Health and Care Bill

Lord Lexden Excerpts

Lords Hansard - Part 1 & Committee stage
Wednesday 26th January 2022 Lords Chamber

[Lord Hunt of Kings Heath (Lab)]

My Lords, my amendment concerns patient data. I want to probe the meaning of new Clause 14Z61, proposed by Clause 20(2), which relates to the permitted disclosure of information by integrated care boards. It sets out, on page 27 of the Bill, a number of conditions under which disclosure can be made. They include when

“the information has previously been … disclosed to the public”

or

“the disclosure is made in accordance with any enactment or court order”.

That seems perfectly sensible. However, proposed new subsection (1)(f) contains a catch-all condition under which a disclosure can also be

“made for the purpose of facilitating the exercise of any of the integrated care board’s functions”.

That seems remarkably open-ended. My amendment seeks an assurance that this power excludes the personal data of patients.

We have already had one go at the issue of data and digital transformation, and I have told the House that I am right behind the efforts of the NHS and the Minister’s department to encourage the digital transformation of the NHS. The potential is clearly enormous. However, public confidence depends on the integrity of the system and having embedded in it a guarantee that every use of data will be consensual, safe and transparent.

The recent Laura Wade-Gery review, on which a number of noble Lords have commented, acknowledged some of those concerns. As she said:

“The field of data science is undergoing a revolution as new tools such as machine learning transform our ability to gain insights and improve outcomes. These advances, combined with the explosion of new data driven commercial business models, have caused citizens to be concerned about the privacy of their individual health data and the controls in place over its dissemination and use.”


There may be situations where a patient does not want a doctor—by the way, just for the Chief Whip’s reassurance, I have not spoken for 37 minutes as the clock says—to tell another doctor something about them, yet this can be ignored by those who want to copy records across a lifetime. Modern communications have created the capacity to copy medical records on a scale that can shatter medical confidentiality.

The experience of Care.data is surely a lesson for us. The decision to axe the scheme followed the publication of two reports that supported far greater transparency over what happens to the information, and opt-outs for patients who want their data seen only by those directly caring for them. A review by the late Dame Fiona Caldicott, and a second by the Care Quality Commission, recommended tougher measures to keep people’s medical information confidential. The Caldicott review said that there needs to be much more extensive dialogue with the public as to how their information can be used. As she said:

“Citizens have a right to know how their data is safeguarded. They should be included in conversations about the potential benefits that responsible use of their information can bring. They must be offered a clear choice about whether they want to allow their information to be part of this.”


This was brought home to me recently by NHS England’s announcement that it is to give trusts, as employers, access to the Covid and flu NHS vaccination records of their staff. I am fully behind the vaccination drive and sympathetic to the Government’s mandating of vaccines, but the announcement said:

“To assist Trusts with understanding the vaccination status of their workforce, we are providing a solution for Trusts to view the vaccination status of staff who are on the Electronic Staff Record … system. To do this, we are undertaking an exercise on Trusts’ behalf, to match ESR data, using NHS numbers, with vaccination data held in the National Immunisations Management System … which includes data drawn from all point of care vaccination systems. Following a successful import of ESR data into NIMS, a dashboard will be provided to each Trust detailing their workforce Covid and Flu vaccination uptake, drilled down to employee-level.”


Let me be clear: I support the vaccination drive, as I said, but am I the only one to worry about the access to confidential data that is being given? I recognise that we are talking here about electronic staff records as opposed to electronic patient records, but the principle of releasing patient data is the same.

I would like to hear some assurance from the Minister about the use of this clause and the open-ended nature of new Section 14Z61(1)(f), because, as I think we will shortly hear from the noble Baroness, Lady Brinton, such an open-ended disclosure provision in other legislation would be looked at with very great concern. Having said that, and having taken up 44 seconds, according to the Clock, I beg to move.

[The Deputy Chairman of Committees (Lord Lexden) (Con)]

My Lords, I have failed in my duty, and not for the first time. I should have stated before calling Amendment 145 that the noble Baronesses, Lady Brinton and Lady Harris of Richmond, will be taking part remotely. May I apologise, and invite the noble Baroness, Lady Brinton, to speak?

[Baroness Brinton (LD) [V]]

My Lords, this probing amendment from the noble Lord, Lord Hunt, is essential, because it protects confidential patient data from being given out by an ICB in contravention of the ethics rules of the General Medical Council and other regulatory bodies.

When the Police, Crime, Sentencing and Courts Bill arrived in your Lordships’ House in the autumn, it had clauses in it that gave the police, probation and prison services access to a patient’s confidential medical data as part of their role to reduce and prevent serious violence. As originally drafted, that Bill would have required GPs, CCGs and their staff to hand over that data. This was not just about those under suspicion; it could have been anybody involved in serious violence.

I had extreme concerns about this, and I tabled an amendment not dissimilar to Amendment 145. I was grateful for the support of the noble Lords, Lord Patel and Lord Ribeiro, the General Medical Council, the BMA and others in Committee on that Bill. We had meetings between Committee and Report with officials from the Department of Health and the Home Office, meaning that by the time we got to Report the Government had laid amendments to ensure that a patient’s personal data could not be demanded by the police, probation and prison services. It is now recognised that the medical regulators—the GMC, the Nursing and Midwifery Council and other bodies—actually have the responsibility and the excellent ethical standards by which their members are expected to judge what they should do if they are asked for personal data.

The amendment from the noble Lord, Lord Hunt, would address what data an ICB may disclose by adding a subsection to protect the Government in the same way as happened in the police Bill, so that the personal data of patients should not be disclosed. This is a vital amendment. The Government have already accepted in this Parliament that a patient’s personal data must not be accessible by those other than clinical and clerical staff dealing with it, who must abide by the confidentiality rules of their regulatory body or by their employment contract.

This is even more necessary, because the Bill says in new Section 14Z61(1)(g), on permitted disclosures of information, that

“the disclosure is made in connection with the investigation of a criminal offence”.

That is even broader than in the original police Bill. Patient confidentiality is a fundamental ethical duty. It is crucial to upholding the trust that lies at the heart of the doctor-patient relationship. The new section will give the ICB the right to override that.

New paragraph (e) is also more far-reaching than the investigation of any crime. It says that

“the disclosure is made to any person in circumstances where it is necessary or expedient for the person to have the information for the purpose of exercising functions of that person under any enactment”.

So it is not the doctor or the ICB that has the choice about disclosing that information; they must take the word of the person making that request. That is total free access for anyone who says that it is necessary or expedient for them to have that information. Where is the protection of a patient’s individual and confidential data?

It also removes the decision from GPs, despite GPs having very clear and effective guidance from the GMC on when, in exceptional circumstances, they can give out data. I will not quote the whole of the guidance, because we do not have time, but there are two vital points that a GP must consider: the patient must consent, whether implicitly or explicitly; and disclosure must be permitted or must have been approved under a statutory process that sets aside the common-law duty of confidentiality. The doctor also has a duty, even when they have made their decision, to use anonymised information if practicable, and they must be satisfied that the patient has ready access to information explaining how their personal information will be used. It goes on, but I will not quote the rest.

One might hope that Ministers assumed when drafting the clause that confidential patient data would never be included, other than for the treatment of the patient. However, paragraphs (e), (g), (h) and (f), as the noble Lord, Lord Hunt, outlined, put paid to that. If the argument is that the clause is needed because the ICB might have to share data with, for example, care providers or social workers carrying out assessments, that needs to be made clear, and it would be permissible. But, as drawn, it is far too brief.

The amendment from the noble Lord, Lord Hunt, at least protects the personal data of patients. It is very straightforward and provides the protection that every doctor, nurse and patient would expect. So I hope the Minister will say today that he is happy to accept the amendment. If he is not, please will he agree to a meeting with those who have spoken in this debate, and invite the GMC and the BMA? If progress is not made on this, I will lay an amendment on Report and am likely to press it to a Division.

[The Deputy Chairman of Committees (Lord Lexden) (Con)]

My Lords, the noble Baroness, Lady Harris of Richmond, is also taking part remotely and I invite her to speak.

[Baroness Harris of Richmond (LD) [V]]

My Lords, having spoken on just about every police Bill in this House for the past 23 years, I am afraid that I could not let this amendment pass without comment. I refer your Lordships to my policing interests in the register.

As my noble friend Lady Brinton has just said, the Police, Crime, Sentencing and Courts Bill, which has just gone through this House, had provisions that gave the police and other criminal justice bodies investigating possible serious violence, or plans to produce serious violence, the power to demand the confidential medical data of individuals. As drafted, unspecified police officers —that means any police officer, not just a senior ranking officer—could make requests to a GP’s surgery or a CCG, or their staff, to hand over the data.

What I found chilling was that the police would not be required to explain to the patient’s GP why they wanted the information, or whether the patient concerned was a potential criminal or possible victim—or even someone associated with the investigation, for example a possible witness or family member. After discussions with Peers, the General Medical Council, Ministers and the British Medical Association, the Government made their own amendments, making it clear that the police would not have this universal access to patient data. Instead, they would have to use the current, traditional method of approaching a patient’s GP directly and asking for the data, with the decision being made by the GP under the GMC code of ethics, as my noble friend Lady Brinton explained.

New Section 14Z61 gives the new integrated commissioning boards a duty to hand over personal medical data to a wide range of bodies that request them. However, I will focus on paragraphs (g) and (h), which are about police requests for data when they are undertaking criminal investigations. It is even more extraordinary that a health Bill is proposing to give the police even wider powers than in the recent police Bill. At least that Bill originally limited access to cases of serious violence. I will quote my noble friend from 25 October 2021, in debate on the Police, Crime, Sentencing and Courts Bill:

“It is quite extraordinary that this Bill proposes that any Home Secretary can, at will, demand that doctors and other healthcare professionals breach patient confidentiality, over and above their responsibilities of confidentiality to their patients and their commitments to their regulatory body.”—[Official Report, 25/10/21; col. 551.]