Is Medical Privacy Possible In The Internet Age?
Published by Stephen Milward in Medical · Friday 24 Apr 2026 · 7 minutes
Tags: medical, privacy, internet, age, data, protection, online, security, healthcare, confidentiality, personal, information, privacy, laws, digital, health, cybersecurity, patient, rights, UK, Biobank
Tags: medical, privacy, internet, age, data, protection, online, security, healthcare, confidentiality, personal, information, privacy, laws, digital, health, cybersecurity, patient, rights, UK, Biobank
We regard our privacy to be extremely important, in all parts of our lives. Knowledge and information about us as individuals and families is only shared with others with our express and explicit permission. We should control that information. It should be our decision, and ours alone, as to what and how much information is shared with anyone, from friends and the wider family, to professionals in various spheres of society. But is that still possible at a time where personal information is held electronically and in the internet age, anywhere in the world? That's a big question, so let's look at one example - personal medical information.
What Is UK Biobank?
Medical information is gathered about us from the moment we're born and today even before that. Our gender, birth weight, any immediate health concerns... these are all documented in some way, on paper, electronically in databases, images and video. Every visit to a health professional is documented. By the time someone reaches adulthood, the amount of personal health information held by others is very large and disparate. Duplication of information can be on a large scale. Access points to that information might be unmonitored, except by flimsy security methods. Yet we give our information, sometimes deeply personal, freely, since we implicitly trust organisations to keep our information safe, private and secure.
But in the internet age, nothing is totally secure. Nothing.
An example of insecurity of medical data is reported today in the Guardian (i). UK Biobank (ii), (iii) is a facility that follows half a million volunteers to look at disease prevention, treatment and diagnosis. These are laudable aims. I participate and have done for years.
UK Biobank's response to the Guardian article (iv) via Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank, starts with:
'I want to reassure you that your personal information in UK Biobank is safe. After 14 years of making your data available for scientific discovery, we have no evidence of any of you being unwillingly identified.
Ensuring your personal information is used safely and correctly is our number one priority. There has not been any hack or data breach of UK Biobank, and if there had been you would have heard about it from us.'
It goes on with the following paragraph:
'All UK Biobank data provided to researchers are ‘de-identified’. This means that the data do not contain personally identifying information – such as your name, address, exact date of birth or NHS number – but may include health data you have provided and from your health records.'
That's reassuring. It goes on to say:
'We take your privacy extremely seriously. I am also a UK Biobank participant, so I know how much this matters. We know the possibility of your data being identified can never be completely removed, but it would require someone to have specific, matching information from another source that they knew was personal to you, in order to do so.
That is exactly what The Guardian has done. The participant featured in the article chose to give specific, personal, health information to The Guardian. The Guardian then cross-referenced this information with UK Biobank data to establish that the person is a participant.
This is not a failure of our approach to data confidentiality because the participant shared the information to identify themselves and, significantly, has said she intends to remain part of UK Biobank because its work is so important. As with any personal information, we recommend always being careful not to reveal specific details about ourselves on social media or websites.'
The line 'We know the possibility of your data being identified can never be completely removed' points to the truth of the matter. There's no such thing as perfect security, less so now that AI has become mainstream. An individual, right through to states, can only do their best to lessen risk in the internet age, where data flows around the planet almost instantly, through different hands and jurisdictions. The risk is mitigated by measures, both technical, legal and ethical. That's not new. We do it every time we lock a car door, close a window, install a camera. But in the end it comes down to trust. Given the response from UK Biobank, do I still have trust in that organisation?
It's a trade-off. A balance of risk. What is the balance between the risk of my data being exposed to those who have no right to it, versus the undoubted benefits to research and development that UK Biobank brings? That's not a binary choice. It's a moveable choice. At this time, I choose to remain with UK Biobank and believe that the measures they've put in place to guard privacy are sufficient. But they must also understand that confidence is easily lost. They must continue to develop and cement security and privacy of data. If they don't, confidence in their ability to retain participants will be lowered, with the consequent lessening of the quality of research, research we all have a vested interest in seeing succeed.
31 March 2026: The Guardian reports that the executive vice-chair of Palantir in the UK, Louis Mosley, says that the government should resist calls to cancel the contract they have because of the objections by 'some ideologically motivated campaigners' (v). This contract should never have been signed in the first place. No NHS data should ever leave our shores and certainly not go to an American company founded by Peter Thiel, a 'conservative' political activist (he also founded PayPal), who presumably is 'ideological'. I say NO MORE CONTRACTS to Palantir, now and in the future.
16 April 2026: The Guardian reports that Labour and Lib Dem MPs want the Palantir contract scrapped (vi). For the NHS to be connected with this dreadful company is a disgrace and must be ended.
24 April 2026: The BBC News website carries an article in which Rory Collins blames 'a few bad apples' for the data loss, data that has been on sale on a website in China (vii). A few bad apples? This is before a 'comprehensive and forensic board-led investigation of this incident'. What an absolute shambles and disgrace. Until Collins goes, UK Biobank's credibility for data protection is shattered. He must resign.
(i) The Guardian 14 March 2026: Confidential health records from UK BioBank project exposed online
(ii) Wikipedia: UK Biobank
(iii) UK Biobank
(iv) A message from Professor Sir Rory Collins, Chief Executive and Principal Investigator of UK Biobank 14 March 2026
(v) The Guardian 31 March 2026: Palantir’s UK boss criticises ‘ideological’ groups as ministers move to scrap NHS contract
(vi) The Guardian 16 April 2026: Labour and Lib Dem MPs demand ‘shameful’ Palantir NHS contract be scrapped
