Confidentiality guidance: Research and other secondary uses

1. 40. Research, epidemiology, public health surveillance, health service planning and education and training are among the important secondary uses made of patient information. Each of these uses can serve important public interests.¹⁴
2. 41. For many secondary uses, it will be sufficient and practicable to disclose only anonymised or coded information. When identifiable information is needed, or it is not practicable to remove identifiable information, it will often be perfectly practicable to get patients’ express consent.
3. 42. You may disclose identifiable information without consent if it is required by law, if it is approved under section 251 of the NHS Act 2006,¹⁵ or if it can be justified in the public interest and it is either:
   1. (a) necessary to use identifiable information, or
   2. (b) not practicable to anonymise or code the information
4. and, in either case, not practicable¹⁶ to seek consent (or efforts to seek consent have been unsuccessful).¹⁷
5. 43. In considering whether it is practicable to seek consent you should take account of:
   1. (a) the age of records and the likely traceability of patients
   2. (b) the number of records, and
   3. (c) the possibility of introducing bias because of a low response rate or because particular groups of patients refuse, or do not respond to, requests to use their information.
6. 44. When considering whether the public interest in disclosures for secondary uses outweighs patients’ and the public interest in keeping the information confidential, you must consider:
   1. (a) the nature of the information to be disclosed
   2. (b) what use will be made of the information
   3. (c) how many people will have access to the information
   4. (d) the confidentiality and security arrangements in place to protect the information from further disclosure
   5. (e) the advice of a Caldicott Guardian or similar expert adviser, who is not directly connected with the use for which disclosure is being
      considered, and
   6. (f) the potential for distress or harm to patients.
7. 45. When considering applications for support under section 251 of the NHS Act 2006 in England and Wales, the National Information Governance Board considers:
   1. (a) the feasibility of doing the research or other activity with patients’ consent or by using anonymised or coded information, and
   2. (b) whether the use of identifiable information would benefit patients or the public sufficiently to outweigh patients’ right to privacy.¹⁸
8. 46. The Privacy Advisory Committee in Northern Ireland can advise on some of the same considerations; but it has no statutory powers and so cannot give lawful authority to disclosures of identifiable information without consent. In the event of a complaint or challenge, its advice on best practice might play an important part in any assessment of the propriety of a disclosure.
9. 47. The Privacy Advisory Committee in Scotland performs a different role, and doctors there should seek the advice of Caldicott Guardians, defence organisations or professional bodies if they are unsure about whether disclosures of identifiable information for secondary uses can be justified in the public interest.
10. 48. It might not be practicable for the healthcare team, or those who usually support them, to anonymise or code information or to seek patients’
    express consent:
    1. (a) for the disclosure of identifiable information for important secondary uses, or
    2. (b) so that suitable patients can be recruited to clinical trials or other approved research projects.
11. 49. If that is the case:
    1. (a) identifiable information may be sent to a ‘safe haven’, where they exist and have the capabilities and are otherwise suitable to process the information (including anonymising or coding it) and to manage the disclosure of information for secondary uses or, if that is not
       practicable¹⁹
    2. (b) the task of anonymising or coding the information or seeking patients’ consent to disclosure can be delegated²⁰ to someone incorporated into the healthcare team on a temporary basis and bound by legal and contractual obligations of confidentiality.
12. 50. You should only disclose identifiable information for research if that research is approved by a Research Ethics Committee. You should alert
    Research Ethics Committees to disclosures of identifiable information without consent when applying for approval for research projects.²¹