Conclusions and recommendations
NHS Digital’s approach to data-sharing for immigration tracing
1.The principle remains in place that data held for the purposes of health and care should only be shared for law enforcement purposes in the case of serious crime. It is not only the GMC and NHS Codes which reflect this principle, but even NHS Digital’s own guidance on confidentiality. It is entirely inappropriate that NHS Digital should be sharing data in a manner inconsistent with that principle. (Paragraph 32)
2.The leadership of NHS Digital has not been sufficiently robust in upholding the interests of patients or in maintaining the necessary degree of independence from Government. It is deeply concerning that so little regard was paid by either the Chair or the Chief Executive to the underlying ethical implications that arise from the MoU. At a time when the benefits of data sharing for research is such a key issue, it is absolutely crucial that the public have confidence that those at the top of NHS Digital have both an understanding of the ethical underpinning of confidentiality and the determination to act in the best interests of patients. (Paragraph 37)
3.We support the sharing of data for the benefit of patients, with their consent. As demonstrated by the care.data experience, the success of such data-sharing depends crucially on public consent and confidence in NHS Digital’s commitment to respecting confidentiality. Its actions in this case risk undermining that confidence. (Paragraph 44)
The memorandum of understanding and the public interest test
4.We repeat the conclusion of our 29 January letter that NHS Digital should suspend its participation in the memorandum of understanding. In order to ensure that there is no continued conflict between the standards of confidentiality applied in different parts of the health system, consideration of the public interest test, and of whether the arrangements set out in the memorandum of understanding should be resumed, should not be undertaken until NHS England’s review of the NHS Code of Confidentiality is complete. The decision about the application of the public interest test should be undertaken in the light of the reviewed Code, after proper consultation with all interested parties on the specific practice of data-sharing for the purposes of immigration tracing, and with the full involvement of experts in medical ethics. (Paragraph 45)
Risks to public health
5.In our letter of 29 January, we noted that the advice from the Government’s statutory advisers on public health, Public Health England (PHE), was very clear: “the perceived or actual sharing of identifiable information from confidential health records in order to trace individuals in relation to possible immigration offences [ … ] could present a serious risk to public health and has the potential to adversely impact on the discharge by PHE of the Secretary of State’s statutory health protection duty”. We remain of that view, and consider that the evidence presented by PHE should have been taken more seriously when the public interest test was conducted. (Paragraph 46)
6.We recommend that when it reports at the conclusion of its review of the evidence of the impact of the MoU on health-seeking behaviours, Public Health England (PHE) restate its conclusion on the basis of the evidence already available, and then report on whether its further research has collected any evidence which would be sufficient to change the view it had already reached. The reassessment of the public interest test carried out once the review of the NHS Code of Confidentiality is complete should take into account—and give proper weight to—all the evidence PHE presents. (Paragraph 48)
Government policy on sharing of data held for the purpose of health and care
7.The review of the NHS Code of Confidentiality should also consider and consult upon the statement of Government policy on data-sharing which was contained in the Ministers’ response to our letter of 29 January, and advise Ministers on whether it is an appropriate statement of policy on the sharing of data collected and held for the purpose of health and care. (Paragraph 49)
8.We are deeply concerned that accepting the Government’s stated position would lead to sharing non-clinical data such as addresses with other Government departments. We believe that patients’ addresses, collected for the purposes of health and social care, should continue to be regarded as confidential. (Paragraph 42)
Published: 15 April 2018