A Brief Note On The Apparent Divergences Between Europe's Data Protection Commissioners And The Government With Respect To The Electronic Patient Record (May 2007)

From Nhs It Info

Dr. C. N. M. Pounder

(Editor of Data Protection & Privacy Practice)

The Working Party of European Data Protection Commissioners has published a document on the privacy of medical data within an Electronic Health Records (EHR) system . The document states that unless there is a substantial public interest to the contrary, the patients' wishes concerning the processing of their own medical data via an EHR system should prevail. There are several important elements which, at this late stage, I draw to the attention of the Committee.

The Working Party has also concluded that centralized EHR system (i.e. on the UK model) "assumes there will be single controller for the whole system separate from the healthcare professionals/institutions" – in the UK's case, this data controller could be the Secretary of State for Health . The Working Party notes that in such a system "liability for the confidentiality of the system is taken out of the hands of medical professionals", and that this "might influence the amount of trust invested by patients into such a system".

The Working Party notes that risks associated with a lack of trust do not arise in a decentralized EHR system "where the health care professional/institution" is responsible for the medical file, or in patient-centric EHR systems (for example, the French EHR system) where patients exercise a significant degree of control over their own medical personal data.

I should add that when the Government offers an "opt-out" with respect to the EHR system, it is assuming that it is a data controller and not only the medical professional , as only the data controller has the obligation to offer the right to object to the processing found in section 10 of the Data Protection Act 1998.

The Working Party states that "all data contained in medical documentation in electronic health records" should be considered to be "sensitive personal data", even the "administrative data" associated with a medical record. The Party notes that if these administrative data "were not relevant in the context of treatment of a patient, they would and should not have been included in a medical file".

This does not appear to represent the position adopted in the UK, as it treats administrative personal data differently from those data which have a medical content. For example, the Statistics and Registration Service Bill before Parliament has excluded health personal data from the substantial degree of data sharing of administrative personal data (e.g. as contained in the Summary Care Record) on the grounds that these administrative data are devoid of medical content.

The Working Party states that if patient consent is used as a basis of legitimising the processing of health personal data for other purposes, then such consent has to be freely given and fully informed. The document notes that it is "misleading" if the patient does not have "a genuine free choice and is subsequently able to withdraw the consent without detriment". When giving consent, the patient must be made aware that he is "renouncing the special protection" granted to medical records (i.e. the prohibition on the processing of health data in the absence of such consent).

The Working Party states that the processing of medical records within an EHR system can be legitimised by statute but only if that statute supports a "substantial public interest". In assessing this public interest, the Working Party stresses the need to respect "self determination" of patients whereby the patients' wishes with respect to the processing of their medical data plays a "significant role as a major safeguard".

This appears to contrast with the practice in the UK. For example, the Secondary Uses Service in the UK will consider wider uses of health personal data in the absence of consent. The position adopted by the Service is that if there is a substantial public interest for that secondary use, then there is no need to consider any aspect of "self determination".

The Working Party adds that the processing of health personal data can be legitimised on the grounds that the processing is undertaken by a health professional for a necessary "medical purpose". The Working Party then state that "medical research" is not included within the meaning of "medical purpose", and this implies that medical research by a health professional needs patient consent or has to be legitimised in terms of a "substantial public interest" where self determination is an important factor.

Finally, the Working Party states that only those professionals who are "presently involved" with a patient should have access to the health record (e.g. this limitation should apply to access to the Summary Care Record), and that "a patient should have the chance to prevent access to EHR data if he so chooses".

In summary, it appears that there are several requirements, which the NHS's own EHR system have yet to fully adopt. If I can be of assistance to the Committee, please do not hesitate to ask.

Dr. C.N.M. Pounder
Editor of Data Protection & Privacy Practice
30 Aylesbury Street,
London EC1R 0ER, UK

APPENDIX 1 – SECTION 251 OF THE NHS ACT 2006

251	Control of patient information
	(1) The Secretary of State may by regulations make such provision for and in connection with requiring or regulating the processing of prescribed patient information for medical purposes as he considers necessary or expedient-
		(a) in the interests of improving patient care, or
		(b) in the public interest.
	(2) Regulations under subsection (1) may, in particular, make provision-
		(a) for requiring prescribed communications of any nature which contain patient information to be disclosed by health service bodies in prescribed circumstances-
			(i) to the person to whom the information relates,
			(ii) (where it relates to more than one person) to the person to whom it principally relates, or
			(iii) to a prescribed person on behalf of any such person as is mentioned in sub-paragraph (i) or (ii),
		in such manner as may be prescribed,
		(b) for requiring or authorising the disclosure or other processing of prescribed patient information to or by persons of any prescribed description subject to compliance with any prescribed conditions (including conditions requiring prescribed undertakings to be obtained from such persons as to the processing of such information),
		(c) for securing that, where prescribed patient information is processed by a person in accordance with the regulations, anything done by him in so processing the information must be taken to be lawfully done despite any obligation of confidence owed by him in respect of it,
		(d) for creating offences punishable on summary conviction by a fine not exceeding level 5 on the standard scale or such other level as is prescribed or for creating other procedures for enforcing any provisions of the regulations.
	(3) Subsections (1) and (2) are subject to subsections (4) to (7).
	(4) Regulations under subsection (1) may not make provision requiring the processing of confidential patient information for any purpose if it would be reasonably practicable to achieve that purpose otherwise than pursuant to such regulations, having regard to the cost of and the technology available for achieving that purpose.
	(5) Where regulations under subsection (1) make provision requiring the processing of prescribed confidential patient information, the Secretary of State-
		(a) must, at any time within the period of one month beginning on each anniversary of the making of such regulations, consider whether any such provision could be included in regulations made at that time without contravening subsection (4), and
		(b) if he determines that any such provision could not be so included, must make further regulations varying or revoking the regulations made under subsection (1) to such extent as he considers necessary in order for the regulations to comply with that subsection.
	(6) Regulations under subsection (1) may not make provision for requiring the processing of confidential patient information solely or principally for the purpose of determining the care and treatment to be given to particular individuals.
	(7) Regulations under this section may not make provision for or in connection with the processing of prescribed patient information in a manner inconsistent with any provision made by or under the Data Protection Act 1998 (c 29).
	(8) Subsection (7) does not affect the operation of provisions made under subsection (2)(c).
	(9) Before making any regulations under this section the Secretary of State must, to such extent as he considers appropriate in the light of the requirements of section 252, consult such bodies appearing to him to represent the interests of those likely to be affected by the regulations as he considers appropriate.
	(10) In this section "patient information" means-
		(a) information (however recorded) which relates to the physical or mental health or condition of an individual, to the diagnosis of his condition or to his care or treatment, and
		(b) information (however recorded) which is to any extent derived, directly or indirectly, from such information,
	whether or not the identity of the individual in question is ascertainable from the information.
	(11) For the purposes of this section, patient information is "confidential patient information" where-
		(a) the identity of the individual in question is ascertainable-
			(i) from that information, or
			(ii) from that information and other information which is in the possession of, or is likely to come into the possession of, the person processing that information, and
		(b) that information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual.
	(12) In this section "medical purposes" means the purposes of any of-
		(a) preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services, and
		(b) informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment.
	(13) In this section-
		"health service body" means any body (including a government department) or person engaged in the provision of the health service that is prescribed, or of a description prescribed, for the purposes of this definition,
		"processing", in relation to information, means the use, disclosure or obtaining of the information or the doing of such other things in relation to it as may be prescribed for the purposes of this definition.