Contract minimum dataset includes confidential dataBMJ 1996; 312 doi: https://doi.org/10.1136/bmj.312.7024.185 (Published 20 January 1996) Cite this as: BMJ 1996;312:185
EDITOR,—R Basu Roy and P Sriskandabalan are right to be concerned about the threat to the privacy of data related to AIDS,1 but for inpatients it is already too late. Data on HIV status are included in the clinical coding that forms part of the contract minimum dataset,2 together with the patient's name, address, postcode, date of birth, sex, and other information. Until April 1995 HIV positive status was coded according to the International Classification of Diseases (ICD), ninth revision, which specified a subsidiary code of 079.4. Since then the ICD-10 codes have been used, which expand illness related to HIV into main codes B20 through to B24. Similar levels of detail for other sexually transmissible diseases, abortions, and fertility treatment are also included in the contract minimum dataset. Even when, as is often the case, patients' names and addresses are removed from contract minimum dataset databases, intelligent querying strategies can be used to establish individuals' identities.3 It is well established that the combination of date of birth, sex, and postcode is sufficient to identify almost everyone except monozygotic twin children.
The contract minimum dataset forms the basis of trading in the reformed NHS: it is routinely passed between administrative and clerical staff as part of the contracting process. Without its exchange the internal market would probably not be able to operate, at least in its present form, but it may not be possible to reconcile this exchange with existing legislation on confidentiality of personal clinical data and therefore with the requirements of the Data Protection Act.