Evidence submitted by the Academy of Medical
Sciences (EPR 34)
The Independent Academy of Medical Sciences
promotes advances in medical science and campaigns to ensure these
are translated as quickly as ossible into benefits for society.
The Academy's 800 Fellows are the United Kingdom's leading medical
scientists from hospitals, academia, industry and the public service.
1. The Academy of Medical Sciences welcomes
the opportunity to respond to the House of Commons Health Committee
Inquiry into the Electronic Patient Record and its use. The Academy's
core objectives are to promote advances in medical science and
ensure that these are converted as quickly as possible into healthcare
benefits for society. Our focus is therefore on the research aspects
of the Committee's Inquiry and our submission will concentrate
on the fourth area of the terms of reference: "How data
held on the new systems can and should be used for purposes other
than the delivery of care, eg clinical research".
2. The use of patient health records in
research was the subject of a recent major study by the Academy,
chaired by Professor Robert Souhami CBE FMedSci and involving
a working group of senior researchers and clinicians. The
study culminated in the publication of a report, Personal data
for public good: using health information in medical research,
which is enclosed with this submission. Publication
was followed in June 2006 by a symposium involving senior members
of the legal profession, including barristers, solicitors, academics
and members of the judiciary, the report of which is also enclosed.
3. Personal data for public good
describes in detail how information contained in patient records
provides much of the evidence on which improvements in healthcare
are based. This kind of "secondary research" has identified
important causes of disease, led to effective measures for control
of epidemics, demonstrated the long-term effects of treatment,
and shown how the health of the population can be improved by
better services. The late Sir Richard Doll OBE FRS FMedSci put
it thus: "Much of the research on the effects of ionising
radiation and the use of oral contraceptives, leave alone smoking,
would have been impossible without the facility of obtaining unbiased
access to medical records".
4. The UK already has an outstanding record
in population-based research and epidemiology. The development
of the National Programme for IT (NPfIT) and the Electronic Patient
Record offer unparalleled opportunities for research that could
have a real and significant impact on future health in the UK.
In 2005, the Chancellor of the Exchequer, Gordon Brown, and the
Health Secretary, Patricia Hewitt, stated a new commitment to
develop the capability within NPfIT to facilitate "the
gathering of data to support groundbreaking work on the health
of the population and the effectiveness of health interventions".
This was reflected in Sir David Cooksey's Review of UK Health
Research, which identified an essential need "to ensure
that research is fully embedded in and integral to the NHS IT
programme, and prioritised on a par with other service uses for
the system." 
5. However, the Academy is concerned that
a number of factors, including confusing legislation and professional
guidance, bureaucracy of process and an undue emphasis of privacy
and autonomy, are having a detrimental effect on UK research activity
in this area. The report Personal data for public good
describes how disproportionate constraints on the use of health
information can compromise the quality and validity of research
results, leading to potentially misleading claims, or even costing
lives. The UK must avoid mistakes made elsewhere, for instance
the decision by the Hyogo prefecture in Japan to halt cancer registration
on the basis of privacy concerns, which led to delays in the detection
of a significant cluster of asbestos-related mesothelioma cases.
6. There is no doubt that information held
in electronic health records can be extremely sensitive; inappropriate
use or disclosure of such information has the potential to cause
embarrassment or distress. Experience or fear of inappropriate
disclosure might induce patients to withhold information from
a health professional or even avoid treatment altogether. We also
note that the introduction of more pervasive CCTV, aggressive
use of data for commercial marketing purposes and the national
debate over identify cards have all influenced the climate in
which issues related to research using health information are
7. Policies that emphasise choice within
healthcare focus on the value of individual autonomy. But this
emphasis presents challenges for activities such as medical research,
which are performed for public, rather than individual, benefit.
It could be maintained that a patient has the right to say "use
my data to treat me, but not to improve care for others".
Or more starkly, "use evidence from other people's data to
treat me, but don't use my data to help them."
8. In the following sections, we outline
some of the considerations around consent, confidentiality and
anonymisation that should be taken into account during the development
of systems supporting the Electronic Patient Record. We also share
our hopes and concerns for the Secondary Uses Service and Care
Record Development Board, before discussing ways forward and the
need for public engagement.
9. Consent is quite rightly the cornerstone
of all interventional research involving human subjects, including
clinical trials and invasive investigations. However, the nature
of records-based research can make obtaining consent unfeasible
or impracticable. For instance, the hypothesis that adverse conditions
in pregnancy might increase the likelihood of cardiovascular disease
in later life was developed and tested by Professor Barker using
over 15,000 birth records collected in Hertfordshire from 1911
of the patients had died and the population had dispersed, making
obtaining consent impractical is most cases and impossible in
some. The results of Professor Barker's research have linked low
birth weight with risk of hypertension, type II diabetes and other
disorders in adult life.
10. Seeking consent can also bias a dataset,
leading to misleading results. For example, until 2001 there was
a great deal of controversy over whether termination of pregnancy
increased the risk of breast cancer. A potential bias was that
women who had developed breast cancer might be more likely to
disclose information about termination than women without cancer.
It was only when a data linkage study was done on records accessed
without consent that the absence of risk was demonstrated conclusively.
11. All patient records must be handled
in a manner that reflects obligations and expectations of confidentiality,
Effective procedures are in place
to prevent the unintentional disclosure of sensitive data.
Data are only used for authorised
Those handling data understand and
respect patients' interests.
12. Many guidance documents now emphasise
anonymisation of data (ie stripping the data of any identifiers)
as the preferred approach for records-based research. However,
we emphasise that anonymising data is only one component in protecting
confidentiality and can sometimes compromise the integrity of
13. There may be several reasons why constructing
a research dataset would require access to identifiable information:
To assess/avoid double counting.
For example, congenital anomaly registers were set up in response
to the thalidomide tragedy and are essential in identifying teratogenic
exposure in pregnancy. Many of the anomalies only come to light
later in life so data must be collected from paediatricians, midwives,
genetic counselling services and many other sources. In many instances,
notification of the same individual will be received from several
sources and matching reliable personal information is the only
way to identify duplicates and avoid double counting. 
For longitudinal research.
Without long-term research based on large, complete datasets the
risks of occupational, environmental or social factors would not
be known with certainty. This is exemplified by studies on the
health of coal miners, fluoridation
and social distribution of cancer. Understanding
how exposure to a risk factor influences later health requires
that information on an individual be updated over time. This is
impossible if data are irreversibly anonymised.
For validation. The quality
of the data contained in health records can vary significantly,
and the ability to test the validity of a sample of records is
essential. This is generally done by taking a random sample and
retrieving the original records to confirm that data subject x
really is data subject x. This can only be achieved using identifiers
to match the records.
Identifiers contain useful information.
Many of the identifiers that might be stripped from data during
anonymisation are useful to research. For
instance, postcode, date of birth, date of death and occupation
are all routinely used as important factors in analysing population
health data, but are stripped out when data are anonymised.
14. This final point illustrates that "anonymised"
and "identifiable" are not distinct categories of data.
There is no consensus guidance on the identifiers that should
be stripped from a dataset to render it anonymised, and, as illustrated
above, removing potential identifiers can leave the data unusable
for research purposes.
15. The Secondary Uses Service (SUS), which
is being delivered as part of NPfIT through NHS Connecting for
Health, is "a system designed to provide timely, pseudonymised,
patient-based data and information for management and clinical
purposes other than direct patient care". The plan is
for information from SUS to be available in pseudonimysed form
to researchers. It
will also provide results of standard and bespoke analyses, as
well as extract anonymised data sets on behalf of researchers
and other users.
16. One aim of SUS is to reduce the overall
burden on local NHS servces of data collection, abstraction and
submission by centralising and automating these processes. However,
the Academy seriously doubts whether SUS will be able to provide
the flexible access needed to allow existing research methods
to be applied to the new datasets. The plan relies on SUS undertaking
much of the work currently done by research groups, such as linkage,
validation and additional data collection from patients. Although
this is theoretically possible, we doubt that it will be a high
priority among the other calls on the resources of SUS, not least
the implementation of "Payment by Results". Researchers
have also expressed concern that the different IT systems being
developed in England and the devolved nations will not be sufficiently
compatible and integrated to allow UK-wide research.
17. Given these concerns, the Academy welcomes
the formation of the UK Clinical Research Collaboration (UKCRC)
R&D Advisory Group to Connecting for Health, which followed
an explicit recommendation in our 2006 report. The
Advisory Group, which is chaired by Professor Ian Diamond, is
tasked with "obtaining and presenting evidence to help
prioritise the research agenda in future development commissioning
of the NHS Care Records Service". The Group is now completing
a series of simulations designed to interrogate the NHS Care Records
Service (including the Secondary Uses Service) for its suitability
to support research. These simulations cover research applications
in observational epidemiology, clinical trials, surveillance and
prospective tracking of a cohort (longitudinal research). We look
forward with interest to the publication of the results of these
simulations in March, which we hope will address concerns around
data quality (completeness, validity and reliability), removal
of identifiers and data linkage, as well as issues of information
governance. We urge careful examination of the Research Simulation
Report by the Health Committee and on the part of all those involved.
18. We are also aware of a forthcoming report
from the Care Record Development Board Working Group on the Secondary
Uses of Patient Information. The date of publication is to be
confirmed, but might be in April 2007. This is likely to make
a number of recommendations on governance issues arround researchers'
access to information in the Secondary Uses System, which we hope
will take into consideration issues of consent and anonymisation
raised in the Academy's 2006 report and summarised above.
19. The Academy has previously expressed
significant concerns about the Care Record Guarantee, which has
been drawn up and published by the Care Record Development Board
Guarantee sets out for the public the rules that will govern information
held in the NHS Care Records Service (CRS) and will be the basis
for an information campaign intended to reassure the public about
the confidentiality of the system.
20. We are concerned that the current version
of the Guarantee seems to be based on the assumption that all
work with identifiable data will be accomplished within SUS and
that research and public health users will be only supplied with
anonymised output from SUS. It includes statements that seem to
preclude any use of CRS data outside the NHS for research purposes.
We welcome the mention in the document that data might be used
to "help with research". However, we are
concerned about the explicit pledge that the new IT system will
"allow only those involved in your care to have access
to records about you from which you can be identified".
A public statement of this kind invalidates the legal basis on
which public health professionals and clinical researchers currently
access identifiable data for research and is therefore of grave
21. We have previously recommended that
the current wording of the Guarantee should be revised to make
a clear distinction between bone fide researchers acting
in the public interest and "third parties" who should
not be permitted access to records (eg employers, insurers, the
press and other members of the public). We strongly urge the promotion
of the benefits of research during the Care Record Guarantee public
22. The public, patients and researchers
have a common interest in ensuring that research involving patient
records is conducted efficiently and to the highest standards.
NPfIT and the Electronic Patient Record offer an exceptional opportunity
to allow research to inform all aspects of healthcare. However,
the Academy is concerned that research needs are not being integrated
into the development of these programmes.
23. The basis for accessing and using the
Electronic Patient Record for research depends upon public expectations
of what is involved. The public is largely unaware of the regulation
that underpins research of this kind, including the role of ethics
committees, NHS data controllers and Caldicott Guardians, as well
as the Patient Information Advisory Group. Evidence of public
attitudes towards the use of health information in research is
largely absent, forcing regulatory bodies to make assumptions
about what the public might find acceptable. There are two large
studiesby Shickle et al
and Barrett et alwhich
are noteworthy because of the rigorousness of the methodology
and the focus of the questions. We also warmly welcome recent
studies undertaken by the Wellcome Trust and Medical Research
Research Council to investigate public perspectives in this area.
We look forward to the publication of the outcomes of this work
24. Urgent work is needed to increase public
engagement about the value of research using healthcare records
and the arrangements under which records are held and accessed.
The introduction of NPfIT, the Electronic Patient Record and the
Care Record Guarantee will provide valuable opportunities for
such engagement. The research mission of the NHS is seldom mentioned
in literature given to patientsin striking contrast to
its role in teaching nurses, medical students and other staff.
In the development of the Electronic Patient Record, the Department
of Health understandably does not want the primacy of confidentiality
to be undermined in gaining public acceptance. However, in our
discussions with patient representatives there was strong support
for research using health data. There was great concern that a
vocal minority, loudly proclaiming the right of privacy, might
override the unexpressed desire of many people to contribute to
the public good. The Academy recommends that a long-term programme
of public engagement concerning research uses should be established.
We consider that the benefit for health will strengthen the perceived
value of the Electronic Patient Record in the opinion of the public.
The Academy of Medical Sciences
16 March 2007
1 For further details see http://www.acmedsci.ac.uk/p48prid5.html Back
Further copies can be downloaded from http://www.acmedsci.ac.uk/images/project/Personal.pdf Back
Further copies can be downloaded from http://www.acmedsci.ac.uk/images/project/1170326729.pdf Back
Sir David Cooksey (2006) A review of UK health research funding.
The Stationery Office, London http://www.acmedsci.ac.uk/images/project/1170326729.pdf Back
Detmer D (2000) Your privacy or your health-will medical privacy
legislation stop quality health care? International Journal
for Quality in Healthcare 12, 1-3. Back
Barker D (2003) The midwife, the coincidence and the hypothesis.
British Medical Journal, 327, 1428-9. Back
Goldacre M J, Kurina L M, Seagroatt V & Yeates D (2001) Abortion
and breast cancer: a case[en rule]control records linkage study.
Journal of Epidemiology and Community Health, 55, 336-7. Back
Richards I D, Bentley H B & Glenny A M (1999) A local
congenital anomalies register: monitoring preventive interventions.
Journal of Public Health Medicine, 21, 37-40. Back
Fox A J, Goldblatt P & Kinlen I J (1981) A study of mortality
of Cornish tin miners. British Journal of Industrial Medicine,
38, 378-80. Back
Kinlen L & Doll R (1981) Fluoridation of water supplies
and cancer mortality.III: A re-examination of mortality in cities
in the USA. Journal of Epidemiology and Community Health,
35, 239-44. Back
Kinlen L J (1988) The longitudinal study and the social distribution
of cancer. British Medical Journal, 297, 1070. Back
Ohno-Machado L, Silveira P S & Vinterbo S (2004) Protecting
patient privacy by quantifiable control of disclosures in disseminated
databases. International Journal of Medical Information, 73,
In this context pseudonymised data cannot be used by the holder
of the data to indentify an individual. However, the original
provider of the data (in this case SUS) retains a means of identifying
individuals. This will often be achieved by attached codes or
other unique references to information so that the data should
only be identifiable to those with access to the code or key. Back
See http://www.ukcrc.org/activities/infrastructureinthenhs/nhsitprogrammes/advisorygroup.aspx Back
See http://www.connectingforhealth.nhs.uk/crdb/docs/nhscrgenglish.pdf Back
School of Health and Related Research (2002) Patient Electronic
Record: Information and Consent (PERIC) Public attitudes to protection
and use of personal health information. School of Health and
Related Research, University of Sheffield. Back
Barrett G et al (2006) National survey of British Public's
views on use of identifiable medical data by the National Cancer
Registry. BMJ, 332: 1068-72 Back