NHS HDL(2001)1
01_files/SEHD%20transparent.gif){kind=spacer}
|
NHS HDL(2001)1
|
|
Health Department |
|
|
|
|
Summary 1. This HDL updates guidance on the transmission and use of personal health information, encourages the resumption of data flows which have ceased since the enactment of the Data Protection Act 1998, outlines a series of actions which are necessary to take to meet the terms of the Act, and announces the formation of the Confidentiality and Security Advisory Group for Scotland. Background 2. In order to ensure the proper transmission and use of personal health information for reasons other than direct patient care, a system of Caldicott Guardians has been in place in the NHSScotland since April 1999. This system has been instrumental in developing better systems which manage personal health information within the Service. The Data Protection Act 1998, in force since March 2000, places additional responsibilities on clinical, support staff and management to obtain and process health data fairly, with the knowledge and agreement of patients. These new measures, together with renewed professional guidance, such as the GMC booklet on "Confidentiality: Protecting and Providing Information" have resulted in the recent discontinuation of several important collections of health information in Scotland. Revised interim GMC guidance has sanctioned resumption of cancer registries specifically, on an interim basis until October 2001 (Annex A). |
Addressees For
information
|
3. Several matters relating to the collation and transmission of personal health information, and its use in survey work, have been raised with the Scottish Executive. Healthcare professionals need to use their judgement in each case; if they need further guidance they should discuss with their Caldicott Guardian. Interim guidance on the transfer of data is attached to this letter (Annex B). 4. Meanwhile the Scottish Executive has established the Confidentiality and Security Advisory Group for Scotland whose remit is:- "To provide advice on the confidentiality and security of personal health related information to the Scottish Executive, the Public and to Health Care professionals." 5. CSAGS will in due course, subject to consultation, issue policy advice and a series of guidance notes intended to codify practice in the proper use of personal health information for reasons other than direct patient care. Further details of CSAGS' remit and membership are available at Annex C and its website at http://www.show.scot.nhs.uk/csags.
6. Clinicians and managers should maintain the transmission of data to central points including the Information and Statistics Division (ISD) using best current practice in ensuring confidentiality and security. 7. Caldicott Guardians should maintain and develop programmes which ensure the highest standards of confidentiality when obtaining and processing personal health information. The Scottish Executive, in association with CSAGS and the IM&T Programme Board, is embarking on a programme of policy revision and guidance. Early tasks will include the issue of further guidance on Disease Registries, surveys and audit. NHSScotland Managers, in collaboration with clinical staff will be required to revise and update general and specific written materials which inform patients about the use of their personal health information in the light of the new guidance in annex B. 8. In association with their Caldicott Guardian, Chief Executives, managers and clinicians should also make an assessment of the impact that more patient choice in this area will have on their work. Issues that arise during this process should be reported to the Caldicott Guardian for consideration and possible onwards transmission to ISD or SEHD. 9. This HDL is available on the Scottish Health on the Web (SHOW) web site: http://www.show.scot.nhs.uk/.
ANNEX A
1. The Scottish Executive is firmly committed to reducing the number of cancer deaths in Scotland. In its Cancer Registry, Scotland has long held one of the best systems of epidemiological research in the world which has contributed to important advances in the aetiology, risk factors, treatment and prognosis of different types of cancer. Recent practice has been that information about newly-diagnosed cancers would be passed to the registry, often without the knowledge or consent of the patient, in a patient-identifiable form. This is to ensure that the registry can track patients and the developments or cures of their cancers, and link in to SMRs and death certificates. The eventual aim of the cancer registry is to monitor trends of cancer incidence and survival, and to support advances in cancer care. 2. In September 2000 the General Medical Council (GMC) published its document 'Confidentiality: Protecting and Providing Information'. In paragraph 27 the document stated that 'the automatic transfer of personal information to a registry ... before informing the patient that information will be passed on, is unacceptable save in the most exceptional circumstances'. This has the effect of requiring explicit consent before information is passed to any registry. 2. On 8 November 2000 the GMC issued a further statement proposing a transition period until October 2001 to enable cancer registries to develop systems which will be able to cope with non-consent. This development has important consequences for the validity of the health information and disease registries, particularly relating to cancer, and affects the current and future care of patients. 3. During this transition period, clinicians involved in the treatment of cancer patients, and pathologists working in laboratories should therefore continue to submit information to the Scottish Cancer Registry in the usual way. Future design of information systems incorporating personal health information should make special provision for patients who decline to consent to some or all transfer of identifiable information. 4. However, as a matter of good clinical practice clinicians should, where appropriate, inform patients about the release of such information to the cancer registries, their role and the benefits of these registries. The date and outcome of this discussion should be briefly noted in a prominent position in the patient file. In circumstances where the clinician believes that discussion with the patient is not appropriate, such a decision, and the reasons for it, should also be recorded in the patient's file. ANNEX
B Protecting patient confidentiality 1. Recently there have been several cases where NHSScotland bodies have decided to cease to share personal health information in accordance with established procedures. In most cases the decision has been taken in response to the issue by the GMC of new guidelines on confidentiality which effectively prohibited the transfer of data to, for instance, disease registers unless the patient agrees. SEHD concurs with the GMC that as a rule, patients should have more of a say over the way their personal health information is used. Patients must be able to see that information about them is properly kept confidential. Without such steps, there is a danger that patients will lose faith in the ability of the Service to protect their personal health information. As a result some patients may choose to withhold details which are critical both to the treatment of the individuals themselves and to efforts to improve patient care as a whole. General advice on protecting confidentiality. 2. There is widespread acceptance that personal health information should only be shared on a need to know basis. For example, a clinician seeking the views of colleagues on the best treatment for an individual is already well aware that the identity of the patient should not be disclosed unless it is relevant to the evaluation of treatment options. The use of paper records has made the application of need-to-know principles into practice difficult in some situations. However, development of electronic records will, in time, make it much easier to ensure that only those clinicians responsible for treating an individual have access to patient identifiable information. 3. Although there is a high level of awareness of confidentiality issues in the NHSScotland, the specific requirements of the Data Protection Act 1998 and common laws of confidence are not clear. SEHD is actively seeking to improve this situation. Firm conclusions will be required and detailed guidance issued to the NHSScotland prior to the expiry of the main batch of transitional arrangements to the 1998 Act in October 2001. The main issue concerned is the extent to which it is necessary to disclose to a patient the uses to which their personal health information might be put. It is appreciated that whilst the NHSiS has historically had a high appreciation of the rules of confidence which affect it, new legal rules contained for example in the Data Protection Act and of the course the European Convention on Human Rights as well as developments of the common law on patient confidentiality may force significant changes of principle or practice on the profession. The implications of such legislation are wide ranging and its interpretation not without difficulty, and it is appreciated that the Service requires up to date guidance which covers all of these areas. It is for that reason that CSAGS has been created. It is our intention is that both the Department and CSAGS will issue that guidance in due course. 4. Even where the law may not require informed consent, however, the SEHD takes the view that clinicians should disclose to the patient the uses to which personal health information may be put. The objective should be to involve patients in decisions about the way information about them is used as a matter of course. The intention should be to ensure that patients are fully involved in discussions about the use of their information, rather than to implement a mechanistic system which requires patients to sign that they have consented to particular uses of their information. For many in the NHSScotland, this will represent a significant change in approach and SEHD recognises that this cannot be achieved overnight. SEHD therefore intends to work with the service to deal with the clinical, management, financial and other issues that will arise. In the meantime however, clinicians should make use of appropriate opportunities to disclose to patients details of how their information is used. Where practical and where this does not contravene the public interest, patients should be given the opportunity to withhold their information. SMR data 5. Information and Statistics Division has collected patient-identifiable data on patients having contact with the NHSScotland for many years in the Scottish Morbidity Record (SMR) series of datasets. Amongst others, these include information on out-patients, discharges from hospital, maternity and cardiac surgery. 6. These datasets are important sources of information for epidemiology, planning, audit and research and it is imperative that the continuity and completeness of the datasets is not lost. The data contained in them has been extracted from patient records and is normally provided to ISD by Trusts. 7. In the meantime we should continue to supply patient-identifiable data to ISD for the SMR series. The SEHD supports the continuation of long-established practices which have been formulated and controlled under tight protocols by the profession, until new guidance is issued. However, it is good practice that clinicians should discuss with patients the uses of their information and this should include the transmission of data to ISD. ANNEX
C CONFIDENTIALITY
AND SECURITY ADVISORY GROUP FOR Aim To provide advice
on the confidentiality and security of health related information Tasks
The purpose of CSAGS is to act as a focus for the confidentiality and security debate in Scotland. Its main task in the immediate future is to develop a small number of principles to underpin the use of personal health information by the NHSScotland and related bodies. CSAGS will be circulating a draft around the Service in the near future and will be seeking comments. When complete, the principles will be supported by detailed guidance. The principles will also help to inform other processes being co-ordinated by CSAGS such as the development of a model protocol on sharing personal health information between the NHSScotland and other agencies. The principles will be incorporated into a revised Code of Practice on the Confidentiality of Personal Health Information.
The group is chaired by Mrs Angela Macpherson from Ross-shire, who is also a lay member of the GMC, and has 19 members from a variety of professions and interest groups as follows:
Currently, there are four sub-groups supporting the work of CSAGS. They cover the following issues:
For more information on CSAGS, visit its website at http://www.show.scot.nhs.uk/csags or contact Gregor Lindsay, CSAGS Secretary on 0131 244 2351 (e-mail: gregor.lindsay@scotland.gsi.gov.uk). ANNEX D Further information can be obtained from:
ANNEX E Copied
to: |