FGM patient identifiable data collection breaches confidentiality?

Is the NHS collection of patient identifiable data of women with FGM unethical and a breach of confidentiality?

Female genital mutilation (FGM) has been illegal in the UK since 1985, and taking a child abroad to undergo FGM, as legislated in the 2003 Female Genital Mutilation Act and the 2015 Serious Crime Act is also illegal and is recognised as a form of child abuse. Until 2014, however, no one had been prosecuted for FGM and to date, no one has been convicted of this crime.

In response to calls for ‘something to be done’ to address this failing, the UK government has taken a number of steps. They include encouraging the Crown Prosecution Service to scour the landscape for possible perpetrators, sending the Police to airports to hand out leaflets to suspicious travellers and tell them that FGM is illegal, and encouraging Border Agency staff to be on the lookout for victims who might have undergone the procedure abroad, particularly during the so-called ‘cutting season’ (summer holidays).

New regulations and guidance have also been issued to professionals. Among them has been a requirement to gather data on the prevalence of FGM among girls and women living in the UK. Contrary to long-established practice in epidemiological study, however, the data include a long list of identifying information on the women, including their names and NHS numbers, and the governmental Health and Social Care Information Centre are being sent this data, quarterly, since April 2015.

Epidemiology, according to a BMJ handbook, is “the study of how often diseases occur in different groups of people and why. Epidemiological information is used to plan and evaluate strategies to prevent illness and as a guide to the management of patients in whom disease has already developed.” Epidemiological study requires the identification of the population at risk. Not everyone with a disease or who is at risk is studied, however; rather, a representative, sample population is identified for study. Individuals being studied remain anonymous because the aim is not to study or treat individuals, but to study them as a population group, through random selection among those at risk. There is almost never an attempt to find everyone who may be at risk or affected, but only a representative sample. On the basis of this information, health professionals can be trained in addressing the disease concerned and services directed at those who need them.

FGM is not a disease, of course, but a harmful traditional practice. For women with problems arising from FGM, a number of NHS specialist centres have existed in Britain for many years and provide care for women with these problems. They are staffed by specialist clinicians, mainly midwives and doctors.

Still, the study of FGM epidemiologically is valid in that the findings can be used to ensure that the services women may need can be planned and made accessible to them. It has long been recognised that some of the women who migrated to the UK from FGM-practising countries had experienced FGM as children in their country of origin. Bindel estimated that the numbers could be as high as 170,000. A provisional estimate of FGM prevalence in England and Wales, published by City University and Equality Now in 2014, however, suggested this figure was 137,000 women and girls. This is a not inconsiderable difference. (Note: The Bindel data was not accessible on the web at this writing.)

In the latter estimate, prevalence data were “derived from reports of household interview surveys in 2011 in the countries in which FGM is practised and extrapolated to the number of women living here who came from those countries of origin. Thus, the figure is based on two sets of estimates. Yet another study published by the UN Refugee Agency looked at the number of initial applications for asylum from women from FGM-practising countries, to Europe, covering the UK between 2009 and 2011. It found that an average of 2,350 females per year had applied for asylum in the UK. This does not mean all of them were granted asylum or had entered the country, nor that they even had FGM. So the value of these numbers is dubious.

What is certain is that none of these estimates were derived from a bona fide epidemiological study and should never have been accepted and treated by officials, the media or campaigners as if they were. But they were, and they continue to be cited by those pressurising the government to ‘do something’.

In reality, there are no accurate data on the number of women in this country who have undergone FGM. Nor is there evidence that FGM is being carried out in the UK on children. Although it is presumed that some British families take their girl children back to where their relatives came from or elsewhere for FGM, the numbers involved are also unknown. These are all good reasons for why accurate epidemiological data should be collected. So, how is the government addressing this need?

Starting in 2014, the Department of Health (DH) mandated that the Health & Social Care Information Centre (HSCIC) collect monthly prevalence data from NHS health professionals working in acute hospital settings, of women who had previously been identified and were being treated for FGM related or non-FGM related conditions, as well as newly identified women. This continued to March 2015.

Then in April 2015, prevalence data collection was replaced by an FGM enhanced dataset. Clinicians in England, working in Acute Trusts, Mental Health Trusts and GP Practices now have to record demographic and other data (including patient identifiable data) when a patient with FGM is identified during a consultation for health care of any kind, including the type of FGM she has undergone. The data has to be entered every time the woman or girl seeks care, has treatment related to her FGM, or gives birth to a baby girl (because the baby may be at risk of being subjected to FGM), and every time FGM is identified (by a clinician or self-reported), not just the first time. The data must be sent quarterly to the HSCIC. But this is not the way to do an epidemiological prevalence study. How is it different?

First, its goal is to record data on every woman and girl found to have had FGM. This is neither necessary or cost-effective since the point of epidemiological studies is to obtain representative data on the “group”, not the individuals.

The sort of ‘blanket’ data collection demanded by the DH was not even carried out to identify people living with HIV, for example, even after the extent of the epidemic became clear. Although it was certainly proposed, it caused a great deal of debate and controversy ‒ and was rejected. People living with HIV fought against named data collection as a violation of privacy and medical confidentiality, and as a human rights issue ‒ not only because of the stigma related to being identified as having HIV or AIDS, but also because, in those early days, there was no benefit for patients as no treatment had been developed.

Are not the rights of patients with FGM also being violated when they are identified and recorded as having had FGM? Some activists who have undergone FGM have expressed feelings of being stigmatised and fear of speaking out about it. But unlike with HIV, this fear is because their families are also implicated and might be exposed. Perhaps they do not want themselves and their families to be investigated by the justice system? Or they may be afraid of the racism and condemnation resulting from such exposure?

Secondly, the HSCIC regulations now require that a host of information be recorded, with or without the patient’s permission. The mandatory and required (i.e. if appropriate) non-pregnancy-related data that must be collected include: the woman’s full name, birth date, post code, NHS number, country of birth, country of origin, GP practice, care contact date, details of referring organisation, details of treatment site, existence and type of FGM, details of de-infibulation, pregnancy status indicator, FGM family history, number of daughters under 18, that the woman was advised on the health implications of FGM and on the illegalities of FGM, daughter/s born at this attendance, woman’s age at FGM and country. Optional information includes age and country of origin of the father of any of the woman’s daughters aged under 18.

(Following email correspondence with HSCIC in regard to the rationale for this data collection, the Senior Press Officer sent suggested amendments. They are incorporated in an italicised format (for now). He made the specific point that the comments and amends relate specifically to the data capture and processes involved.)

Secondly, the HSCIC are now required to collect data, with or without permission in the interest of the patient. The mandatory and required (i.e. if appropriate) non-pregnancy-related data that must be collected include: NHS number, or local patient identifier, provider organisation code if the NHS number is not available, patient forename and surname, date of birth and postcode. In addition, care contact date and how FGM was identified are mandatory and finally, the actual FGM activity that was identified is also mandatory. There are other data fields that are included in the collection that GPs and providers are encouraged to complete to improve the usefulness of the data.

Included also from HSCIC was ”Some additional information to put the above paragraph into context”.

The reasons why the HSCIC collects patient identifiable data for FGM is to ensure our data is accurate and useful. NHS number and date of birth is collected to uniquely identify the woman or girl within the dataset, ensuring the correct data is entered against the correct record and prevents double counting. Also, where users do not have NHS Number available, date of birth, Local Patient Identifier and Provider Organisation are used to uniquely identify the woman or girl until NHS Number is populated. Date of birth is also used to identify where girls are under 18. A name is only collected to avoid data entry errors by users of the data when navigating through records. It is not collected for any other purpose. Postcode is collected to enable more detailed analysis and reporting for geographical reasons, such as linking the data to a particularly Clinical Commissioning Group. Finally, no patient identifiable information will ever be published. To prevent individual patient identification, small numbers of aggregated numbers will be suppressed. 

I can understand that recording a woman’s NHS number might be considered necessary to avoid the possibility that, with totally anonymised data, a woman with FGM who attends for health care in more than one place might well be counted more than once. This is a valid concern, considering the flaws in the initial regulations. However, in my opinion, there are serious new concerns here no matter which way one looks at it. The value and purpose of the extent of the information health professionals are now required to record is, epidemiologically speaking, highly questionable, despite HSCIC reassurance that no patient identifiable data (PID) will ever be published. This is because the woman’s personal data may be handed over to the police, social care authorities or the courts if she has girl children who are deemed, during the course of data collection or afterwards, to be at risk of FGM.

HSCIC’s response to the above paragraph:

HSCIC has never given clinical information to the police, social services or the courts. We would only ever supply this information if a court order legally required us to disclose clinical data, which has never occurred. We do not routinely share any information from the FGM dataset with any of these agencies. End of HSCIC communication.

This is because FGM is not just a health condition, it is a crime. Consequently, only one of the purposes of data collection by the HSCIC is to determine prevalence and to make information and treatment available to women and girls as victims. Another is to share the information with other governmental authorities, so that they can investigate whether these same women’s daughters are at risk of becoming the next generation’s victims, thereby turning the adult victim into a potential perpetrator or accessory to the same crime she herself was the victim of.

On top of this, even if she does not give her consent to do so, the victim is required to provide health professionals information about herself. On page 48 (of 53 pages), the regulations say: “It is not intended that patient-identifiable data will be shared with other parties. Such activity would require explicit patient consent…. It is intended, however, that the FGM information collected and disseminated using the Clinical Audit Platform will support the publication of patient-anonymised Official Statistics.”

Yet the next paragraph on the same page says: “As the FGM Enhanced Dataset will be underpinned as a result of Department of Health directions, this will require no explicit patient consent to be sought in order to collect this information and subsequently share this with HSCIC. However, each patient where FGM information has been identified by a healthcare organisation, must inform each woman or girl as to how and what will happen to the information being recorded, and further to this, where an objection to this is made each organisation must ensure it understands the fair processing procedures outlining where a woman can contact to make an objection to this information being recorded and sent to the HSCIC.” A long set of instructions on how to handle this follows.

Moreover, it also says that the woman can only register a complaint after the fact, that is, after the data have been recorded, but her complaint will not stop her data being retained and used by the HSCIC. It seems that the Health and Social Care Act 2012 allows health professionals to violate women’s informed consent in this way. This is certainly a violation of privacy and confidentiality that must be challenged.

Pregnant women generally come under a lot of scrutiny. Pregnant women with FGM come under particular scrutiny. The HSCIC requirements say that all existing maternity discharge information sent to GPs and health visitors MUST [their emphasis] also include all relevant FGM information, where appropriate, when FGM or family history of FGM have been identified prior to, during or after the birth of a baby. This is another instance in which personal data will be shared.

The pregnancy-related FGM information to be specifically recorded includes: FGM type, confirmation that a de-infibulation procedure took place to facilitate the delivery of a birth, where applicable, and confirmation that no external female genitalia abnormalities were found in girl babies at birth following existing neonatal examinations, confirmation if an interpreter was required during the episode of care, and confirmation that the newborn baby’s healthcare record has been updated to reflect that FGM had been identified in the mother. Additionally, as part of the initial antenatal assessment, every woman MUST [their emphasis] be asked if they have undergone FGM. Where a Health Visitor identifies that there are sisters of a girl with FGM, it is the responsibility of the Health Visitor to inform the GP (pages 12-13). And this is not even the half of it.

The regulations say three times, (pages 8, 11 and 21), that clinical examinations of the woman’s genitalia need only be undertaken “as part of a usual, routine or requested provision of care – there is no intention for every clinician to automatically undertake a clinical examination in order to record the type of FGM”. Thus, there is a presumption that women not requiring examination of their genitalia will “self-report” when asked if they have had FGM. But will all clinicians note this caveat or will we begin to hear stories of women’s genitals being examined no matter what they have attended for?

From the point of view of the woman sitting in front of the doctor or midwife, one might easily imagine that any need for help she may feel would be compromised by the fear ‒ especially if she is pregnant, has girl children under age 18 or has just delivered a girl child ‒ of being investigated, prosecuted and criminalised by the criminal justice system, along with other family members. Will she give all the information asked of her? Will she come back for another appointment?

And what about the health professionals who have to ask women these questions and record their answers in the relevant database? There is an ethical requirement on health professionals not to allow the violation of patient privacy and not to break medical confidentiality, particularly if it is against the woman’s expressed wishes. Yet the HSCIC requirements require just that from health professionals, who must submit the data quarterly and in annual reports.

What if clinicians refuse to collect some or all of the data? The regulations do not say what will happen if they fail to return this information fully and in the required detail, except that “the submission will be rejected”. Will they be required to get the woman back in to obtain more details? Will they be disciplined, as they would if they do not report a suspicion or actual case of FGM in an under-18-year-old? Clinicians already worry about the consequences of not identifying ‒ or mis-managing ‒ women with FGM, and now they also fear prosecution, after what one of their colleagues suffered, in spite of being acquitted.

This is not the first time the Government has attempted to ‘share’ identifiable information from clinical records without patients’ permission. In 2013, they announced they were going to extract ‘identifiable data’ from GP records to be used ‘routinely’ for research by the health service and private entities (which might have included pharmaceutical companies), unless patients asked to opt out. In this instance, there was a public furore and after 700,000 people had opted out, the scheme was ‘indefinitely delayed’. This year, they attempted to do so again on the grounds that they needed to intervene in regard to the care of ‘high cost individuals’.

This time, however, women with FGM are not being given any choices in the matter. It is highly unlikely that they will refuse to provide their personal data in large numbers, as people with HIV did previously, as they do not have the social or political clout, or the public support, to challenge the Government or their health care providers.

Health professionals, on the other hand, do have that power, and just as GPs supported the 700,000 patients’ refusal to allow their data to be shared for unspecified research, so health professionals should stand up in this instance, and refuse to populate the HSCIC database with identifying details about the women involved.

At the end of February 2015, the government reported that 2,603 women and girls who had attended the NHS in the previous six months for health care of some kind had been recorded as having had FGM. Of these, only 44 were under the age of 18. Is it possible to extrapolate from these figures what the estimated prevalence might actually be? Probably it will take a much longer time to accomplish that, depending on how long it takes before the whole population of women and girls with FGM has attended for health care of some kind. Will prosecutions arise from the analysis of those data? Meanwhile, no proper epidemiological study has yet been considered, let alone launched.

Conclusion

I continue to believe, as I did at the FGM trial in January 2015, that this issue is being used politically by people in power, to gain credibility as champions of women only because they can present them as victims of their own culture. Furthermore, when, in reporting the government’s figures, the Guardian quotes Equality Now as saying “this is only the tip of the iceberg”, we can be pretty certain that it is the shock-horror value of FGM that is holding sway here, not concern for the women who have experienced it.

Although the situation is complicated by the criminal aspects of the issues involved, the government clearly needs a rethink ‒ epidemiological data, data for the provision of health care, and information leading to criminal investigation and prosecution should not be conflated in this way.

Marge Berer is an independent sexual and reproductive rights specialist. She was the founding editor, Reproductive Health Matters 1992-2015.

This article by Marge Berer will also appear on the BererBlog.