The General Pharmaceutical Council (GPhC) has suspended Pharmacy2U’s commercial director for three months for the company’s sale of patient data in 2014.

Julian Harrison (registration number 2039775) was found to have authorised the sale of patient data to third parties three times between October and December 2014, for which he said he was “deeply sorry”, the GPhC heard at a fitness-to-practise hearing held on Monday and Tuesday.

Chief operating officer Daniel Lee (registration number 2039891) was issued with a warning for his part in the data-selling incident. He failed to ensure robust procedures were in place on the company's website to allow patients to provide informed consent to the use of their names and addresses, the GPhC heard.

The regulator noted that Mr Lee’s actions were “less severe” than Dr Harrison’s, and accepted that he was unaware of the data sales until their details were published in the press last year.

Pharmacy2U "took immediate action"

Pharmacy2U CEO Neil Laycock told C+D the day after the hearing that the company had “fully cooperated” with the GPhC since the matter was brought to its attention in March 2015, and “took immediate action to ensure it could not happen again”.

The company is “sincerely sorry for any concern this incident caused”, and no medical information was ever shared, he stressed.

“While this was indeed a serious matter, it was an isolated incident and swift and comprehensive action was taken to rectify it by both individuals involved.  Lessons have been learned and the company has strengthened all aspects of its data governance,” he added.

The Information Commissioner’s Office (ICO) slapped Pharmacy2U with a £130,000 fine last October after it found the company had “unfairly” obtained the data, but accepted its breach of the Data Protection Act was accidental.

 

The hearing - as it happened

---

Day 1

09.30 - The hearing begins

Both Pharmacy2U chief operating officer Daniel Lee and commercial director Julian Harrison are present at the hearing, along with their legal representative.

The statement of facts of the hearing show that Pharmacy2U patient data was sold via third party marketing company Alchemy three times between October and December 2014, and each sale was approved by Dr Harrison.

According to the General Pharmaceutical Council’s (GPhC’s) legal representative in the case:

• Prior to April 2015, Pharmacy2U’s privacy policy mentioned that the company would occasionally make patient details available to third party marketing companies.
   
• Patients could choose to opt out of this by logging into their account and specifying that they didn’t want this to happen. This was not clearly signposted upon registration.
   
• Data from 3,000 Pharmacy2U patients was supplied to an Australian lottery company.​
   
• Dr Harrison approved an advert that would be sent to patients by the company giving them a “unique opportunity” to win millions of dollars. The lottery company’s deal with Alchemy specified that the patients had to be male and aged 70 or over.

It’s the turn of government privacy watchdog the Information Commissioner’s Officer (ICO) to give evidence. They state: 

• Pharmacy2U’s privacy policy prior to April 2015 was “inadequate” if Pharmacy2U was planning on selling patient data. 21,500 patients were affected, although it’s possible that some were affected twice.
   
• The rental of patient data to third party companies was for one-time use only.
   
• No more data was sold by Pharmacy2U after December 2014.
   
• The £130,000 fine issued by the ICO [last year for breaching the Data Protection Act] was paid promptly by Pharmacy2U.

 

11.30 - Pharmacy2U commercial director Julian Harrison gives his evidence

• He had not been aware of any criticism of Pharmacy2U’s privacy policy prior to March 2015.
• He was told by Alchemy that it was “normal” for companies to make money by selling some of their data.
• He had not actively sought out a deal such as this, but it came about opportunistically, so he decided to go through with it.
• He felt that he had taken care over the contract with Alchemy, especially regarding confidentiality clauses and specifying that the data sold could only be used by companies once.

Dr Harrison expresses "deep regret"

• It is “with deep regret” that he didn’t turn his attention to Pharmacy2U’s privacy policy after the deal with Alchemy went through. “It just wasn’t something that came into my mind, I’m afraid…I accept it was a serious omission”.
   
• Dr Harrison said he would have thought differently about the situation if he had sought legal advice. It is “entirely possible” he would have chosen not to proceed with the deal if he had known of the ramifications.

Swayed by Alchemy

• He maintains that he was not aware the deal with the Australian lottery company required all the data to relate to male patients aged 70 or over, and wouldn’t have permitted the deal if he had known.
   
• He “wasn’t keen” on selling data to the Australian lottery company, but felt he was “swayed” by Alchemy.
   
• As soon as the issue gained press attention last year, Pharmacy2U immediately contacted the ICO and the GPhC. It will not sell third party data again.
   
• The ramifications of selling the data weren’t “by design” – the company made a mistake which it “deeply regrets”.

Three patients responded

• Pharmacy2U found that three of its patients had responded to the advert from the Australian lottery company, each paying £10.
   
• He is “deeply sorry” for his actions.
   
• Dr Harrison says he does not believe that it is never acceptable for pharmacists to sell patient information. But they must be informed properly and have the option to opt out, he says.

14.20 Pharmacy2U chief operating officer Daniel Lee speaks: What happened was a “mistake”   He assures the GPhC that “this will never happen again”, and apologises on behalf of himself and the company.   He was not directly involved in selling the data, he says.   If he could “turn the clock back” then Pharmacy2U would not have sold the patient data.   The company has since made the language in its privacy policy clearer.   “We are putting in huge barriers” to ensure there is a culture change at the company after this incident.   “It’s been a terribly distressing time.”   “We regret it wholeheartedly.”

Further notes from day one of the hearing A lawyer acting on behalf of the GPhC told the hearing: Pharmacy2U chief operating officer Daniel Lee and commercial director Julian Harrison’s conduct should be considered individually by the council, not collectively.   The misuse of patient data is “serious” and goes to the heart of the relationship of trust between healthcare professionals and patients.   Aggravating factor: the Australian lottery company specified to Alchemy that they wanted data from male patients aged 70 and over, so were arguably targeting the vulnerable and elderly.   Mr Lee’s failure was to secure the interests of patients.   But there is no evidence he knew about the sale of patient data.   Dr Harrison’s conduct was worse, because he was directly responsible for this sale. “He put profit before the interests of patients”.

 

Day two

13.30 - We hear from the fitness-to-practise committee

• Both registrants admitted the allegations against them. Therefore, the allegations were found to be proven by the committee.
   
• It found both Daniel Lee and Julian Harrison to be truthful witnesses.
   
• The sale of patient data was serious because it was “so far at odds” with what patients would have expected to be done with their information.
   
• The committee accepted that Mr Lee was unaware of the sale of patient data until the details were published in the press last year.
   
• He has clearly expressed remorse and has shown insight into his actions.
   
• Mr Lee's actions were “less severe” than Dr Harrison’s. Mr Lee has shown fuller insight into his actions and has taken a lead role in transforming Pharmacy2U’s policy and culture around information governance.
   
• Mr Lee’s fitness to practise is not currently impaired, but the committee could still issue him with a warning.
   
• Dr Harrison’s actions were not sufficiently informed by his role as a pharmacist, although the committee accepts he has played a full part in putting his actions right.
   
• Dr Harrison's fitness to practise is currently impaired, so the committee will consider imposing sanctions on him.

 

GPhC’s lawyer gives his position to the committee:

• It would be too lenient for the committee to issue Dr Harrison with a warning. His behaviour has been “very much worse” than Mr Lee’s.
   
• It would be inappropriate for the committee to place conditions on his registration because there are no appropriate conditions to impose.
   
• Suspension would be the “appropriate” sanction for Dr Harrison.
   

Pharmacy2U’s lawyer gives her position to the committee:

• The committee should issue advice to Mr Lee rather than a warning.
   
• It should issue Dr Harrison with a warning because a suspension is unnecessary.

Committee is now considering sanctions in #Pharmacy2U FTP hearing

— Beth Kennedy (@CandDBeth) May 24, 2016

committee will still consider issuing Daniel Lee with a warning #Pharmacy2U

— Beth Kennedy (@CandDBeth) May 24, 2016

16.30 - Final GPhC determination

The committee has decided:

• To impose a warning on Daniel Lee.
   
• To suspend Julian Harrison for three months.
   
• A warning was “not sufficiently strong” for Dr Harrison, but removal from the register was disproportionate.

Why patients fear datasharing: tiny wristslap for pharmacy co that illegally sold ur private NHS data to advertisers https://t.co/kmfMmQs6S3

— ben goldacre (@bengoldacre) May 25, 2016

For the latest from the hearing, see C+D Deputy features editor Beth Kennedy's live coverage here