Disclosure of confidential patient information and the duty to consult: The role of the health and social care information centre

Medical Law Review

Volumn 21, Issue 3, 2013, Pages 415-447

  Grace, Jamie ^a,b   Taylor, Mark J ^b  

^a UNIVERSITY OF DERBY   (United Kingdom)

^b UNIVERSITY OF SHEFFIELD   (United Kingdom)

Author keywords

[No Author keywords available]

Indexed keywords

ARTICLE; CONFIDENTIALITY; HUMAN; INTERPERSONAL COMMUNICATION; LEGAL ASPECT; PATIENT RIGHT; UNITED KINGDOM;

CONFIDENTIALITY; DISCLOSURE; GREAT BRITAIN; HUMANS; PATIENT RIGHTS;

EID: 84883156316     PISSN: 09670742     EISSN: 14643790     Source Type: Journal    
DOI: 10.1093/medlaw/fwt013     Document Type: Article

References (78)

1. See,http://www.ic.nhs.uk/about-us
2. Department of Health 'A consultation on strengthening the NHS Constitution' (DoH, 5th November 2012) [22], [34]
3. We risk raising antibodies through the use of this term. There is a desire tomove away from describing purposes beyond direct care as 'secondary' as there is a fear that it undermines any perception that they are core (NHS) activity. We use the term here, not in a pejorative way, but to recognise that information is provided by a patient, to a health professional, for the primary purpose of supporting their direct care. Any further use is 'secondary' from the patient's perspective, even if central to the effective and efficient delivery of a modern health service. See, for example, The Bolton Research Group 'Patients' Knowledge and Expectations of Confidentiality in Primary Health Care: A Quantitative Study' (2000) Br J Gen Prac 50 901-2. See also, Department of Health 'Summary of Responses to the Consultation on the Additional Uses of Patient Data', 40, available at,http://www.dh.gov.uk/prod_consum_dh/groups/ dh_digitalassets/documents/digitalasset/dh_110715.pdf
4. There is a proposal to replace Data Protection Directive 95/46/EC with a General Data Protection Regulation (Draft Regulation available at,http://ec.europa.eu/justice/data-protection/document/review2012/com_2012_11_ en.pdf.). The final text cannot yet be reliably anticipated. Where current proposals would modify the position taken by the Directive in ways that are material to our argument that is noted by way of footnote.
5. s 1(1), Part II, Schedule 1
6. s 2(1)(a), Part II, Schedule 1
7. This is not the place to raise the issue of whether the Data Protection Act 1998 improperly implementsDirective 95/46/ECby extending the justification of 'impracticability' to the circumstance where personal data are obtained directly from a data subject. For more on this point, see MJ Taylor 'Health Research, Data Protection, and the Public Interest in Notification' (2011) 19 (2) Med L Rev 267-303 and MJ Taylor, Genetic Data and the Law(Cambridge University Press 2012) 89.The DraftRegulation (above, n 6)would lift the responsibility to provide information where data are not collected directly from the data subject and the provision of such information proves impossible or would involve a disproportionate effort (Art 14(5)(b)).
8. Recital 38: 'Whereas, if the processing of data is to be fair, the data subject must be in a position to learn of the existence of a processing operation and, where data are collected from him, must be given accurate and full information, bearing in mind the circumstances of the collection. '
9. s 10(2). The Draft Regulation (above, n 6) retains the right to object 'unless the controller demonstrates compelling legitimate grounds for the processing which override the interests or fundamental rights and freedoms of the data subjects' (Art 19). If this proposal were to be enacted, then we suggest that this would take us closer to the concept of consultation that we argue for and, arguably, recognise as reasonable objections beyond those currently recognised by the Data Protection Act 1998.
10. These are adapted from the classic requirements for consultation as articulated by Sedley QC and adopted by Hodgson J in R v Brent London Borough Council ex parte Gunning (1985) 84 LGR 168 at 169
11. s 2(2), Part II, Schedule 1
12. A responsibility to respect 'reasonable objection' would seem more consistent with the content of the proposed right to object under the draft General Data Protection Regulation. See above, n 11.
13. It is interesting to note in this context that the prohibition on publication had not apparently been explicit at the time that the manuscript was given over. Rather, 'the Lord Keeper. said that it was not to be presumed that Lord Clarendon, when he gave a copy of his work to Mr. Gwynne, intended that he should have the profit of multiplying it in print; that Mr. Gwynne might make every use of it, except that'. It was assumed by the court that, if there had been an intention to this use, then that would have been made clear. In the absence of such an indication, such use was regarded as improper and prohibited. Duke of Queensberry v Shebbeare (n 15).
14. At least this is how the legal obligation would be currently expressed. See, Campbell v MGN Ltd [2004] UKHL 22; Lord Nicholls [21]. For an interesting history of the common law duty of confidence see M Richardson and others, Breach of Confidence: Social Origins and Modern Developments (Edward Elgar 2012).
15. This is in part because the courts have recognised that failure to maintain public trust in a confidential health service may undermine public health. See, X Health Authority v Y [1988] RPC 379, 386. For recognition of the confidentiality of health records in the context of Art 8 of the ECHR see, for example, MS v Sweden (74/1996/693/885).
16. The idea that one party may be restrained in their actions, by obligations of confidence originally owed by another, can be traced back to Morison v Moat (1851) 68 Eng Rep 492 (Ch). Here a son was prevented by the court from publishing a medical formula in relation to which his father had owed a duty of confidence.
17. British Medical Association, 'Confidentiality and disclosure of health information toolkit' (BMA 2009) 10
18. 'Secondly, I will make it clear that, unless - exceptionally - a requirement to disclose is introduced, doctors are free to respect any objections that a patient may raise' Lord Hunt, House of Lords, Hansard, 21 May 2002: Column 730 (our emphasis)
19. 'My Lords, Britain has had an outstanding record in clinical research since at least the 1920s and that has been based on the use of patient information on a scale not easily achievable in other countries. The assumption which doctors made before the war was that any information about their voluntary hospital patients or their local infirmary patients could be used for research purposes That ethos carried on into the NHS and yet that approach has enabled the disease registries to group up and public health surveillance to take place'. Baroness Northover, House of Lords, Hansard, 21 May 2002: Column 734.
20. Sarah Boseley, '"Grotesque" breach of trust at Alder Hey' The Guardian (29 January 2001)
21. Alan Milburn, Secretary of State for Health, speech to patients' organisations January 2001, quoted in Department of Health, 'Building the Information Core: Protecting and Using Confidential Patient Information - A Strategy for the NHS' (Information Policy Unit, December 2001) 8
22. The revised GMC guidance that prompted the crises was criticised by both those (researchers) wanting access and those (patients) seeking to (protect) confidentiality. See O'Brien and Chantler 'Confidentiality and the Duties of Care' (2003) 29 J Med E 36-40.
23. Originally s60 of the Health and Social Care Act 2001, the power to make such regulations is now contained in s251 National Health Service Act 2006
24. Earl Howe, House of Lords, Hansard, 20 October 2003: Column 1331
25. Processing can be supported where the intention is one or more of the following: (1) To de-identify the patient. (2) To use information about geographical locations of patients for medical research. (3) To enable identification and contact patients for the purposes of obtaining their informed consent to participate in, or allow the use of information for, medical research or to allow the use of tissue or samples for medical purposes. (4) To link, validate, and complete information from different sources. (5) To audit, monitor, or analyse patient care and treatment.
26. [251s] (12) NHS Act 2006: In this section 'medical purposes' means the purposes of any of-(a) preventative medicine, medical diagnosis, medical research, the provision of care and treatment, and the management of health and social care services, and (b) informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment
27. Membership of PIAG transferred to NIGB ECC and, as a sub-committee, advice is offered to the Secretary of State on behalf of the NIGB
28. See,http://www.hra.nhs.uk/hra-news-and-announcements/further-updateon-transfer-of-s251-function-from-nigb-to-hra/
29. s 251(7) NHS Act 2006
30. PIAG, Minutes of Meeting held on 12 September 2007, 3.6. 'Using Section 60 to require Processing'.
31. See also comments of Lord Lester when s 60 of the Health and Social Care Act 2001 [now s 251 NHS Act 2006] was being debated by the House of Lords. Lord Lester, House of Lords, Hansard, 3 May 2001: Column 862
32. NIGB ECC (2012), 'Principles of Decision Making: Exploring the concepts of public interest and reasonably practicable' (NIGB, 2012) 5-6. Paper in NIGB ECC Improvement Programme Series available at,http://www.nigb. nhs.uk/ecc/principles.pdf
33. Regulations 2(4) and 3(4) permit the Secretary of State to require processing where necessary but the power to require disclosure (rather than permit it) has not, as far as we are aware, been relied upon even in relation to these two regulations
34. 'I can give the hon. Gentleman reassurance, both generally and specifically. First, if patients object to their information being passed on, they can tell their doctor, who would not then be compelled to provide the information.' (Ms Hazel Blears) House of Commons, Third Standing Committee on Delegated Legislation (pt 1), 15 May 2002: Column 12.
35. Although for a contrary view on this point see E Histed and D Beyleveld, 'Betrayal of Confidence in the Court of Appeal' (2000) 4 (3-4) Med L Int 277-311
36. However, we note with interest that the Information Commissioner's Office does state an intention to anonymise data should be brought to the attention of a data subject (ICO, Anonymisation: managing data protection risk code of practice, (ICO, 2012, 40)). For an argument in support of this position see Taylor 2011, above, n 9.
37. For discussion of the limits of anonymisation as amethod of protecting privacy, see Taylor 2012, above, n 9, Chapter 6 'Anonymity'
38. Hunter v Mann [1974] QB 767; W v Egdell [1990]; R v Kennedy [1999]; Woolgar v CC of Sussex Police [1999]; Re L (Care Proceedings: Disclosure to a third party) [2000]
39. Per Ungoed-Thomas J in Beloff v Pressdram Ltd [1973] 1 ALL ER 241, 260
40. Data Sharing Code of Practice, 12. [2.30].
41. For example, the Secretary of State's general power under s 2 NHS Act 2006 has been relied upon as the statutory basis for the Personal Demographics Service (Ministry of Justice, Government Response to the Joseph Rowntree Trust Report: 'Database State', (MoJ, 2009, 18)
42. See,www.ic.nhs.uk/about-us
43. 'Confidential Information' is defined within the Act as 'information which is in a form which - (a) identifies any individual to whom the information relates who is not an individual who provides health or adult social care, or (b) enables the identity of such an individual to be ascertained.' (s 256(1)).
44. 'Principal Body' means Monitor, the Care Quality Commission, the National Institute for Health and Care Excellence, and such other persons as may be prescribed in regulations (s 255(9))
45. A request of this kind constitutes a 'mandatory request' (s 255(4)) and mandatory requests for confidential information are permitted under s 256(2))
46. Under s255 any person (including a devolved authority) can request that the Information Centre 'establish and operate a system for the collection or analysis of information of a description specified in the request' but s 256 limits requests for confidential information
47. s 261(5)(d). Note, the NHS Commissioning Board will enjoy similarly broad powers of disclosure.
48. s 261(6). This must surely restrict any reliance upon 'expediency' where that could not also be shown to be necessary.
49. Schedule 3 sets out the conditions relevant for the purposes of the first data protection principle. One would usually expect processing by the Information Centre to satisfy paragraph 8 ('processing is necessary for a medical purpose') but conferment of certain functions upon the Information Centre by statute will also bring it within the terms of paragraph 7(1)(b) ('processing is necessary - for the exercise of any function conferred on a person by or under any enactment').
50. S13Z3 (2) HSC Act 2012 states that only paragraphs (a) to (c) and (h) of subsection (1) 'have effect notwithstanding any rule of common law which would otherwise prohibit or restrict disclosure'. In cases of disclosure permitted under (d) [welfare of the individual], (e) [exercising statutory functions], (f) [Board function], (g) [investigation of criminal offence], then common law rules will still apply. It is interesting to note that in a version of the Health and Social Care Bill (accessed from,www.parliament.gov.uk. on February 2012), S13Z3 read more broadly: '(2) This section has effect notwithstanding any rule of common law which would otherwise prohibit or restrict the disclosure.'
51. Litster v Forth Dry Dock and Engineering Co Ltd [1988] UKHL 10
52. Robertson, R (on the application of) v City of Wakefield Metropolitan Council, [2004] EWHC Admin 915 (16th November 2001) [24]
53. Even explicit repeal might be insufficient to avoid EU responsibilities. See Marleasing SA v La Commercial Internacional de Alimentacion SA [1990] ECR 1-4135, esp. 4159; Francovich v Italy [1993] 2 CMLR 66: R v Secretary of State for Transport, ex parte Factortame Ltd (No 2) [1990] EUECJ C-213/ 89. If the government really wished to avoid EU responsibilities, then it would have to repeal the European Communities Act 1972.
54. s 255(3), Health and Social Care Act 2012
55. s 3(2), Part II, Schedule 1, Data Protection Act 1998
56. s 10(2)(a) actually states that the right to prevent processing likely to cause damage or distress does not apply 'in a case where any one of the conditions in paragraphs 1 to 4 of Schedule 2 is met'. The third paragraph of Schedule 2 refers to a case where 'The processing is necessary for compliance with any legal obligation to which the data controller is subject, other than an obligation imposed by contract.'
57. For example, between Public Protection Networks. See Sir Ian Magee, The Review of Criminality Information, 2008, 14.
58. MS v Sweden (1999) 28 EHRR 313; Z v Finland (1998) EHRR 371
59. We focus here upon the instrumental value of consultation, informing decisions to support only necessary and proportionate interference, and leave for now the question of whether Art 8 entitles consultation as a substantive right in itself. This is something indicated in the case of Re G: 'So procedural fairness is something mandated not merely by Article 6, but also by Article 8'. Per Munby J, Re G (Care: Challenge to Local Authority's Decision) [2003] EWHC 551 (FAM) [34].
60. See concluding chapter of ML Flear and others (eds), European Law and New Health Technologies (OUP 2013)
61. W v UK (1987) 10 EHRR 29 (parents' involvement in a local authority decision to take child into care); McMichael v UK (1995) 20 EHRR 205, [87] (need for parental involvement in a decision making process which might have a 'drastic effect on the relations between parent and child' [102]); R (S) v Plymouth City Council [2002] 1 WLR 2583, [48] (successful challenge to denial of access to information about guardianship order concerning an adult child by the mother as it denied adequate involvement in decision making process); Connors v UK (2005) 40 EHRR 9 (successful complaint of inadequate opportunity to challenge allegations which led to eviction); R (B) v Crown Court at Stafford [2006] EWHC 1645 (Admin) [23] (established procedural fairness in the light of Art 8, supported the claim for notice of a witness summons together with right of representation as a process that 'must be such as to secure that the views of those whose rights are in issue are made known and duly taken account of' [23]); and, the recent Scottish case of South Lanarkshire Council v Ellen McKenna [2012] CSIH 78, [13] (requirement to give notice of the reasons before depriving someone of their home)
62. A lack of objection following consultation might imply some form of consent. We seek here, however, to distinguish consultation from both consent and dissent. For more on the distinction see the later discussion in section VI(C).
63. The courts have acknowledged that a loss of trust might lead individuals to withhold information relevant to their care. In this way, opportunities to engage patients in decisions over disclosure might be valuable for health-care reasons independent of any value in challenging the proportionality of disclosure.
64. It is worth noting in this context that when considering the proportionality of the retention of DNA data for forensic purposes, the European Court of Human Rights, in the case of S and Marper v the UK (4th December 2008), was 'struck by the blanket and indiscriminate nature of the power of retention in England and Wales' [119] and the lack of any provision for 'independent review' [119]
65. In a different context concerned with public confidence in journalism; if journalists were too readily required to hand over individual information about members of the public, this would have a detrimental effect on transparency and freedom of expression in the longer term, since public confidence in the press would be reduced, as was noted by the High Court in British Sky Broadcasting Ltd & Others v Chelmsford Crown & Another [2012] EWHC 1295 (Admin)
66. See R (L) v Commissioner of the Police of the Metropolis [2009] UKSC 3 and subsequent cases, discussed below
67. For example, s 115 Crime and Disorder Act 1998 allows for sharing of information between policing authorities and local authorities in connection with an application for an anti-social behaviour order. The Child Sex Offender Disclosure Scheme is empowered by explicit statutory provisions (s327A Criminal Justice Act 2003 as amended etc). In the context of the sharing of criminality information, however, the statutory provision most drawn upon in terms of giving legitimacy to that sharing of criminality information is s113B Police Act 1997, as amended.
68. See Woolgar (n 86), under heading 6, 'The Issue'
69. See David Mead, 'Outcomes aren't all: defending process-based review of public authority decisions under the Human Rights Act', PL 2012, January, 61-84
70. See Woolgar (n 86), under heading 9, 'Conclusion'
71. Neuberger LJ in R (L) v Commissioner of the Police of the Metropolis [2009] UKSC 3, [82]
72. Munby LJ in R (on the application of H) v A City Council [2011] EWCA Civ 403, [50-52]. Interestingly, though he is critical of this perception, David Mead highlights that such ECHR-based proportionality need not include a procedural element in circumstances 'set in stone' by the 'triptych' of House of Lords cases in R. (Begum) v Governors of Denbigh High School [2006] UKHL 15, Belfast City Council v Miss Behavin' Ltd [2007] UKHL 19, and R. (on the application of Nasseri) v Secretary of State for the Home Department [2009] UKHL 23, where for the purposes of the proportionality test, 'outcome is all'. See David Mead (n 89). We would add to Professor Mead's analysis the idea that in the context of criminality information sharing (CIS), given the procedural component of Art 8 ECHR identified in the later decision of L in the UKSC in 2009, there is a procedural element to proportionality-based review and we would extend that differentiation to the context of processing patient information without consent through the operation of the HSCA 2012.
73. Munby LJ in R (on the application of H) v A City Council [2011] EWCA Civ 403, [50-52] (emphasis in original)
74. R (C) v Secretary of State for Justice & Another [2011] EWCA Civ 175 [25-26]
75. In R (B) v The Chief Constable of Derbyshire Constabulary [2011] EWHC 2362 (Admin), Munby LJ said: 'On a proper application of the relevant principles this was a case in which, in my judgment, compliance with the procedural requirements of Article 8 required that the claimant be given adequate opportunity to make representations before any ECRC was issued. He ought to have been sent a draft of the Certificate. He was not; so there was, in my judgment, a breach of Article 8. On the other hand, there was nothing in the circumstances of the case to take it so far out of the typical as to require disclosure of the documents, let alone the all-embracing disclosure demanded, nor to justify anything going beyond affording the claimant, as he was eventually offered, the right to make written representations.' [70] [our emphasis].
76. See, for example, Miss Behavin' [2007] UKHL 19, [13]
77. Department of Health, 'A consultation on strengthening the NHS Constitution' (DoH, 5th November 2012) Annex 4, 7
78. Beloff v Pressdram Ltd [1973] 1 ALL ER 241, 260