Revealed: Mass use of credit check firm to find NHS patients to charge

Lewisham and Greenwich Trust, which runs two hospitals in south east London, has been handing information from referred patients to Experian since at least 2015, helping it to recoup millions of pounds, HSJ has established.

The information – including name, address, date of birth and NHS number – is routinely passed on when a patient is referred to the trust. Experian then checks whether the individual has a credit footprint in the UK, and is therefore likely to be resident and eligible for free NHS treatment. If not, the trust can carry out further eligibility checks and potentially issue charges.

HSJ has also seen documents revealing NHS England and Improvement earlier this year encouraged 51 trusts to carry out similar checks, and, during the spring and summer, worked with a smaller group of trusts to try to put a mass credit checks process in place.

An email from a member of staff at Experian in the summer, also seen by HSJ, said several trusts had shared data with it as part of a pilot.

However, when HSJ approached Experian last week, the firm said a pilot with the NHS had been “discontinued” and “there are currently no plans to extend the services we provide in this area to other trusts”.

HSJ understands that at least three trusts were working to put the system in place during the spring. These are Liverpool Women’s, King’s College Hospital and St George’s University Hospitals foundation trusts. Liverpool Women’s and St George’s told HSJ on Friday they were “not involved” in the pilot.

Privacy campaigners questioned whether this use of identifiable data was lawful, and warned some vulnerable people without a credit history could be unfairly targeted.

For several years, the government has asked the NHS to do more to recoup costs from those who are eligible to pay for NHS treatment and has introduced new regulations. NHSE/I warned earlier this month trusts should step up their efforts ahead of a potential no-deal Brexit.

Digital footprint

An official in NHSI’s “overseas visitor improvement team” said in an email in January, seen by HSJ, it had identified 51 NHS trusts which had an “income opportunity” from overseas visitors, and continued: “We are offering you the opportunity to participate in a research and development pilot exercise made available by a third-party provider, Experian.”

This would involve, it said: “Running checks on historical data (2017-18) to confirm residency by matching an individual to an address using a patient’s digital footprint and then analysing credit bureaus for other aspects which could ‘disprove’ residency against economic activity, potentially helping us identify ex-pats and other health tourists.”

It said: “Experian is already being used by a major acute trust to provide residency checks, so a data sharing and processing agreement is already available… The information required would be name, address, DOB, preferably an NHS number or other identifier, email address and telephone number. Clinical or other sensitive information is not required.”

The email said the aim of the pilot was to “refine a system that can conduct bulk residency checks on all admissions and referrals in secondary care”, including to establish whether “this is an economically viable solution for use in all trusts”.

HSJ has been told there was significant disquiet in trusts over the plan to share historic data, including concern it could breach data protection rules because individuals had not been informed.

Several well-placed sources said this retrospective sharing project did not go ahead.

New pilots

However, in the spring, NHSI started working with a smaller group of trusts to use the Experian process on new referrals, in a similar way to Lewisham and Greenwich.

A “frequently asked questions” document sent to trusts in May about this project said: “The overseas visitor improvement team at NHS Improvement is facilitating a pilot exercise between a third-party provider, Experian, and eight acute trusts to help improve eligibility checking within overseas departments.

“Trusts should seek their own independent legal and information governance advice as appropriate on whether their participation in the pilot and their individual arrangement with Experian is compliant with their legal obligations and their own information governance policies and procedures.”

On whether patients should be informed, NHSI’s FAQ said trusts should update their privacy statements, and that it had not carried out its own data protection impact assessment. It said: “NHS Improvement has not reviewed Experian’s processes and data sharing agreements for compliance with either GDPR or Caldicott principles. The individual participants will need to carry out this exercise.”

NHSE and I declined to say how the pilot with eight trusts had developed, saying only that trusts had a duty to seek payment where applicable.

An Experian spokesman told HSJ: “Experian currently works with one NHS trust to help them verify the identity of patients. The trust submits lists of patient details in order for us to cross reference and check whether they are residents in the UK, and therefore eligible for services. This process is similar to most standard residency checking services.

“The information used in this process is subject to strict industry guidelines. And it is not used for any other purpose than helping the NHS trust identify potential overseas patients, who may be required to pay for treatment under NHS guidelines.”

Phil Booth, from data privacy campaign group Med Confidential, told HSJ: “People who go to the NHS do not expect their data to be handed over to a credit finance agency.

“It is extraordinary that a national body, not having even determined the legality of what they are doing, appear to be doing everything they can through this carefully designed process to wash their hands of any consequences and put them on to any trust foolish enough to join this pilot.”

One insider close to the programme told HSJ: “The public has a right to know who the NHS is working with, especially when something this wide ranging is happening that could be setting a precedent for further sharing with the finance sector.”

An Information Commissioner’s Office spokeswoman said the use of personal data was required by law to be fair, transparent and secure, especially medical information.

Lewisham

Trust documents seen by HSJ show Lewisham and Greenwich Trust has been running a scheme with Experian since at least 2015. In 2017-18, the system helped generate £4.2m in invoices for overseas visitors, with around a quarter of that recovered.

A Lewisham and Greenwich Trust spokesman told HSJ: “We have used Experian as a non-discriminatory way of potentially identifying patients that are not entitled to free NHS treatment.”

The trust did not say whether patients had been informed of the checks, but the spokesman added: “We do have a notice on our website about sharing some information with non-NHS organisations. 

”It is important to stress that Experian do not carry out a credit check, but look at many sources to see whether patients are economically active in the UK. This is one of several indicators to help check that patients are UK residents and eligible for care which is free at the point of access, in a non-discriminatory way.”

King’s College Hospital said it was approached to take part in the pilot but it not go ahead.