Bournemouth and Poole NHS PCT criticised for passing on patient data
A man has criticised his Primary Care Trust (PCT) after it passed on his information to a third party.
Chris Skone-Roberts said Bournemouth and Poole PCT did not comply with the Data Protection Act by giving details to Enhanced Health Care Services.
The company phoned him to offer him a health check because he was seen to be at risk of coronary heart disease.
Adrian Dawson, public health director, said the application of the "very successful" scheme had been an "error".
He added: "We took a pragmatic approach. We've been criticised about that and we'll put that right.
"There was never any discussion about passing on peoples' personal medical history. That was never on the table, that never happened."
Mr Skone-Roberts, 42, from Bournemouth, told the BBC he felt "awful" when he was called in January by a woman purporting to be from his local surgery.
He added: "It soon became very obvious that she wasn't calling from my doctors surgery and I became suspicious immediately.
"When she started getting to specifics she knew nothing about my medical history, but she knew enough to be able to phone me up with my name, my home phone number, my post code, my date of birth, even my mobile number, so it was worrying to say the least.
"She knew enough to say that I'd been identified as being in an at risk group and she started speaking to me about coronary heart disease."
Mr Skone-Roberts said he was also advised the he should be screened for cancer.
He said: "My mum died a couple of years ago from a brain tumour so to have somebody purporting to be from my doctors surgery call me on a Monday night and start talking about the health benefits was like somebody took an axe to my legs."
The Department of Health requires all Primary Care Trusts to offer a cardio-vascular risk assessment to 18% of adults aged 40-74 per year.
In the case of Bournemouth and Poole, outside company Enhanced Health Care Services carried out the calls.
When the PCT was quizzed by the Information Commissioner's Office (ICO) on its decision it replied that it was not practical to obtain consent from all patients.
The office concluded in a letter to Mr Skone-Roberts that the PCT's processing of personal data was not fair.
It wrote: "Individuals should have been informed by the trust that they would be receiving a call inviting them to attend a risk assessment, and that this letter should ideally give them some method for asking not to be contacted.
"The reason for this is that even if their health data is not being processed, people would generally not expect to hear from an unknown company regarding healthchecks, and given the context (and lack of information provided in that phone call), people could be concerned as to who has had access to their medical records."
Bournemouth and Poole NHS PCT claimed of the 13,000 patients contacted by phone, 4,000 submitted to check ups.
Of these 1,000 were determined to be at risk and underwent further medical treatment.
Mr Skone-Roberts said: "It cannot happen in 2012, where personal information is so important to people, that information can be passed to other companies and money change hands with nobody knowing.
"I understand why this has happened, the PCT is saying because it was beneficial to patients that it's acceptable, [but] you cannot do this with peoples' private information."