care. data Programme
Date Reviewed
20 December 2013
Owner
[S40],
[S40],
[S40]
Headline
‘care.data’ is NHS England’s programme to make increased use
of information from medical records with the intention of
improving health services. The system is being delivered by the
Health and Social Care Information Centre (HSCIC) and the
NHS.
Background
England has some of the world’s best health and care information resources, with the
new powers of the HSCIC presenting a unique opportunity to link and use a new
wealth of previously unavailable linked data.
NHS England’s ‘care.data’ programme approach, drawing data directly from existing IT
systems used across the health and care system, rather than as separate data
collections, then linking this data within the secure environment of the HSCIC
represents a less burdensome mechanism very much in line with the recent Francis
response and the NHS Confederation’s linked report on reducing burdens.
As a first step, NHS England has directed the HSCIC to collect primary care data to
link to Hospital Episode Statistics. Initially, this will be used to support commissioning.
In the future, the HSCIC will also collect other information from different parts of the
health and social care system to create a joined-up picture of the care delivered.
For the primary care data, only the agreed amount of information required will be used.
GP representatives have been involved in deciding which health, care and treatment
information is needed and should be extracted. Date of birth, postcode, NHS number,
and gender (but not the name or full address) of the patient will be used to link records
in a secure environment before being removed. Once this information has been linked,
a new record will be created with a reference number that does not identify the
individual. This new record will not contain information that identifies individuals.
Under the Data Protection Act 1998, GPs, as data controllers have fair processing
responsibilities in relation to the planned extraction of primary care data from GP
systems. In practice, this responsibility means ensuring that a person’s personal data
are handled in ways that are transparent and that they would reasonably expect. It is
important that patients are aware that the HSCIC has powers to extract confidential
data and that they understand what they need to do if they wish to object. Guidance
was provided to GP practices on these fair processing responsibilities on 18th October
2013.
As set out in the NHS Constitution, individuals have a right to object to the disclosure
of confidential data about them and they have a right to have any reasonable
objections respected. In addition, as Secretary of State for Health you gave a
commitment that in relation to data held in GP records, individuals’ objections to
disclosure to the Health and Social Care Information Centre will be respected in all but
exceptional circumstances (e.g. in the event of a civil emergency). A member of the
public can inform their GP of their wishes to object and they do not need to give a
reason for their objection. The right to object has been implemented as a constitutional
rather than legal right.
Key Points
• Care.data will provide comprehensive, timely, and accurate data to deliver
improvements to health and social care.
• NHS E are not developing care.data to generate a profit: we are developing it
with the purpose of improving healthcare for all.
• HSCIC, which is delivering the care.data programme, only seeks to recoup the
cost of processing and analysing data from the organisation requesting it.
• NHS E’s ambition is minimise these costs in order to encourage more analysis
of the data for the benefit of patients.
(i)
Currently, the linked hospital to GP data can only be used for the
purposes of commissioning healthcare services. As a result, only NHS E,
clinical commissioning groups and local authorities will be able to request
pseudonymised care.data data reports since these are the organisations
that have responsibilities for planning and purchasing healthcare services
on behalf of populations
(ii)
NHS England’s ambition is for other organisations, such as charities,
think-tanks, and universities and other research organisations to be able
access the data for the benefit of patients and citizens.
(iii) Robust information governance and controls are in place to safeguard
patient confidentiality.
(iv) Data will only be released by the HSCIC:
• if it has been anonymised in accordance with the Information Commissioner’s
code
of practice on anonymisation or
• where there is a legal basis for the disclosure of confidential data (e.g., if a patient
has given their consent or where there is special approval under section 251 of the
NHS Act for the data to be used for research).
(v) From April 2013, the Health and Social Care Information Centre has
taken on its new status and functions – collecting, linking securely and
publishing a wealth of core data – enabling it to become the national focal
point and key resource for health and care information. Provisions in the
Health and Social Care Act 2012 are designed to strengthen and clarify
the role of the Health and Social Care Information Centre so that
information can be collected, held securely and made readily available to
those who need it in safe, de-identified formats, with crucial safeguards in
place to protect the confidential data it holds.
(vi) People’s private, identifiable health information cannot be shared unless
there is a legal basis to do so. All data drawn from health and social care
records for these purposes will be held securely by the Health and Social
Care Information Centre and will only be made available more widely, in
safe, de-identified formats, with crucial safeguards. These safeguards are
set out in law to protect the confidentiality of each individual patient.
January 2014 care.data leaflet drop
The public awareness campaign began in summer 2013, with leaflets and posters in
GP surgeries from August 2013, so that GPs could make their patients aware and fulfill
their obligations in relation to fair processing. This was supported by digital content on
NHS Choices and FAQs for GP practices to respond to patient queries. Guidance as
also issued jointly with the BMA and RCGP to GP practices.
NHS England colleagues have planned a mail drop to every household in England to
help ensure that people are aware that data from their GP records will be extracted
securely to the Health and Social Care Information Centre (HSCIC) as part of the
‘care.data’ programme.
NHS England will be sending a leaflet to every household in England during January
2014, commencing 6 January. The leaflet will explain how the NHS uses patient data
and what patients should do if they have any concerns or if they wish to object.
No data will be extracted until spring 2014. GP practices will be notified in advance of
the first extraction and they will be able to view the data extract before it is sent to the
HSCIC.
Media messages will make clear and reaffirm your commitment that any person who
having discussed this with their GP does not want the personal data held in their GP
record to be shared with the HSCIC, will have their objection respected
The household leaflet drop has been designed to support this ongoing public
awareness campaign and there will be a coordinated set of activities in place to
support it as set out below.
The leaflets will be delivered over a four-week period:
Region 1 (North)
Week commencing 6 January 2014
Region 2 (Midlands and East)
Week commencing 13 January 2014
Region 3 (South)
Week commencing 20 January 2014
Regional 4 (London)
Week commencing 27 January 2014
Patients will then have a minimum of four weeks to read the leaflet and register their
objection at the GP practice, if they wish to do so, before the first extract begins.
A patient information line has also been put in place and will be operational from 6
January so that members of the public can call and speak to a trained operator about
any queries they may have after reading the leaflet.
The first extract is planned for March, although this will be for a small percentage of
practices, building over a 3 month period with full extractions anticipated in May 2014.
This will allow time to assess the quality of the primary care data and the linkage (to
hospital data) before it is made available to commissioners in anonymised form from
July 2014.
Possible Objections Q & A
•
Can someone stop their identifiable data being used by the HSCIC after it
has already been sent, for example, if they don’t lodge their objection in
time?
An objection applies from the point that the patient makes that objection. Therefore,
it cannot be applied retrospectively. Patients can notify their GP of their objection at
any time (See FAQ 24 for the code to enter)
If a person has concerns about the data the HSCIC may hold about them and
would like it to be anonymised, they should contact the HSCIC directly via
xxxxxxxxx@xxxxx.xxx.xx.
•
If a patient objects to PCD from being shared by the HSCIC but there is
approval under Regulation 5 (anecdotally known as section 251 approval)
what would happen?
It is a standard condition of support under these Regulations that patient objections
be respected. Therefore, if a patient has objected to their PCD being shared by the
HSCIC, then the standard conditions of support under Regulation 5 would require
that objection to be upheld.
Decisions to override a recorded objection would only be made in the most
exceptional circumstances (e.g. serious public safety concerns).
•
How will the HSCIC know I have objected?
There are three possible scenarios:
• If a patient has objected to personal confidential data about them leaving the GP
Practice only then no information that could identify them will leave the practice.
The HSCIC will take a count of the number of these objection codes applied at
each practice .
• If a patient had objected to the HSCIC sharing personal confidential data only
then the note of this objection will come to the HSCIC with the data extracted
from the GP system so this can be upheld whenever the HSCIC shares PCD.
• If both objection codes are applied to a patient’s record then it is necessary for
the patient’s NHS number to flow from the GP practice to the HSCIC so that the
patient’s objection to information leaving the HSCIC can be actioned. The
HSCIC needs the NHS number in order for them to apply the objection to any
other data they already hold that also contains that NHS number. No other
information, which identifies the patient will flow to the HSCIC from the practice.
Where the HSCIC receives approval to release data it holds in identifiable form
it will first check the NHS number and where an objection is recorded for that
NHS number it will remove the NHS number, and all personal data items (where
these exist) before the data is released.
Department of Health - care.data standard lines
1. How have stakeholders and patients been involved?
1
2. I will be opting all my patients out.
1
3. Why has an opt-out system been chosen rather than an opt-in system? 2
4. Is there a discrepancy between the stated purpose of data sharing
(to improve the generic understanding of the most important health
needs and quality of care) and the proposal to share NHS numbers?
2
5. Should we write to every patient?
2
6. Why should GPs take on this additional workload?
3
7. What national awareness raising activities have taken place?
3
8. How does this relate to the Summary Care Record?
3
9. Has the ICO agreed to the plans?
4
1.
How have stakeholders and patients been involved?
NHS England and the HSCIC have worked closely with the British Medical Association and
with the Royal College of General Practitioners during the process. We have listened to and
incorporated views of these professional organisations, which culminated in publishing joint
guidance and materials for GP practices.
The Independent Advisory Group (IAG) of the General Practice Extraction Service (GPES),
considered the specification of the GP data. The group, which includes lay representatives,
approved the extraction of GP data in order for it to be linked to hospital data and made
available to commissioners.
Patients were involved in commenting on the patient materials for informing patients about
data sharing and use. These materials, which included posters and leaflets, were then tested
in a small number of practices over the summer of 2013. GP practice staff and patients were
invited to provide feedback on the materials and NHS England communicated with these first
practices in order to gauge public acceptability at this preliminary stage.
Information about the programme has been sent to over 350,000 patient groups, charities, and
voluntary organisations. In addition, NHS England has been engaging with the
strategic
partnership programme (see
https://www.gov.uk/government/publications/the-department-of-
health-voluntary-sector-strategic-partner-programme), which enables voluntary sector
organisations to work in equal partnership with the Department of Health (DH), the NHS and
social care to help shape and deliver policies and programmes.
A series of meetings are being held with patient groups to discuss care.data. Meetings have
been held with stakeholders for example with the Association of Medical Research Charities,
Cancer Research UK and the British Heart Foundation. This is an ongoing exercise and
further meetings will be held over the coming weeks and months with patient groups and
charities to discuss and seek their views on the design and implementation of care.data.
2.
I will be opting all my patients out.
The Health and Social Care Act 2012 provides a legal basis for the Health and Social Care
Information Centre (HSCIC) to require confidential data when directed by the Secretary of
State for Health or by NHS England. Opting all your patients out would be a breach of the
Health and Social Care Act 2012.
The HSCIC will record the numbers of patient objections made at each practice. Where there
appears to be an abnormal number of objections, the BMA and NHS England will explore with
practices why this might be occurring.
3.
Why has an opt-out system has been chosen rather than an opt-in system?
The Health and Social Care Act 2012 provides a legal basis for the Health and Social Care
Information Centre (HSCIC) to require confidential data when directed by the Secretary of
State for Health or by NHS England. The Act overrides the common law duty of confidentiality
requirement to seek patient consent. There is therefore no legal requirement to seek patients’
consent for care.data extractions so this is not a consent model, like with the Summary Care
Record.
We are committed to safeguarding patient confidentiality and to respecting patients’ views in
relation their data. For this reason, we have ensured that if a patient objects to their
confidential information being shared beyond their care, their objection will be respected,
except in exceptional circumstances (for example, if there is a court order or an overriding
public interest such as in the event of a civil emergency). The right to object has been
implemented as a constitutional rather than legal right.
4.
Is there a discrepancy between the stated purpose of data sharing (to
improve the generic understanding of the most important health needs and
quality of care) and the proposal to share NHS numbers?
Identifiers (NHS number, postcode, DOB and gender) are extracted into the HSCIC to allow
data to be linked. Identifiers are held separately from clinical data within the HSCIC. Identifiers
are then replaced by a pseudonym, which does not reveal a patients real world identity. This is
an automated process.
Three types of data which will be disclosed by the HSCIC
•
aggregated/anonymised data - with safeguards to ensure that the data are truly
anonymous in line with ICO advice. This data can be published openly.
•
potentially identifiable data - the data may be identifiable e.g. due to small numbers
of patients with a condition and is therefore only made available to approved
organisations under a contract, in line with Information Commissioner's Office
guidance.
•
Identifiable data - this may only be released where there is a legal basis for example,
where there is special approval for the data to be used for medical purposes such as
research under section 251 of the NHS Act.
5.
Should we write to every patient?
We have issued further guidance on what GPs should do to meet their fair processing
requirements under the Data Protection Act 1998. This advice is available at:
http://www.england.nhs.uk/wp-content/uploads/2013/10/cd-proc-guid-bma.pdf
6.
Why should GPs take on this additional workload?
We are very conscious of not burdening GPs with additional workload, however, GPs, as data
controllers, have legal responsibilities under the Data Protection Act (DPA) 1998 for ensuring
that patients are aware of how their information are used and shared. This does not just relate
to care.data but any use of data for wider purposes.
For this reason, the patient leaflet we have produced does not only cover care.data but
supports GP practices in meeting this requirement in relation to all uses of data. We have
liaised with a number of stakeholders to ensure it broadly meets their requirements. It is the
intention in the longer term, to minimise the number of communications, which GP practices
are asked to share with patients.
We have provided additional guidance to GPs on the reasonable steps that GP practices
should take to meet their
fair processing obligations under the Data Protection Act 1998. In
addition, we are supporting GP practices with national awareness raising activities (see FAQ 9).
The aims of care.data include ensuring that linked data can be used to assess the population's
health needs, plan and monitor services with the aim of improving quality and efficiency,
supporting commissioners with evidence to make improvements, easing the burden on the
system.
7.
What national awareness raising activities have taken place?
(Lines revised February 2014)
Both NHS England and the HSCIC are supporting GPs with their awareness raising obligations
through a range of regional and national activities. For example, they have:
•
distributed resources and guidance to every GP practice, including patient information
materials and frequently asked questions;
•
introduced dedicated patient support pages on the NHS Choices website; and
•
provided information to 350,000 charities and voluntary groups and asked them to
share the information with their members.
In addition, NHS England is sending a patient leaflet to every household in England.
8.
How does this relate to the Summary Care Record?
We are aware that there has been some confusion about the Summary Care Record (SCR)
and the primary care data extract for care.data. We will be including a clarifying sentence in the
patient leaflet being delivered to all households. The two initiatives are very different.
The Summary Care Record is an electronic health record, which provides healthcare staff with
rapid access to essential information about an individual patient in order to provide direct care
and treatment to them.
Care.data will use data for purposes other than direct care. It will be extracting coded GP data
which will enable the health service to link data to other information about a patient from other
healthcare settings to ensure that commissioners and providers obtain a more complete and
balanced picture of the care being delivered to NHS patients and are in a position to address
inequalities in health service provision.
Information for care.data will be extracted into the secure environment of the Health and Social
Care Information Centre (HSCIC) as a series of codes together with the NHS number,
postcode, gender and Date of Birth. These data are then processed in an automated way. The
information released from the linked data will not identify individuals unless there is a legal
basis e.g. patient consent or approval under Section 251 of the NHS Act.
It is important to note that if a patient has opted out of having an SCR this will NOT
automatically apply to care.data extractions. Consent sought for the SCR was for that specific
purpose. If a patient wishes to opt out of the SCR and prevent confidential data being used for
wider purposes beyond their care, then
both the SCR dissent and the objection codes detailed
in the care.data guidance should be applied.
9.
Has the ICO agreed to the plans?
NHS England the HSCIC have worked closely with the ICO. The ICO has examined in detail
our plans and has been involved in commenting on our materials. A statement on care.data is
available on the ICO website at:
http://www.ico.org.uk/news/current_topics
We will continue to liaise with the ICO to ensure compliance with the Data Protection Act
1998.
Frequently asked questions for patients
1. Why do I need to read the leaflet ‘Better information means better care’?
The leaflet contains important information about your health records. It explains that
NHS organisations share information about the care that you receive with those who
plan health and social care services, as well as with approved researchers and
organisations outside the NHS, if this may benefit patient care.
It is important you know how information about your health is used, shared and
protected and what choices you have.
2. Why is information collected?
By using information about the care you have received, those involved in providing
health and care services can see how well different services are performing and where
improvements need to be made.
Sharing information about the care you have received helps us understand the health
needs of everyone and the quality of the treatment and care being provided. It also
helps researchers by supporting studies that identify patterns in diseases, responses to
treatments, and the effectiveness of different services.
3. What is the “secure environment” mentioned in the leaflet?
The secure environment is called the Health and Social Care Information Centre,
which is a public body based in Leeds. The Health and Social Care Information Centre
was set up in April 2013 as the central source of health and social care information in
England.
The role of the Health and Social Care Information Centre is to ensure that high quality
information is used appropriately to improve patient care. The organisation has legal
powers to collect and analyse information from all providers of NHS care. It is
committed, and legally bound to the very highest standards of privacy, security and
confidentiality to ensure that your confidential information is protected at all times.
Access to information is strictly controlled. Further information about the Health and
Social Care Information Centre is available at www.hscic.gov.uk/patientconf
4. What is changing?
For decades, the NHS has been using information from health records for purposes
other than providing your direct care, for example to support research and to help plan
new health services. However, we need to upgrade our information systems and
collect information from more places where you may receive care. Doing so will make
sure that we have joined-up information about all parts of the NHS, as well as public
health and social care services.
5. Why are these changes needed? The NHS has some of the best information systems in the world. Since the 1980s, we
have been collecting information about every hospital admission, nationwide. This
information is brought together at the Health and Social Care Information Centre,
where it is anonymised (see FAQ 7 below). The information has been invaluable for
monitoring the quality of hospital care, for planning NHS services, and for conducting
research into new treatments. However, the information collected is incomplete, with
areas such as prescribing and test results not currently included. Additionally, while we
have this type of information already for some of the care provided outside hospitals,
there are significant gaps. As a result, it is not currently possible for us to see a
complete picture of the care that patients receive.
NHS England has therefore commissioned a programme of work on behalf of the NHS,
public health and social care services to address these gaps. Known as the care.data
programme, this initiative has been designed to ensure that there is more rounded
information available to citizens, patients, clinicians, researchers and the people that
plan health and care services. Our aim is to ensure that the best possible evidence is
available to improve the quality of care for all.
6. When will these changes occur? The first change is that information from GP practices will be brought in to the Health
and Social Care Information Centre in spring 2014. This information will be joined to
the hospital information that is already held by the Health and Social Care Information
Centre. In the future, we will also collect information from different parts of the health
and social care system to create a joined up picture of all the care delivered.
7. Will confidential information be shared?
The Health and Social Care Information Centre collects information from a range of
places such as your GP practice, hospitals and community services. This information
includes postcodes and dates of birth so that the information about an individual can
be joined together accurately. However, there are very strict rules about what
information the Health and Social Care Information Centre can release to the NHS and
outside organisations. Information can be released in three ways:
•
Anonymised information – this information does not identify any individuals, nor
small numbers of patients with rare characteristics or diseases. Anonymous
information may be published in public reports produced by the HSCIC.
•
Potentially identifiable information – this is information about individual patients
but it does not include any identifiers (i.e., there are no personal details such as
your date of birth and postcode included). We would never publish this type
information because there is a risk that you might be identified. For example, if you
were the only person in an area who had a rare disease then someone may work
out that it was you even though your identifiers were not included. As a result, there
are strict controls about how we release potentially identifiable information. For
example, we would only ever release this type of information to approved
organisations for approved purposes, and there must be a legal contract in place
with penalties for any misuse of the information.
•
Identifiable information – information that identifies you can only be disclosed
where you have given your explicit consent (such as where you have agreed to
participate in a research study) or there is a legal basis for doing so (please see
FAQ 22).
8. What kinds of information sharing can I object to?
There are two types of information sharing you can object to:
• You can object to information containing data that identifies you from leaving your
GP practice. This type of objection will prevent the identifiable information held in
your GP record from being sent to the Health and Social Care Information Centre’s
secure environment. It will also prevent researchers who have gained legal
approval (see FAQ 22) from receiving your health information.
• Information from other places where you receive care, such as hospitals and
community services is collected nationally by the Health and Social Care
Information Centre. The Health and Social Care Information Centre only releases
this information in identifiable form where there is legal approval for doing so such
as for medical research (please see FAQ 22).
This legal approval is only granted where:
• in the interests of patients or the wider public to do so; and
• it is impractical to obtain each individual patient’s consent; and
• it is not possible to use anonymised data.
If you object, this type of information will not leave the Health and Social Care
Information Centre to researchers with approval. The only exceptions are very rare
circumstances such as a civil emergency or a public health emergency.
9. Will my whole GP record be used?
No. Only the agreed amount of information required will be used. GP representatives
and an independent advisory group have been involved in deciding which health, care
and treatment information should be extracted. Your date of birth, postcode, NHS
number, and gender (but not your name or full address) will be used to link your
records in a secure environment at the Health and Social Care Information Centre but
will then be removed (see FAQ 3). Once this information has been linked, a new record
will be created with a reference number that does not identify you. This new record will
not contain any information that identifies you.
10. I can’t get in to my GP Practice to object, what should I do?
Please contact your GP Practice by telephone or email to discuss with them what
arrangement would work best. If you have a query or a question about the leaflet you
received through your letterbox, you can call our Patient Information line on 0300 456
3531.
11. How long have I got to decide if I want to object?
You can decide to object at any time. If you would like to object before any information
is extracted from your GP practice then we recommend you do so within four weeks of
receiving the leaflet through your letterbox. The first extraction of information is
planned for spring 2014. You can change your mind at any time (please see FAQ 12),
12. Can I change my mind?
Yes. You can change your mind at any time and as many times as you wish. If you
object but then change your mind then you will need to speak to your GP practice to
ensure your preferences are kept up-to-date. Likewise, if you do not object now but
your later decide you wish to object, then just speak to your GP practice and ask them
to record your wishes in your health record.
13. What should I do if I have concerns?
We have produced a leaflet called “Better information means better care”, which
provides information about how your information is stored and used. There is also
information on the Health and Social Care Information Centre website about how we
look after confidential information www.hscic.gov.uk/patientconf
If you still have questions or concerns, you can call the patient information line on
0300
456 3531 or talk to staff at your GP practice. If you want to object you should speak to
your GP Practice (please see FAQ 8)
14. I have opted out of the Summary Care Record (SCR). Do I still need to talk to
my GP practice if I have any concerns?
Yes, you should still talk to your GP practice. There are important differences between
allowing the NHS to use your information for planning and research and the Summary
Care Record (SCR).
The SCR may be used by authorised health professionals to support your care. It
would be wrong for us to assume that just because you have chosen not to have an
SCR that this automatically means you also wish to stop the use of your information
being used to improve health and care services. So you still need to let your GP
practice know if you have concerns about sharing your information for improvements to
services, planning and research.
15. Will information about me be safe and secure?
Yes. The Health and Social Care Information Centre maintains the highest levels of
confidentiality both within the organisation itself and in the systems and services that
we provide for the wider health and care system, in order to protect all information. We
are continually testing, reviewing, and improving our security systems.
16. Can I stop information that does not identify me being used?
No. Information that does not identify you is neither personal nor private and the law
says that it can therefore be used much more freely. Because this information does not
identify you and because it can be so helpful to the NHS, public health and social care,
it is important that we make the best possible use of it for the benefit of all.
17. Do I need to do anything if I am happy for my information to be used?
No. If you are happy for your information to be shared to help improve health services,
then you do not need to do anything. Your information will continue to be used for that
purpose and to benefit all patients.
18. I am a carer for someone who lacks capacity to decide whether to allow their
information to be shared. Can I decide on their behalf?
It depends. If you have
Lasting Power of Attorney for health and welfare then you can
object on behalf of the patient who lacks capacity. If you are a carer or relative who
does not hold a Lasting Power of Attorney then you can raise your specific concerns
with the patient’s GP. The GP will make a decision based on an assessment of the
patient’s best interests, taking your views into account.
19. I am a parent/guardian of a child. Can I make the decision on their behalf?
It depends. If you have parental responsibility and your child is not able to make an
informed decision for themselves, then you can make a decision about information
sharing on behalf of your child. If your child is able to understand and make an
informed decision, then the decision must be theirs.
20. Will you sell data?
No. While the Health and Social Care Information Centre charges a fee to cover our
costs, we do not make profits from providing data to other organisations, nor do we
subsidise any applicants to receive it.
21. What research will be carried out on information that identifies me?
Examples of approved projects are:
• a national study of people who have had a heart attack, and
• a study of the time that people had to wait for treatment for cancer and the effect
of these waiting times on survival.
• Details of approved studies can be found at http://www.hra.nhs.uk/about-the-
hra/our-committees/section-251/cag-advice-and-approval-decisions/
22. When does the HSCIC allow researchers to access confidential information
about me?
In most cases, researchers can carry out their studies using information that does not
identify you. Occasionally, however, medical researchers need to use information that
does identify you.
Only researchers who have obtained your permission or who have been granted legal
approval are allowed to access confidential information that identifies individuals. Only
the Secretary of State for Health or the Health Research Authority (HRA) can grant this
legal approval and they do so following independent advice from the
Confidentiality
Advisory Group (CAG).
CAG considers each application in great detail against the legal framework, and
recommends whether approval should be provided together with any conditions.
Applicants must demonstrate (i) that the research is in the public interest and for the
benefit of the health service; (ii) that it is not possible to use information that does not
identify you; and (iii) it is not possible to ask your permission. There are a variety of
reasons why it might not be possible to ask people; for example, where there are
extremely large numbers of patients. Access to the information is restricted to the
specific information necessary for the research. All approvals must demonstrate
compliance to with the Data Protection Act 1998.
23. Will information that identifies me be used by commercial organisations? Please see FAQ 7 about the different ways in which the HSCIC shares information.
Any organisation can make an application to the HSCIC for identifiable or potentially-
identifiable information and each application is considered individually.
An organisation making an application would only be allowed confidential information
that identifies individuals if they have:
1. already obtained your permission (i.e. patient consent); or
2. have been granted legal approval by the Secretary of State for Health or the
Health Research Authority (HRA) following independent advice from the
Confidentiality Advisory Group (CAG) (please see FAQ 22); or
3. where we are legally required to provide it for a public health emergency such
as an epidemic.
So that we can ensure that confidential information about you remains protected, the
organisation making an application must sign a data sharing contract and a data
sharing agreement with the Health and Social Care Information Centre. This contract
sets out the terms of how the information is shared, what it can and cannot be used for
(its purpose), security requirements on how it is stored, and restrictions on onward
sharing or publication.
For case studies and examples of how customers have used information from the
Health and Social Care information Centre, please see http://www.hscic.gov.uk/dlescst
For clinical trials, pharmaceutical companies may work with your GP practice who will
contact you first to ask if you are willing for a researcher to contact you about a
particular trial for which you may be eligible. You will not be contacted by a
pharmaceutical company or any other third party unless you have specifically agreed.
The Health and Social Care Information Centre will not share information about you
with insurance companies or solicitors. If an insurance company or solicitor wanted
information about you, they would need to approach your GP practice directly and you
would need to give your explicit consent before any of your information could be
shared with them. If you do not agree to their specific request for your information then
it will not be shared with them.
Data will not be shared or used for marketing purposes
24. Can I have a greater number of choices and allow information to be used for
some but not other research projects? No. Currently, you have the right to say yes or no to your information leaving your GP
practice or being shared by the Health and Social Care Information Centre. Our
systems do not let you say yes or no to your information being used for specific
projects. However, if a researcher is working directly with your GP practice for their
study then, unless they have approval (please see FAQ 22), your GP will check with
you first to see if you are happy for your information to be shared as part of the study.