The Health Service (Control of Patient Information) Regulations 2002

Explanatory Note

(This note is not part of the Regulations)

These Regulations make provision for the processing of patient information, including confidential patient information.

Regulation 1 contains definitions of the terms used in the Regulation and provides that the Regulations apply to England and Wales only.

Regulation 2 makes provision relating to the processing of patient information in connection with the construction and maintenance of databases by bodies (known as “cancer registries”) which undertake the surveillance of health and disease of patients referred for the diagnosis or treatment of neoplasia. Regulation 2(4) provides powers under which the Secretary of State may require certain persons to process information for those purposes. Regulation 2(5) makes provision for information on the operation of these Regulations to be passed to the Secretary of State.

Regulation 3 makes provision for the processing of patient information for the recognition, control and prevention of communicable disease and other risks to public health. Regulation 3(4) provides powers under which the Secretary of State may require certain persons who perform health service or other public functions to process information where, for example, there is a need to assess whether there is a significant risk to public health. Regulation 3(5) makes provision for information on the operation of these Regulations to be passed to the Secretary of State.

Regulation 4 provides that information may be processed in accordance with these Regulations notwithstanding any common law obligation of confidence.

Regulation 5 and the Schedule to these Regulations makes general provision in relation to the processing of patient information. Such processing is restricted to that approved by the Secretary of State and, in the case of processing for research purposes, the relevant ethics committee.

Regulation 6 requires the Secretary of State to record and make public particulars relating to approvals which permit the transfer of confidential patient information.

Regulation 7 restricts the processing of information under the Regulations, for example by requiring the removal of particulars by which the persons to whom information relates can be identified if that is practical (regulation 7(1)(a)).

Regulation 8 provides for enforcement by civil penalty of requirements imposed under regulations 2(4) or (5), 3(4) or (5) or 7.

The Schedule to these Regulations sets out the circumstances in which confidential patient information may be processed for medical purposes under regulation 5. The provisions relate, for example, to the processing of confidential patient information in order to identify who should be invited to participate in medical research (paragraph 3) or to enable the auditing, monitoring and analysing the provision made by the health service (paragraph 5).

A Regulatory Impact Assessment has not been prepared for these Regulations. In general the Regulations enable the flow of information and impose no obligations. Where obligations are imposed, they are imposed primarily on those performing functions for public authorities and so any burden imposed on business is considered negligible.