291.This section enables the Secretary of State to make regulations for and in connection with requiring or regulating the processing of patient information in prescribed circumstances. This will make it possible for patients to receive more information about their clinical care and for confidential patient information to be lawfully processed without informed consent to support prescribed activities such as cancer registries. The Government places importance on the consistent use of informed consent as the basis for handling confidential patient information. The regulation–making power in this section is therefore intended to provide for exceptional situations where essential services cannot, having regard to the present NHS systems and available technology, operate on that basis.
292.In recognition of the inherent difficulties associated with using confidential information the Act builds in a number of safeguards over the use of this power to protect patients’ interests. First regulations can only provide for the processing of patient information for medical purposes ( defined in subsection (10)) where there is a benefit to patient care or where this is in the public interest. Secondly , regulations can only require the processing of confidential patient information, where there is no reasonably practicable alternative. The Secretary of State can only make regulations under the terms of this section following consultation with bodies representing the interests of those likely to be affected by the regulations and with the new statutory advisory group introduced by section 61. Finally any such regulations can only be made under the affirmative resolution procedure, requiring the consent of both Houses of Parliament (See section 64(3)).
293.It is envisaged that the Patient Information Advisory Group (to be established under section 61), will consider and advise the Secretary of State as regards each proposed use of the regulation-making power, including as regards the need to use the information and whether consent should be obtained.
294.The Data Protection Act 1998 governs, in broad terms, the processing of information relating to living individuals. This section does not amend that Act. In addition, regulations made under this section will not be capable of derogating from that Act (see note on subsection (6) below). Regulations made under this section may provide additional and more specific restrictions on the use of information relating to patients.
295.Information provided in confidence by patients is also subject to common law requirements which, being derived from case law, are difficult for healthcare professionals to apply with certainty in particular circumstances, especially since there has been little case law relating to healthcare settings. Regulations may provide that the processing of patient information under the regulations is lawful despite any common law obligation of confidence (see note on subsection (2)(c) below).
296.Subsection (1) enables the Secretary of State, subject to limitations imposed by subsections (3) – (6), to make regulations requiring patient information to be processed for medical purposes (as defined in subsection (10)) and regulating such processing.
297.Subsection (2) specifies some of the ways in which the power conferred by subsection (1) may be used.
298.Subsection (2)(a) enables regulations to be made that require specified communications about patients to be disclosed to them by NHS bodies, in certain circumstances. Such regulations may only provide for these communications to be disclosed to those persons to whom they relate or principally relate or to a prescribed person on their behalf, for example a spouse. Such regulations are intended to support the NHS Plan commitment that clinicians will in the future be required to share information about patients with them.
299.Subsection (2)(b) enables regulations to be made which require the disclosure or other processing of specified patient information subject to conditions or the giving of undertakings. This will support public health work and important activities such as cancer registration where it is essential to maximise the patient information available.
300.Subsection (2)(c) enables regulations to be made to permit patient information to be processed lawfully where, but for the regulations, this may be prevented by an obligation of confidentiality at common law. This is subject to the limitations imposed by this section (see, for example, the note on subsection (6)) and human rights requirements.
301.Subsection (2)(d) enables regulations to make provision for their enforcement by the creation of criminal offences.
302.Subsections (3) – (5) serve to limit the use of the power conferred by subsection (1) to make regulations requiring the processing of confidential patient information (as defined in subsection (9)).
303.Subsection (3) provides that regulations cannot be made under subsection (1) if the purpose for which confidential patient information would be used could be achieved in another reasonably practical way, having regard to cost and available technology. In practice this means, for example, that persons cannot be required to disclose confidential patient information where the purpose can be satisfied by use of anonymised information.
304.Subsection (4) requires the Secretary of State to carry out an annual review of whether regulations made under subsection (1) and requiring the processing of confidential patient information would contravene subsection (3). The review must be conducted within one month of each anniversary of the making of the regulations (paragraph (a)) and, if he determines that they would contravene subsection (3), he must vary or revoke them (paragraph (b)).
305.Subsection (5) provides that regulations may not be made under subsection (1) solely or principally for the purpose of determining the care and treatment that is to be provided to individual patients. The care and treatment of individuals should be determined by appropriate professional staff that work with, and are responsive to the preferences of, those in their care.
306.Subsection (6) provides that regulations made under this section cannot make provisions for the processing of information which are inconsistent with the provisions of, or the provisions in instruments made under, the Data Protection Act 1998.
307.Subsection (7) provides that before the Secretary of State may make regulations under this section, he must consult such bodies as appear to him to represent the interests of those likely to be affected by the regulations as he considers appropriate in the light of the requirements of section 61. The consultation is intended to ensure that the regulations are fair and non-discriminatory.
308.Subsection (8) defines patient information as any information that is, or is derived from, information concerning a patient’s physical or mental health or condition, the diagnosis of his condition or his care or treatment. In addition to information which directly identifies individuals, this would include information which is either anonymised (e.g. any information that cannot be tracked back to the individual) or coded (e.g. information that can be tracked back to an individual by persons in possession of the key to the code). It includes information recorded in any manner, whether electronically or manually.
309.Subsection (9) provides that “confidential patient information” for the purposes of the section is patient information that has been obtained by a person who owes an obligation of confidence to an individual where the identity of that individual is ascertainable from that information or from that information and other information which is in, or is likely to come into, the possession of the person processing the information .
310.This section requires the Secretary of State to establish, by regulations, a committee to be known as the Patient Information Advisory Group. The Secretary of State is required to seek and have regard to the views of this Advisory Group prior to laying draft regulations before Parliament under section 60(1) or making regulations under section 60(4)(b).
311.The work of the Advisory Group is intended to provide an additional safeguard for patients as regards use of the power provided by section 60, complementing the safeguards included within that section. Before draft regulations under section 60(1) are laid before Parliament or regulations under section 60(4)(b) are made, the advice of the Advisory Group must be sought. The Secretary of State is required to publish the views of the Advisory Group.
312.In recognition that there may be other issues arising in relation to the processing of patient information, or other information obtained or generated through health service provision, the section also allows the Secretary of State to seek the views of the Advisory Group on these wider matters. It is envisaged that the Advisory Group’s views will be sought on a range of issues pertaining to the confidentiality of patient information and standards of processing such information.
313.It is intended that professional and patient groups will be consulted on appointments to the Advisory Group and its proceedings.
314.A detailed commentary on the subsections of section 61 is set out below.
315.Subsection (1) requires the Secretary of State to establish by regulations the Patient Information Advisory Group as soon as reasonably practicable after Royal Assent.
316.Subsection (2) requires the Secretary of State to seek and have regard to the views of the Advisory Group prior to laying draft regulations before Parliament under section 60(1) or making regulations under section 60(4)(b).
317.Subsection (3) gives the Advisory Group the function of providing advice on wider patient and health service information issues at the request of the Secretary of State.
318.Subsection (4) specifies particular matters that may be contained in the regulations that establish the Advisory Group.
319.Subsection (5) places a duty on the Secretary of State to publish, in an appropriate manner, the advice provided to him by the Advisory Group on proposed regulations.
