitised. This is a process that destroys all data held, for example on a server or hard drive, and not just a particular record.
"Furthermore, the SCR system has been designed in terms of the functionality required when it is fully implemented and employed across England.
"When this is the case, the issue of audit and the medico-legal evidential significance of the SCR will be extremely important and it would be inappropriate to provide tools that could completely remove a record, even if this were feasible."
The Department says that a GP practice may authorise the masking of an SCR and "can accomplish this by uploading a blank record that has the effect of preventing the previous record from being accessed".
A GP practice may also hide a record by flagging a record to indicate that this is a patient's preference. "Once a record has been masked, it should only be reinstated at the request of the patient concerned. The process of reinstating a record is multi-staged and cannot result from human error. A full audit trail of changes to a patient's preferences is maintained," says the department's letter.
Bhatia says the summary records will be on the central database "for eternity" unless patients opt out of having their files uploaded. They cannot change their minds later, he said.
The Department of Health and NHS Connecting for Health does not want patients to opt out because too many gaps in the database would make it all but useless to clinicians and doctors. The aim of the summary care record is to make information such as adverse drug reactions available to any clinician anywhere, provided they are authorised to view the files.
The SCR scheme is in its infancy. It is part of the NHS's National Programme for IT [NPfIT]. Thousands of SCR records have been uploaded so far, but the aim is for the database to contain records on 50 million people in England.