Trust in the time of markets: protecting patient information.

www.thelancet.com Vol 383 May 3, 2014 1523 Trust in the protection of confi dential patient data in England seems to be at an all-time low given recent breaches in releases of patient data and the fi nding that hospital data have been sold to companies with insuffi cient oversight. This follows a Memorandum of Understanding signed in January, 2014, by the Secretary of State for Health for England and his US counterpart in which they agree to “priming their respective markets for innovative new Health IT products and services”. Concerns have centred on the decision in December, 2013, by NHS England to direct the Health and Social Care Information Centre to establish a system for uploading and linking primary care patient coded data with identifi ers. In February, 2014, after a campaign by the British Medical Association, the Royal College of General Practitioners, and the privacy campaign group medConfi dential, among others, a 6-month delay in the implementation of this aspect of NHS England’s programme for sharing patient data across the health and social care system, known as Care.data, was announced. In March, 2014, the UK Government proposed amendments to the Care Bill in a bid to allay these concerns. The Care Bill is due to come before the House of Lords on May 7. Until 2012, two main exceptional uses of confi dential patient data were allowed: production of aggregated offi cial statistics under the auspices of the UK Statistics Board and, since 2002, use for defi ned medical purposes, commonly known as “section 251 approvals”. Between 2009 and 2013, the latter use was overseen by the now defunct National Information Governance Board and currently falls under the remit of the Health Research Authority’s non-statutory Confi dential Advisory Group. Section 251 approvals allow use of patient data in relation to neoplasia, communicable diseases, and other public health risks, and in other specifi ed circumstances by health professionals or equivalents. Use of the information to determine individual treatment is not permitted. Between these two exceptions is the Health and Social Care Information Centre, which was fi rst set up as a Special Health Authority in 2005. The functions of the Centre originally included the collection, analysis, use, and dissemination of information and issuing administrative identifi cation numbers, as directed by the Secretary of State for Health. The Centre obtained information through section 251 approvals and, from 2008, produced offi cial statistics. The sharing of information, such as Hospital Episode Statistics, held by the Centre with private companies is currently under review. The 2012 Health and Social Care Act led to farreaching changes to the health information system of the National Health Service (NHS), not least because commercial contracts are now at the heart of NHS commissioning. Under Part 9 of the 2012 Act, the original Centre was abolished, re-established as a corporate body, and is now generally referred to as “the HSCIC”. It is subject to the Government’s and NHS England’s directions, and is supposed to be a safe haven where confi dential data are collected and deidentifi ed before onward disclosure. However, Dame Fiona Caldicott’s review of information governance in March, 2013, considered that “it is unlikely that the Information Centre will have the capacity to de-identify information that local commissioners want to extract from local providers”. This lack of capacity to de-identify patient data would be a cause for concern because Part 9 of the 2012 Act is already in force and entitles private companies to request the HSCIC to establish a system for the collection and analysis of patient information for their activities. The HSCIC must publish information obtained by using these powers, subject to exceptions. Requests by a company can be made without reference to “medical Trust in the time of markets: protecting patient information