You may have seen recently that Lewisham and Greenwich NHS Trust has been sharing patient data with the Credit Reference Agency, Experian.

Many were initially surprised to find the Trust sharing data with a Credit Reference Agency, especially the patients who attend the Trust, and it raised a few questions. Experian has processed all information in accordance with strict industry guidelines, but going in for a routine check-up is a far cry from a mortgage application, so why do organisations share your personal data? What do they get out of it and are they allowed to do it without letting you know?

Why do organisations share data with the Credit Reference Agencies?

Every company will have its own unique reasons for sharing data. Often, it’s done by banks and lenders who have a Reciprocal Data Sharing agreement with the Credit Reference Agencies (CRAs). They’ll share their customers’ information with the CRAs, who in turn keep those individuals’ Credit Report information updated.

The purpose of these organisations sharing data is to allow them access to the Credit Reference Agencies’ vast databases. This ‘Reciprocal Data Sharing’ agreement means any organisation that shares customer account information with the CRAs can view prospective customers’ Credit Reports across the UK. Put simply, if you give account data to the CRAs, the CRAs will give you account data in return.

The main reason banks, lenders, mobile phone providers, and utility suppliers (to name just a few) want to access your Credit Report is straightforward: to assess your historic repayment behaviour so they can estimate your future repayment behaviour. These organisations will assess your Credit Report whenever you apply to them so they can understand your creditworthiness and ensure that their lending decision makes sense from both a profitable and responsible perspective. Importantly, they’ll also perform a credit check to establish that your identity is genuine.

But the fact that Lewisham and Greenwich Trust has been sharing patient information has surprised a number of its local residents. Many people weren’t aware that the Trust was sending their information off to any groups outside of the NHS and, even after finding out, still weren’t sure why it was done in the first place.

The Lewisham and Greenwich Trust is required by law only to provide free healthcare to legal residents of the UK. Anyone who isn’t a legal resident of the UK must be charged for healthcare provision, following a change in law by the coalition government in 2015. As such, the Trust felt it reasonable to share patient information with Experian to establish their identity and whether or not they qualify for free treatment.

What type of data is shared?

When banks and lenders have a Reciprocal Data Sharing agreement with a CRA, they will share a deep level of information between each other. This will include your name, date of birth, address, account repayment history, balance, and more besides. The account repayment history will detail all the payments you make towards the account, including any that are missed or late. This information then populates your Credit Report, giving you a financial picture of (usually) the last six years.

The type of data sharing that The Lewisham and Greenwich Trust engaged in wasn’t of the same level. It didn’t share repayment behaviour at all, which means patients won’t find an account from the Trust showing in the payment history section of their Credit Report. Equally, the Trust wasn’t performing a traditional credit check on patients. It wasn’t looking at repayment behaviour to decide whether or not to accept or turn away a patient. Whether the patient had a perfectly clean credit history or one riddled with late payments, defaults, and CCJs was of no consequence.

Instead, the NHS Trust shared name, address, date of birth, NHS number, and contact details with Experian. This resulted in a soft search entry being placed on the patients’ Experian Credit Report to reflect when the data was shared and the search was performed. Soft searches do not impact on people’s creditworthiness at all, as they do not reflect a credit application. Instead, it represents a search where only part of the individual’s Credit Report (usually public information, like Electoral Roll entries, insolvency records, County Court Judgments, etc.) was accessed, with depth of data much shallower than with regular credit checks.

How do organisations get my permission to share my data with Credit Reference Agencies?

Organisations don’t always need your permission to share data, providing they have a lawful basis for doing so and inform you of their intentions.

Banks, lenders, mobile phone providers and similar organisations often have permission anyway, as it’s a requirement found in many terms and conditions of products and services, especially credit cards and loans.

Nowadays there is an expectation that some form of credit check will be performed when you apply for finance, but having your data shared with a Credit Reference Agency isn’t at the forefront of many people’s minds when going in for a check-up.

Lewisham and Greenwich Trust did have a notice on its website explaining that data will be shared with non-NHS groups, but much of the attention is directed at whether it counts as adequate notification – understandably most patients admitted for healthcare don’t scrutinise the hospital’s website beforehand.

The ICO (Information Commissioners Office) says that ‘when you share data, you must ensure it is reasonable and proportionate. You must ensure individuals know what is happening with their data unless an exemption or exception applies.’

As much of the concern focuses on the NHS’s lack of transparency, an independent investigation has been launched to look into Lewisham and Greenwich Trust’s conduct. Jim Lusby, director of integrated care at Lewisham and Greenwich Trust, is now looking to find another way of determining whether patients qualify for free treatment.

Experian has clarified the function it provided to the NHS: ‘The Trust submits lists of patient details in order for us to cross reference and check whether they are residents in the UK, and therefore eligible for services.’

‘The information used in this process is subject to strict industry guidelines, and it is not used for any other purpose than helping the NHS Trust identify potential overseas patients, who may be required to pay for treatment under NHS guidelines.’

How do I know if an organisation has shared my data with a Credit Reference Agency?

First off, if an organisation is sharing your data with a third party, it should inform you of this – but as we’ve seen, sometimes that’s not enough to ensure you’re fully aware.

When an organisation shares your data with a Credit Reference Agency, whether for credit application purposes, general enquiries like with the NHS Trust, or even when you use a Credit Report monitoring service, a search entry will be recorded on your Credit Report to reflect the access of the CRA’s records.

Why a ‘search’? The purpose of sharing information with a Credit Reference Agency (so in this case, patient name, date of birth, address, etc.) is to allow the organisation to access and search the CRA’s database. Lewisham and Greenwich Trust wanted access to Experian’s dataset so it could establish whether its patients have a financial history in the UK, and therefore likely to be eligible for free healthcare.

The most reliable way of seeing which organisations have shared your information (and thereby performed a search) with the Credit Reference Agencies is by checking the ‘Searches’ section of your Credit Report.

What do searches look like on my Credit Report?

There are three different types of searches that can be recorded on your Credit Report. Each search entry will have the type of search, the date it was performed, along with the organisation’s name that submitted the search (i.e. shared your information), as well as your name and address exactly as they were shared with the CRA.

The first two search types – Enquiry and Audit searches – are soft searches of your Credit Report that do not affect your creditworthiness in any way. Because they do not reflect applications for products or services, it is highly likely that the searches Lewisham and Greenwich Trust patients find on their Credit Reports from when the Trust shared their data will be soft searches. As a spokesman for the Trust confirmed ‘It is important to stress that Experian [did] not carry out a credit check’.

One of the main differences between an Enquiry and Audit search is that Audits are visible only to you (the data subject) and the Credit Reference Agency that holds the information. No other organisations checking your Credit Report will see Audit searches. Enquiries will be visible, but they are often of no consequence, usually reflecting where your existing lenders have checked your current status. Both types of soft search very often mean that only a portion of your Credit Report was made available to the searching organisation and your private data (account repayment history, most notably) remained unseen.

The third type of search is known as a Credit Application Search. As the name suggests, these are searches performed when you apply for finance or a product like a mobile phone. These are hard searches that show the organisation your full Credit Report, including account repayment history as it’s central to the credit checking process. Credit Application Searches can influence your creditworthiness, as too many in a short time can signal desperation for credit that prospective lenders may wish to avoid, or that multiple lenders are declining you, hence the multiple searches. As explained, patients of Lewisham and Greenwich Trust didn’t have these searches.

How do I check the data held by the Credit Reference Agencies?

You can check to see exactly what the Credit Reference Agencies are holding for you (along with all searches) by viewing your Credit Reports at each of them – Equifax, Experian, and TransUnion. Thankfully checkmyfile makes this process quick and easy.

If you haven’t already, you can view your Multi Agency Credit Report with checkmyfile free for 30 days, then just £14.99 per month. Sign-up is quick and cancellation is easy online at any time, or by freephone or email.

You’ll have access to your complete information from Equifax, Experian, and TransUnion all in one easy-to-use format. You’ll see who’s been sharing information about you and with which CRAs. Our professionally qualified team of Credit Analysts is easily accessible by secure message or phone if you have any questions about your Credit Report.