The Sunday Times, Top page one, 26 Nov 1995 For sale: your secret medical records for L150 by Lois Rogers and David Leppard Confidential medical records of politicians, celebrities and millions of other National Health Service patients can be bought on the information black market for L150. The contents of the files comprising patients' most personal health details dating back 30 years, are being sold to order by high-street detective agencies advertising in the Yellow Pages. The Sunday Times has discovered that GP practices across Britain are failing to safeguard files which contain sexual, mental and physical histories of patients. Files on sale last week revealed how named patients had vasectomy operations, or had a family history of Alzheimer's disease and precancerous growths. They also included the type and dose of medication prescribed, visits to casualty units, and injuries suffered in road accidents. The disclosures have prompted calls by opposition MPs and doctors' leaders for urgent laws to protect the security of the health records of Britain's 56.5m patients. Alan Milburn, a Labour health spokesman, said he would be asking Stephen Dorrell, the health secretary, to conduct an urgent inquiry. "This is a violation of the special relationship between doctors and their patients," said Milburn. "I find it disturbing and deeply sinister. Patients will be horrified to learn that their records can be accessed by unknown organisations." Alex Carlisle, the Liberal Democrat home affairs spokesman and a lay member of the General Medical Council, said: "It is ethically and morally outrageous that organisations of any kind should obtain details like that without consent. It is contrary to everything we are told about the confidentiality of medical records. This should be a crime punishable by imprisonment." Milburn and Carlile were among more than a dozen people who last week allowed The Sunday Times to expose the security failures in the NHS records system by giving the newspaper permission to access their confidential files through commercial agencies. The problem first came to light when one agency said it was receiving more and more commissions from big employers who wanted it to carry discreet checks on the medical backgrounds of their employees. The agencies, many of which advertise "private searches" in the Yellow Pages, offer their services for fees ranging from L150 to L800. They offer to provide a written summary of anybody's complete medical files within three hours. All they require is the name, address and date of birth of the patient they are investigating. They are thought to be able to obtain the records by impersonating medical staff and persuading them to disclose contents of the NHS files over the telephone. Last week a Sunday Times reporter posing as a prospective client contacted 10 private detective agencies chosen at random from the Yellow Pages. "Most of this stuff is on manual records," said one employee of a London agency. "It is pretty well protected. We're not officially allowed [to do this] but it's perfectly possible." A second private investigator said: "It's just a question of knowing who and what to ask." However, most declined to discuss the methods they used. "What we are doing is illegal, and I'm not going into the details over the telephone," said another agent in Robertsbridge, East Sussex. Dr Sandy Macara, chairman of the British Medical Association council, which represents 105,000 doctors, was among those who agreed to take part in the exercise. Details of his medical and surgical history were provided after a brief telephone call by a reporter to a private agency. The information was faxed to the newspaper within three hours, after a price of L150 was quoted. "This is incredible. I cannot imagine how they have got this information," Macara said. The ease with which the health files could be obtained posed a threat to the Electronic Patients' Records, a new computer database which will soon contain the files of all NHS patients in England and Wales, Macara said. "We will have to ensure the new nationwide computer network is as secure as humanly possible, and press for a statutory right to confidentiality of patient information." Elizabeth France, the data protection registrar, said the Criminal Justice Act had recently tightened the law regarding information obtained by deception. But the penalties apply only to information held on computer, rather than medical notes, which at present are held mainly on hand-written files. "This is something we take very seriously," France said. "We are actively pursuing it. It doesn't mean the problems have been solved." John Wadham, director of Liberty, the civil rights group, called on the government to introduce a new criminal offence of obtaining information by deception. "Such information can obviously include material about sexually transmitted diseases and material about an individual's physical and mental health," he said. "There clearly needs to be a right to privacy so the courts can act against this." Baroness Cumberlege, the junior health minister, said confidentiality remained a cornerstone of the NHS. "We are about to issue strengthened guidelines for security of records within hospitals and new measures for unauthorised access from external sources," she said. "We are having discussions with the BMA and the Data Protection Agency specifically about these issues." -----