25 March 2009

DE00000393632

Dear Mr Bhatia,
 
Thank you for your email of 26 February requesting, under the Freedom of Information Act, information about the deletion of Summary Care Records.  Your email has been passed to me for reply.

The Summary Care Record (SCR) is intended to serve a number of important purposes.  These include providing clinicians with relevant information to support care and to improve the outcomes of care, but also the necessary capacity for audit and medico-legal investigation.  These purposes remain valid and relevant even where records have not yet been accessed.

Whilst Health Ministers have determined that patients need not have an SCR if they do not want one, this should not be understood to mean that once created an SCR can be completely removed.  Records can be made inaccessible to staff in a number of ways, but the cost of completely removing them would be prohibitive.

As with all digital records systems, complete removal would require the hardware holding records to be completely sanitised.  This is a process that destroys all data held, for example on a server or hard drive, and not just a particular record. 

Furthermore, the SCR system has been designed in terms of the functionality required when it is fully implemented and employed across England.  When this is the case, the issue of audit and the medico-legal evidential significance of the SCR will be extremely important and it would be inappropriate to provide tools that could completely remove a record, even if this were feasible. 

The Department of Health understands that this position is entirely consistent with the provisions, including principle 5, of the Data Protection Act 1998, and with general principles of privacy and confidentiality.  It takes the view that, as SCRs serve medical purposes as defined in schedule 3 of the Data Protection Act 1998, then subject to processing being lawful in relation to the other provisions of the Act and common law, their continued existence does not require patient consent.  However, we are currently in dialogue with the Office of the Information Commissioner about this and other related issues.

Whilst section 10 of the Data Protection Act 1998 provides individuals with a right to raise concerns about the SCR continuing to exist even when no one can actually see it, the Department believes that the capacity to prevent access is sufficiently robust to meet all reasonable concerns.  The Information Commissioner takes the view that a section 10 notice is only likely to be appropriate where processing has caused, or is likely to cause, someone to suffer loss or harm, or upset or anguish of a real nature, over and above annoyance level, and without justification.

A GP Practice may authorise the masking of an SCR and can accomplish this by uploading a blank record that has the effect of preventing the previous record from being accessed.  Masking records may also be accomplished by a clinician flagging a record to indicate that this is a patient’s preference.  Once a record has been masked, it should only be reinstated at the request of the patient concerned.  The process of reinstating a record is multi-staged and cannot result from human error.  A full audit trail of changes to a patient’s preferences is maintained.

I hope this reply is helpful.

If you have any queries about this email, please contact me. Please remember to quote the reference number above in any future communications.
 
If you are dissatisfied with the handling of your request, you have the right to ask for an internal review. Internal review requests should be submitted within two months of the date of receipt of the response to your original letter and should be addressed to:
 
Head of the Freedom of Information Team
Department of Health
Room 317
Richmond House
79 Whitehall,
London
SW1A 2NS
  
Email: xxxxxxxxxxxxxxxxxxxx@xx.xxx.xxx.xx
 
If you are not content with the outcome of your complaint, you may apply directly to the Information Commissioner (ICO) for a decision. Generally, the ICO cannot make a decision unless you have exhausted the complaints procedure provided by the Department. The ICO can be contacted at:
 
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
 
Yours sincerely,
 

David Winks
Customer Service Centre
Department of Health