With immaculate timing the Department of Health (DoH) kicked off 2008 by announcing that the first patient electronic records have been uploaded to the new NHS online database, just as news of more data security breaches in the public sector was breaking.

Details of the first 100,000 patients have been uploaded to the controversial NHS database. Around 20 GP surgeries have added 110,000 individual records to the scheme, which will contain details on patients' medical history, current medication and allergies.

The £20 billion National Programme for IT (NPfIT) is intended to store more than 50 million patient records when it is complete, providing access to doctors anywhere in the NHS.

NHS chief executive David Nicholson insists that the new system will be more secure than internet banking. "We are listening to what people say about data security and we have a level of security built into the system which is way above industry standards,” he said. “Clinicians, professionals and people like myself take this sort of thing very seriously. This is a very high level of security.”

But 80 percent of UK medics have no confidence that the NHS is a fit custodian for electronically-stored patient data. According to a study carried out by www.doctors.net.uk – which has over 151,000 registered doctors as members – only 20 percent expressed any confidence that the electronic records would be secure. Even more alarmingly, only four percent expect local NHS organisations to maintain data privacy.

This lack of confidence appears justified after nine NHS trusts were forced to admit losing hundreds of thousands of health records late last year. Eight trusts in England are reported to have lost 168,000 patient details in total, while a ninth lost staff details. Some 168,000 people are thought to have been affected by the data protection breaches.

In a further blow, all deliveries of patient information in London were halted in December after a CD containing details of 160,000 children was lost in transit from BT to St Leonard’s Hospital, Hackney in an incident that occurred on 14th November. The disk was protected using 256k encryption and sent by secure courier by BT to St Leonard’s Hospital IT dept. It was signed for by hospital staff, but never reached the person in the IT department it was destined for. "We take any breach of security very seriously,” said Ruth Carnall, chief executive of NHS London. “I have asked for an independent review of all NHS data transfer in London and procedures are in place to stop this from happening again."

BT, the local service provider for NHS IT in London, insists that because the disk failed to reach its destination, the pass phrase key needed to decrypt the disk was not issued and, as such, there was no risk of the information entering the wrong hands. Ironically, BT is the provider of the secure NHS N3 data network but said that the NHS Trust in question – City and Hackeny PCT - had asked for the data to be sent by disk. This calls into question whether or not whether some NHS trusts have the basic technical competence to handle electronic data, rather than written records.

Opposition MPs are demanding a rethink of the NHS plan in the light of the recent data security scandals in the public sector. Data breaches to date include 25 million records lost from HMRC child benefit database; 6,500 records exposed from the Northern Ireland Driving Agency, and three million records lost from the Driving Standards Agency. "This is further evidence of the Government's failure to protect the personal information which we provide,” said shadow health secretary Andrew Lansley. "Following the HMRC and DVLA failures we will need further steps on the part of the Department of Health to show how their planned electronic patients' database will protect our medical records."

Lansley called for the national database to be replaced by storage on “local servers with interoperability between them”. “You have to look at the risks as well as the benefits… unfortunately, the government only appears to have looked at some of the benefits and has not taken advice on the risks,” he said. “What worries us in data security terms is if you create an enormous database you not only create opportunities for catastrophic data loss, you also create real opportunities for people all across the country - if they have access and proper passwords – to access other people’s data.”

However, the DoH appears intent on ploughing on with the centralised system. Some senior medics have advocated a campaign of disobedience against the database by supporting a campaign to urge patients to opt out and producing a letter that people can send to their GP to stop their records going onto the database. To date, more than 200,000 people have requested this. "Some doctors are actively encouraging their patients to rebel,” said Dr Paul Cundy, chairman of the British Medical Association (BMA) general practitioners IT committee, who helped compose the protest letter. "This letter is an easy way for patients to express the rights that the BMA feels they ought to have by default."

The letter can be downloaded from the website of the Big Opt Out campaign at www.nhsconfidentiality.org.