Health and Social Care Act 2001

60 Control of patient information E+W

(1) The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient—

(a) in the interests of improving patient care, or

(b) in the public interest.

This subsection and subsection (2) have effect subject to subsections (3) to (6).

(2) Regulations under subsection (1) may, in particular, make provision—

(a) for requiring prescribed communications of any nature which contain patient information to be disclosed by health service bodies in prescribed circumstances—

(i) to the person to whom the information relates,

(ii) (where it relates to more than one person) to the person to whom it principally relates, or

(iii) to a prescribed person on behalf of any such person as is mentioned in sub-paragraph (i) or (ii),

in such manner as may be prescribed;

(b) for requiring or authorising the disclosure or other processing of prescribed patient information to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information);

(c) for securing that, where prescribed patient information is processed by a person in accordance with the regulations, anything done by him in so processing the information shall be taken to be lawfully done despite any obligation of confidence owed by him in respect of it;

(d) for creating offences punishable on summary conviction by a fine not exceeding level 5 on the standard scale or such other level as is prescribed or for creating other procedures for enforcing any provisions of the regulations.

(3) Regulations under subsection (1) may not make provision requiring the processing of confidential patient information for any purpose if it would be reasonably practicable to achieve that purpose otherwise than pursuant to such regulations, having regard to the cost of and the technology available for achieving that purpose.

(4) Where regulations under subsection (1) make provision requiring the processing of prescribed confidential patient information, then the Secretary of State—

(a) shall, at any time within the period of one month beginning on each anniversary of the making of such regulations, consider whether any such provision could be included in regulations made at that time without contravening subsection (3), and

(b) if he determines that any such provision could not be so included, shall make further regulations varying or revoking the regulations made under subsection (1) to such extent as he considers necessary in order for the regulations to comply with that subsection.

(5) Regulations under subsection (1) may not make provision for requiring the processing of confidential patient information solely or principally for the purpose of determining the care and treatment to be given to particular individuals.

(6) Without prejudice to the operation of provisions made under subsection (2)(c), regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c. 29).

(7) Before making any regulations under this section the Secretary of State shall, to such extent as he considers appropriate in the light of the requirements of section 61, consult such bodies appearing to him to represent the interests of those likely to be affected by the regulations as he considers appropriate.

(8) In this section “patient information” means—

(a) information (however recorded) which relates to the physical or mental health or condition of an individual, to the diagnosis of his condition or to his care or treatment, and

(b) information (however recorded) which is to any extent derived, directly or indirectly, from such information,

whether the identity of the individual in question is ascertainable from the information or not.

(9) For the purposes of this section, patient information is “confidential patient information” where—

(a) the identity of the individual in question is ascertainable—

(i) from that information, or

(ii) from that information and other information which is in the possession of, or is likely to come into the possession of, the person processing that information, and

(b) that information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual.

(10) In this section—

• “the health service” has the same meaning as in the 1977 Act;

• “health service body” means any body (including a government department) or person engaged in the provision of the health service that is prescribed, or of a description prescribed, for the purposes of this definition;

• “medical purposes” means the purposes of any of the following—

  (a)

  preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services, and

  (b)

  informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care or treatment;

• “prescribed” means specified in, or determined in accordance with, regulations made by the Secretary of State under this section;

• “processing”, in relation to information, means the use, disclosure or obtaining of the information or the doing of such other things in relation to it as may be prescribed for the purposes of this definition.