The Health and Social Care Committee raises serious concerns about NHS Digital’s ability to protect patient data, in its report on Memorandum of understanding on data-sharing between NHS Digital and the Home Office.
Protecting patient data
Confidentiality lies at the heart of good medical practice and patients share data, including their addresses, with clinicians in good faith that this will be held in strict confidence. There are serious concerns about the ability of NHS Digital’s leadership to act as the steward of this non clinical data. So says the Health and Social Care Committee in its report into the MOU that exists between the Home Office, the Department of Health and Social Care and NHS Digital regarding tracing immigration offenders. The Committee is not satisfied that the Chair and Chief Executive of NHS Digital have been sufficiently robust in upholding the interests of patients, understanding the ethical principles underpinning confidentiality, or in maintaining the necessary degree of independence from Government.
Request to suspend involvement in the MoU denied
The Committee took oral evidence on this subject in January 2018 and quickly wrote to NHS Digital (29 January 2018) requesting it to suspend its involvement in the MoU and undertake a further and more thorough review of the consequences and wider implications of sharing addresses with the Home Office for immigration tracing purposes. The government rejected the request which led to the Chair and Chief Executive of NHS Digital being summoned to give further evidence to the Committee. Their response to the serious concerns raised during the session was wholly unsatisfactory and the Committee again calls on NHS Digital to suspend sharing address data. The Committee continues to have serious concerns about Government policy on the confidentiality of address data collected for the purposes of health and social care and in particular the risk that data sharing without patients’ knowledge or consent could become more widespread.
Review of NHS Code of Confidentiality
The report therefore repeats the conclusion of the 29 January letter that NHS Digital should suspend its participation in the memorandum of understanding until the current review of the NHS Code of Confidentiality is complete. This should include proper consultation with all interested parties, and with the full involvement of experts in medical ethics. Its decision should also take full account of the public health concerns raised by Public Health England and the outcome of PHE's review of the impact of the MoU on health-seeking behaviours.
Chair of the Committee, Dr Sarah Wollaston, says
"There is a clear ethical principle that address data held for the purposes of health and care should only be shared for law enforcement purposes in the case of serious crime. NHS Digital's decision to routinely share information with the Home Office with a lower threshold is entirely inappropriate. This behaviour calls into question NHS Digital’s ability to robustly act on behalf of patients in the event of other data sharing requests including from other government departments in the future.
It is absolutely crucial that the public have confidence that those at the top of NHS Digital have both an understanding of the ethical principles underpinning confidentiality and the determination to act in the best interests of patients."
Government policy on data-sharing
The NHS Code of Confidentiality should also consider and consult upon the statement of Government policy on data-sharing which was contained in the Ministers' response ( PDF 205 KB) to the letter of 29 January, and advise Ministers on whether it is an appropriate statement of policy on the sharing of data collected and held for the purposes of health and care. The Committee is deeply concerned that accepting the Government’s stated position would lead to sharing non-clinical data such as addresses with other Government departments and that this would have serious implications for patient trust. We believe that patients’ addresses, collected for the purposes of health and social care, should continue to be regarded as confidential and only shared where this is in patients’ best interests or, in exceptional circumstances and only on a case by case basis, where a serious crime is under investigation.