Health and Care Act 2022

PART 2 U.K. Health and adult social care: information

92 Information about payments etc to persons in the health care sector U.K.

(1) The Secretary of State may by regulations require manufacturers or commercial suppliers of health care products, or connected persons, to—

(a) publish information about payments or other benefits provided by them to relevant persons, or

(b) provide such information to the Secretary of State.

(2) The regulations may make further provision about when and how the information is to be published or provided.

(3) The information may, in particular, include information about—

(a) a payment or other benefit,

(b) the person who provided it, or

(c) the person who received it.

(4) The regulations may make provision permitting or requiring the further sharing, publication or use of the information.

(5) The regulations may impose requirements on manufacturers or commercial suppliers of health care products, or connected persons, about the retention of information relating to payments or other benefits provided by them to relevant persons.

(6) The regulations may—

(a) authorise the Secretary of State to designate as a “relevant scheme” any scheme under which information about payments or other benefits to relevant persons is collected or published by a person other than the Secretary of State, if the Secretary of State considers that the provision of information under the scheme would render compliance with some or all of the requirements imposed by the regulations unnecessary;

(b) create exceptions from requirements to publish or provide information imposed by virtue of subsection (1) where information is provided under a relevant scheme;

(c) if such exceptions are created—

(i) require a person who holds information mentioned in subsection (1) in connection with the operation of a relevant scheme to provide the information to the Secretary of State;

(ii) permit or require the Secretary of State to publish the information.

(7) The regulations may impose requirements on a person mentioned in subsection (6)(c)(i) about the retention of information mentioned there.

(8) The provision for exceptions that may be made by the regulations includes provision authorising the Secretary of State to grant an exception from a requirement imposed by the regulations in a particular case, on grounds specified in the regulations.

(9) The regulations may provide that the disclosure of information under the regulations does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of the information (however imposed), other than a restriction imposed by the data protection legislation.

(10) Provision made by the regulations may, in particular, be framed by reference to manufacturers or commercial suppliers with a specified connection to the United Kingdom or a part of it.

(11) In this section—

(a) “connected person”, in relation to a manufacturer or commercial supplier, means a person who has a connection, of a description specified in regulations made by the Secretary of State, with the manufacturer or commercial supplier;

(b) “relevant person” means—

(i) a person who provides health care in the United Kingdom or a part of it, whether or not under arrangements made by another person, or

(ii) another person who carries on activities connected with health care provided in the United Kingdom or a part of it and is of a description specified in regulations made by the Secretary of State.

(12) In this section—

• “commercial supplier”, in relation to a health care product, means a person who supplies the product otherwise than in the course of providing health care;

• “data protection legislation” has the meaning given by section 3(9) of the Data Protection Act 2018;

• “health care” means all forms of health care provided for individuals, whether relating to physical or mental health;

• “health care product” means a medicine, medical device or other product which is supplied or prescribed in the course of the provision of health care;

• “manufacturer”, in relation to a health care product, means a person who manufactures or assembles the product;

• “payments or other benefits” includes any payment or other benefit—

  (a)

  wherever it is provided,

  (b)

  whether or not it is of a financial nature,

  (c)

  whether it is provided under a contract or otherwise, and

  (d)

  whether it is provided directly or through a third party.

Commencement Information

I1 S. 92 not in force at Royal Assent, see s. 186(6)

I2 S. 92 in force at 1.7.2022 by S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

93 Regulations under section 92: enforcement U.K.

(1) Regulations under section 92(1) may make provision for the enforcement of requirements imposed by the regulations, including provision conferring on the Secretary of State the power to impose a financial penalty on a person who, without reasonable excuse—

(a) fails to comply with such a requirement, or

(b) provides information in response to such a requirement that is false or misleading to a material extent.

(2) The amount of the financial penalty is to be specified in, or determined in accordance with, the regulations.

(3) Regulations by virtue of subsection (1) must include provision—

(a) requiring the Secretary of State, before imposing a financial penalty on a person, to give the person written notice (a “notice of intent”) of the proposed financial penalty;

(b) ensuring that the person is given an opportunity to make representations about the proposed financial penalty;

(c) requiring the Secretary of State, after the period for making representations, to decide whether to impose the financial penalty;

(d) requiring the Secretary of State, if the Secretary of State decides to impose the financial penalty, to give the person notice in writing (a “final notice”) imposing the penalty;

(e) enabling a person on whom a financial penalty is imposed to appeal to a court or tribunal in accordance with the regulations;

(f) as to the powers of the court or tribunal on such an appeal.

(4) The provision that may be made by the regulations by virtue of subsection (1) includes provision—

(a) enabling a notice of intent or final notice to be withdrawn or amended;

(b) requiring the Secretary of State to withdraw a final notice in circumstances specified in the regulations;

(c) for a financial penalty to be increased by an amount specified in or determined in accordance with the regulations in the event of late payment;

(d) as to how financial penalties are recoverable.

Commencement Information

I3 S. 93 not in force at Royal Assent, see s. 186(6)

I4 S. 93 in force at 1.7.2022 by S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

94 Regulations under section 92: consent U.K.

(1) Before making regulations under section 92, the Secretary of State must—

(a) obtain the consent of the Scottish Ministers in relation to any provision which—

(i) would be within the legislative competence of the Scottish Parliament, if contained in an Act of that Parliament, and

(ii) is not merely incidental to, or consequential on, provision which would be outside that legislative competence;

(b) obtain the consent of the Welsh Ministers in relation to any provision which—

(i) would be within the legislative competence of Senedd Cymru, if contained in an Act of the Senedd, and

(ii) is not merely incidental to, or consequential on, provision which would be outside that legislative competence;

(c) obtain the consent of the Department of Health in Northern Ireland in relation to any provision which—

(i) would be within the legislative competence of the Northern Ireland Assembly, if contained in an Act of that Assembly, and

(ii) is not merely incidental to, or consequential on, provision which would be outside that legislative competence.

(2) Consent is not required under subsection (1)(c) in relation to any provision if—

(a) a Bill for an Act of the Northern Ireland Assembly containing the provision would require the consent of the Secretary of State under section 8 of the Northern Ireland Act 1998, and

(b) the provision does not affect, other than incidentally, a transferred matter (within the meaning of that Act).

Commencement Information

I5 S. 94 not in force at Royal Assent, see s. 186(6)

I6 S. 94 in force at 1.7.2022 by S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)

Prospective

95 Information standards E+W

(1) The Health and Social Care Act 2012 is amended as follows.

(2) In section 250 (information standards)—

(a) for subsection (2) substitute—

“(2) For the purposes of this Part “an information standard” is a standard in relation to the processing of information.

(2A) An information standard must specify to whom it applies.

(2B) An information standard may apply to one or more persons falling within the following paragraphs—

(a) the Secretary of State;

(b) NHS England;

(c) a public body which exercises functions in connection with the provision of health care or of adult social care in England;

(d) any person, other than a public body, who is required to be registered under Chapter 2 of Part 1 of the Health and Social Care Act 2008 in respect of the carrying on of a regulated activity (within the meaning of Part 1 of that Act).”;

(b) in subsection (3), for “services” substitute “care”;

(c) omit subsection (5);

(d) for subsection (6) substitute—

“(6) The Secretary of State must—

(a) have regard to any information standard published by NHS England that applies to the Secretary of State, and

(b) comply with any information standard published by the Secretary of State that applies to the Secretary of State.

(6A) Any other person to whom an information standard published under this section applies must comply with the information standard, except in so far as the requirement to comply is waived (see subsection (6B)).

(6B) Regulations may confer on a person who publishes an information standard the power to waive a person’s requirement to comply with the information standard (in whole or in part and generally or for a specific period).

(6C) The regulations may include provision—

(a) limiting the circumstances in which waivers may be granted;

(b) setting out the procedure to be followed in connection with waivers;

(c) requiring an information standard to include specified information about waivers.

(6D) For enforcement of information standards against persons other than public bodies, see section 277E.”;

(e) in subsection (7)—

(i) at the appropriate place insert—

• ““health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition;”;

(ii) omit the definition of “health services”.

(3) For section 251 substitute—

“251 Information standards: procedure etc

(1) Regulations—

(a) must make provision about the procedure to be followed in connection with the preparation and publication of information standards under section 250;

(b) may require an information standard published under section 250 to be reviewed periodically in accordance with the regulations.

(2) Before laying a draft of regulations under subsection (1) before either House of Parliament, the Secretary of State must consult such persons as the Secretary of State considers appropriate.

(3) For the purposes of section 250 the Secretary of State or NHS England may adopt an information standard prepared or published by another person.

251ZA Information standards: compliance

(1) The Secretary of State may require a person to provide the Secretary of State with documents, records or other information for the purposes of monitoring the person’s compliance with information standards published under section 250.

(2) A requirement under subsection (1) may specify—

(a) the form and manner in which information is to be provided, and

(b) when information is to be provided.

(3) A requirement under subsection (1) must be in writing.

(4) For enforcement of requirements under subsection (1) against persons other than public bodies, see section 277E.”

(4) In section 251C (continuity of information: interpretation)—

(a) after subsection (6) insert—

“(6A) “Health services” means services which must or may be provided as part of the health service in England; and for that purpose “the health service” has the same meaning as in the National Health Service Act 2006 (see section 275(1) of that Act).”;

(b) for subsection (7) substitute—

“(7) “Adult social care” and “public body” have the same meaning as in section 250; and “processes and “processed” are to be read in accordance with the meaning of “processing” in that section.”

(5) In section 304 (regulations etc), in subsection (5), before paragraph (k) insert—

“(ja) regulations under section 250(6B) or 251(1) (regulations about waiver of information standards and the procedure for setting standards);”.

Commencement Information

I7 S. 95 not in force at Royal Assent, see s. 186(6)

Prospective

96 Sharing anonymous health and social care information E+W

After section 251C of the Health and Social Care Act 2012 insert—

“CHAPTER 1B E+W Sharing of anonymous information

251D Sharing anonymous information

(1) A health or social care body may—

(a) require another health or social care body to provide information, other than personal information, that relates only to its activities in connection with the provision of health services or adult social care in England;

(b) require a private health or social care provider to provide information, other than personal information, that relates only to its activities in connection with the provision of health services, or adult social care in England, in pursuance of arrangements made with a public body.

(2) A health or social care body may impose a requirement under subsection (1) only for purposes related to its functions in connection with the provision of health services or adult social care in England.

(3) Regulations may create exceptions to subsection (1), which may be framed by reference to specified bodies or descriptions of bodies, descriptions of information or otherwise.

(4) Subsection (1) does not require a person to process information so as to render it into a form in which it must be provided.

(5) For enforcement of requirements under subsection (1)(b), see section 277E.

(6) For the purposes of this section—

• “adult social care” has the meaning given by section 250(7);

• “health services” has the meaning given by section 251C(6A);

• “health or social care body” means a public body which exercises functions in connection with the provision of health services or of adult social care in England;

• “personal information” means information which is in a form that—

  (a)

  identifies any individual, or

  (b)

  enables the identity of any individual to be ascertained;

• “private health or social care provider” means a person (other than a public body) who provides health services, or adult social care in England, pursuant to arrangements made with a health or social care body;

• “public body” has the meaning given by section 250(7).”

Commencement Information

I8 S. 96 not in force at Royal Assent, see s. 186(6)

97 General duties of the Health and Social Care Information Centre etc E+W

(1) The Health and Social Care Act 2012 is amended as follows.

(2) In section 253(1) (general duties of the Information Centre)—

(a) omit the “and” at the end of paragraph (ca);

(b) after paragraph (ca) insert—

“(cb) the need to promote the effective and efficient planning, development and provision of health services and of adult social care in England,”;

(c) at the end of paragraph (d) insert “, and

(e) the need to balance the needs mentioned in this subsection against one another, so far as they compete.”

(3) In section 261(1A) (other dissemination of information), for “the purposes of” substitute “purposes connected with”.

Commencement Information

I9 S. 97 not in force at Royal Assent, see s. 186(6)

I10 S. 97 in force at 1.10.2022 by S.I. 2022/1003, reg. 2(a)

Prospective

98 Collection of information from private health care providers E+W

In section 259 of the Health and Social Care Act 2012 (powers to require and request provision of information), in subsection (1)—

(a) at the end of paragraph (a) omit “and”;

(b) for paragraph (b) substitute—

“(aa) require any health care provider, not within paragraph (a), to provide the Centre with any information which the Centre considers it necessary or expedient to have for the purposes of complying with a direction of the Secretary of State under section 254, and

(b) request any person to provide the Centre with any information which the Centre considers it necessary or expedient to have for the purposes of any function it exercises by virtue of this Chapter.”;

(c) in subsection (2), for “Those persons” substitute “The persons mentioned in this subsection”;

(d) omit subsection (4);

(e) in subsection (5), after “subsection (1)(a)” insert “or (aa)”;

(f) omit subsection (7);

(g) in subsection (9), after “subsection” insert “(1)(aa) or”;

(h) after subsection (10) insert—

“(10A) For enforcement of requirements under subsection (1)(a) or (aa) against persons other than public bodies, see section 277E.

(10B) In this section “health care provider” means a person who is required to be registered under Chapter 2 of Part 1 of the Health and Social Care Act 2008 in respect of the carrying on of a regulated activity (within the meaning of Part 1 of that Act) involving or connected with the provision of health care.”

Commencement Information

I11 S. 98 not in force at Royal Assent, see s. 186(6)

99 Collection of information about adult social care E+W

In Part 9 of the Health and Social Care Act 2012, after section 277 insert—

“CHAPTER 3 E+W Information about adult social care

277A Provision of adult social care information to Secretary of State

(1) The Secretary of State may require a relevant provider of adult social care services to provide the Secretary of State with information that relates to—

(a) the person on whom the requirement is imposed,

(b) their activities in connection with the provision of adult social care in England, or

(c) any person to whom they have provided —

(i) adult social care in England, or

(ii) adult social care, outside England, in pursuance of arrangements made by an English local authority.

(2) The Secretary of State may impose a requirement under subsection (1) only if the information is sought for purposes connected with the health care system, or adult social care system, in England.

(3) A requirement under subsection (1) may specify—

(a) the form and manner in which information is to be provided, and

(b) when information is to be provided.

(4) A requirement under subsection (1) must be in writing.

(5) The provision of information under this section—

(a) does not breach any obligation of confidence owed by the person providing it, but

(b) is subject to any express restriction on disclosure imposed by any enactment (other than a restriction which allows disclosure if authorised by an enactment).

(6) For enforcement of requirements under subsection (1), see section 277E.

(7) In this section—

• “adult social care”—

  (a)

  includes all forms of personal care and other practical assistance provided for individuals who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or other assistance, but

  (b)

  does not include anything provided by an establishment or agency for which Her Majesty’s Chief Inspector of Education, Children’s Services and Skills is the registration authority under section 5 of the Care Standards Act 2000;

• “English local authority” means—

  (a)

  a county council in England;

  (b)

  a district council for an area in England for which there is no county council;

  (c)

  a London borough council;

  (d)

  the Common Council of the City of London (in its capacity as a local authority);

• “relevant provider of adult social care services” means a person who is required to be registered under Chapter 2 of Part 1 of the Health and Social Care Act 2008 in respect of the carrying on of a regulated activity (within the meaning of Part 1 of that Act) involving or connected with the provision of adult social care.

277B Restrictions on onward disclosure of information

(1) Information provided under section 277A may not be disclosed by the Secretary of State except for purposes connected with the health care system, or adult social care system, in England.

(2) Commercially sensitive information provided under section 277A may not be disclosed by the Secretary of State (even for the purposes mentioned in subsection (1)) unless the Secretary of State considers that the disclosure is appropriate, having taken into account the public interest as well as the interests of the person to whom the commercially sensitive information relates.

(3) Subsections (1) and (2) do not restrict the disclosure of information where—

(a) the person to whom the information relates has consented to the disclosure,

(b) the information has previously been lawfully disclosed to the public,

(c) the disclosure is in accordance with any court order,

(d) the disclosure is necessary or expedient for the purposes of protecting the welfare of any individual,

(e) the disclosure is made to any person in circumstances where it is necessary or expedient for the person to have the information for the purpose of exercising functions of that person conferred under or by virtue of any provision of this or any other Act,

(f) the disclosure is in connection with the investigation of a criminal offence (whether or not in the United Kingdom), or

(g) the disclosure is for the purpose of criminal proceedings (whether or not in the United Kingdom).

(4) In this section “commercially sensitive information” means commercial information whose disclosure the Secretary of State thinks might significantly harm the legitimate business interests of the person to whom it relates.

277C Directions to certain bodies to exercise functions under this Chapter

(1) The Secretary of State may direct the Health and Social Care Information Centre to exercise the functions of the Secretary of State under section 277A (and where a direction is given, section 277B applies accordingly).

(2) The Secretary of State may direct a Special Health Authority performing functions only or mainly in respect of England to exercise the functions of the Secretary of State under section 277A (and where a direction is given, section 277B applies accordingly).

(3) The Secretary of State may give directions to a body about the exercise of any functions that it is directed to exercise under subsection (1) or (2) (including directions as to the processing of information that the body obtains in exercising those functions).

277D Arrangements with third parties

(1) The Secretary of State may make arrangements for any person prescribed by regulations under this subsection to exercise the functions of the Secretary of State under section 277A (and where arrangements are made, section 277B applies accordingly).

(2) Arrangements under subsection (1) may—

(a) provide for the Secretary of State to make payments to the person;

(b) make provision as to the circumstances in which any such payments are to be repaid to the Secretary of State.

(3) Section 304(9) (differential provision) applies in relation to the power to make arrangements under subsection (1) as it applies to a power of the Secretary of State to give directions under this Act.”

Commencement Information

I12 S. 99 not in force at Royal Assent, see s. 186(6)

I13 S. 99 in force at 31.7.2022 for specified purposes by S.I. 2022/734, reg. 3 (with regs. 13, 29, 30)

I14 S. 99 in force at 1.10.2022 for specified purposes by S.I. 2022/1003, reg. 2(b)

100 Enforcement of duties against private providers E+W

(1) The Health and Social Care Act 2012 is amended as follows.

(2) After section 277D (inserted by section 99 of this Act) insert—

“CHAPTER 4 E+W Enforcement

277E Enforcement of provisions under this Part

(1) Regulations may make provision conferring on the Secretary of State the power to impose a financial penalty on a person, other than a public body, who without reasonable excuse—

(a) fails to comply with an information standard (unless the requirement for the person to comply has been waived by virtue of regulations under section 250(6B));

(b) fails to comply with a requirement to provide information imposed under section 251ZA(1), 251D(1)(b), 259(1)(a) or (aa) or 277A(1);

(c) provides information in response to such a requirement that is false or misleading to a material extent.

(2) The amount of the financial penalty is to be specified in, or determined in accordance with, the regulations.

(3) The regulations must include provision—

(a) requiring the Secretary of State, before imposing a financial penalty on a person, to give the person written notice (a “notice of intent”) of the proposed financial penalty;

(b) ensuring that the person is given an opportunity to make representations about the proposed financial penalty;

(c) requiring the Secretary of State, after the period for making representations, to decide whether to impose the financial penalty;

(d) requiring the Secretary of State, if the Secretary of State decides to impose the financial penalty, to give the person notice in writing (a “final notice”) imposing the penalty;

(e) enabling a person on whom a financial penalty is imposed to appeal to the First-tier Tribunal in accordance with the regulations;

(f) as to the powers of the Tribunal on such an appeal.

(4) The provision that may be made by the regulations includes provision—

(a) enabling a notice of intent or final notice to be withdrawn or amended;

(b) requiring the Secretary of State to withdraw a final notice in circumstances specified in the regulations;

(c) for a financial penalty to be increased by an amount specified in or determined in accordance with the regulations in the event of late payment;

(d) for the recovery of financial penalties in the county court.

(5) In this section “public body” has the meaning given by section 250(7).

277F Directions to Special Health Authority to exercise functions under section 277E

The Secretary of State may—

(a) direct a Special Health Authority performing functions only or mainly in respect of England to exercise the functions of the Secretary of State under regulations made under section 277E;

(b) give the Special Health Authority directions about the exercise of those functions (including directions as to the processing of information that the body obtains in exercising those functions).”

(3) In section 304 (regulations etc), in subsection (5), after paragraph (ja) (inserted by section 95 of this Act) insert—

“(jb) regulations under section 277E (regulations about enforcement);”.

Commencement Information

I15 S. 100 not in force at Royal Assent, see s. 186(6)

I16 S. 100 in force at 1.10.2022 by S.I. 2022/1003, reg. 2(c)

101 Medicine information systems E+W

(1) The Medicines and Medical Devices Act 2021 is amended in accordance with subsections (2) to (9).

(2) In Part 2, for the heading of Chapter 1 substitute “Regulations: general”.

(3) After that Chapter insert—

“CHAPTER 1A E+W Regulations: information systems

7A Information systems

(1) The appropriate authority may by regulations make provision about the establishment and operation by the Health and Social Care Information Centre (“the Information Centre”) of one or more information systems for purposes relating to—

(a) the safety of human medicines, including the safety of clinical decisions relating to human medicines;

(b) the quality and efficacy of human medicines.

(2) The regulations may (among other things) make provision—

(a) about the information in relation to human medicines which may or must be entered or retained in an information system established under subsection (1);

(b) requiring information to be provided to the Information Centre for the purposes of its functions under the regulations;

(c) about the use or disclosure of information contained in an information system established under subsection (1);

(d) requiring the Information Centre to have regard to specified matters in exercising its functions under the regulations.

(3) The provision mentioned in subsection (2)(a) and (b) may relate to—

(a) information for specified purposes,

(b) information that the Information Centre considers it necessary or expedient to have for the purposes of its functions under the regulations,

(c) information (including information relating to individuals) which is of a specified description, or

(d) information (including information relating to individuals) which is of a description set out in a direction in writing given by the appropriate authority.

(4) The provision mentioned in subsection (2)(b) may include provision—

(a) requiring, or enabling the Information Centre to require, specified persons or descriptions of persons to whom subsection (5) applies to provide information to the Information Centre;

(b) about the manner in which, and the time at which, those persons must provide information, or for those matters to be determined by the Information Centre;

(c) about any procedural steps the Information Centre must follow in requiring a person to provide information to it;

(d) requiring specified persons or descriptions of persons to whom subsection (5) applies to record or retain information which they are, or may be, required to provide to the Information Centre under the regulations;

(e) in relation to the enforcement of any requirement imposed by or under the regulations.

(5) This subsection applies to any person who provides services, or exercises any powers or duties, relating to—

(a) human medicines,

(b) health, or

(c) education.

(6) The provision mentioned in subsection (2)(c) may include provision about—

(a) the analysis by the Information Centre of information that is contained in an information system (whether alone or in combination with other information) for the purposes mentioned in subsection (1) or for other purposes;

(b) the publication by the Information Centre of information that is contained in an information system or has been analysed in combination with such information;

(c) the disclosure (other than by way of publication) of information mentioned in paragraph (b) to specified persons or descriptions of persons, or for specified purposes;

(d) the use or further disclosure by any person of information disclosed to them under the regulations.

(7) Regulations conferring on the appropriate authority a power to give a direction by virtue of subsection (3)(d) must —

(a) provide that the power includes power to vary or revoke the directions by a subsequent direction, and

(b) in the case of a power exercisable in relation to Wales or Scotland, require the Secretary of State—

(i) where a proposed direction relates to Wales, to consult the Welsh Ministers before giving it, and

(ii) where a proposed direction relates to Scotland, to consult the Scottish Ministers before giving it.

(8) Where regulations under subsection (1) include provision by virtue of subsection (4)(a) which requires, or enables the Information Centre to require, the provision of individual health information held for the purposes of the health service established under section 1 of the National Health Service (Scotland) Act 1978, the regulations must provide for the information to be collected by the Scottish Ministers, or a person designated by them, on behalf of the Information Centre, subject to specified exceptions.

(9) Regulations by virtue of subsection (8) may—

(a) confer powers or duties (including discretions) on the Scottish Ministers, a designated person or the Information Centre;

(b) provide for powers or duties conferred on the Scottish Ministers to be treated for the purposes of section 2 of the National Health Service (Scotland) Act 1978 as functions relating to the health service (within the meaning of that Act).

(10) Where regulations under subsection (1) include provision by virtue of subsection (4)(a) which requires, or enables the Information Centre to require, the provision of individual health information held for the purposes of the health service in Wales, the regulations must provide for the information to be collected by the Welsh Ministers, or a person designated by them, on behalf of the Information Centre, subject to specified exceptions.

(11) Regulations by virtue of subsection (10) may confer powers or duties (including discretions) on the Welsh Ministers, a designated person or the Information Centre.

(12) Regulations under subsection (1) may provide that the disclosure of information by virtue of this section does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of the information (however imposed), other than a restriction imposed by the data protection legislation.

(13) In this section—

• “data protection legislation” has the meaning given by section 3(9) of the Data Protection Act 2018;

• “health service”, in relation to Wales, has the meaning given by section 206(1) of the National Health Service (Wales) Act 2006;

• “human medicine” has the same meaning as in Part 2 (see section 9);

• “individual health information” means information (however recorded) which relates to—

  (a)

  the physical or mental health or condition of an individual,

  (b)

  the diagnosis of an individual’s condition, or

  (c)

  an individual’s care or treatment,

  or is (to any extent) derived directly or indirectly from information relating to any of those matters;

• “specified” means specified in regulations under subsection (1).

7B Offence of disclosing information

(1) A person to whom information is disclosed under regulations under section 7A(1) commits an offence if the person uses or discloses that information in contravention of the regulations.

(2) A person guilty of an offence under this section is liable—

(a) on summary conviction in England and Wales, to imprisonment for a term not exceeding 51 weeks, to a fine or to both;

(b) on summary conviction in Scotland or Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding level 5 on the standard scale or to both.

(3) In relation to an offence committed before the coming into force of section 281(5) of the Criminal Justice Act 2003, the reference in subsection (2)(a) to 51 weeks is to be read as a reference to 6 months.”

(4) In section 19 (medical devices: information systems)—

(a) in subsection (6)—

(i) in paragraph (b) for “contained in an information system” substitute “that is contained in an information system or has been analysed in combination with such information”;

(ii) in paragraph (c) for “contained in an information system” substitute “mentioned in paragraph (b)”;

(b) after subsection (7) insert—

“(7A) Regulations under this section may provide that the disclosure of information by virtue of this section does not breach—

(a) an obligation of confidence owed by the person making the disclosure, or

(b) any other restriction on the disclosure of the information (however imposed), other than a restriction imposed by the data protection legislation.”

(5) In section 43 (power to make consequential etc provision)—

(a) in subsection (1), for “This section” substitute “Subsection (2)”;

(b) after subsection (2) insert—

“(3) Provision made by regulations under section 7A or 19 by virtue of subsection (2)(a) may include provision—

(a) changing the territorial extent of provisions of Chapter 2 of Part 9 of the Health and Social Care Act 2012 (constitution and functions etc of the Health and Social Care Information Centre), or

(b) otherwise amending that Chapter.”

(6) In section 44 (scope of powers of Northern Ireland departments) after “2(1)” insert “, 7A(1)”.

(7) In section 45 (consultation)—

(a) after subsection (1) insert—

“(1A) In relation to proposed regulations under section 7A(1), the Secretary of State must—

(a) where the regulations relate to Wales, specifically consult the Welsh Ministers, and

(b) where the regulations relate to Scotland, specifically consult the Scottish Ministers.”;

(b) in subsection (6), for paragraph (a) (but not the “and” at the end) substitute—

“(a) in relation to regulations made under section 2(1) or 7A(1), the appropriate authority within the meaning given by section 2(6),

(aa) in relation to regulations made under section 10(1), the appropriate authority within the meaning given by section 10(6),”.

(8) In section 46 (reporting requirements)—

(a) in subsections (1), (3)(b) and (4)(a), after “2(1),” insert “7A(1),”;

(b) in subsection (5), in paragraphs (a) and (b) of the definition of “relevant authority”, after “2(1)” insert “, 7A(1)”.

(9) In section 47 (procedure for regulations), in subsection (2), after “2(1)” insert “, 7A(1)”.

(10) In section 253 of the Health and Social Care Act 2012 (general duties of Information Centre), after subsection (2) insert—

“(2A) Subsections (1) and (2) do not apply in relation to the functions of the Information Centre by virtue of the Medicines and Medical Devices Act 2021.”

Commencement Information

I17 S. 101 not in force at Royal Assent, see s. 186(6)

I18 S. 101 in force at 1.7.2022 by S.I. 2022/734, reg. 2(a), Sch. (with regs. 13, 29, 30)