Sir Nick Partridge’s review published today, of data releases by the NHS Information Centre, is an elegant demolition of all that has gone before in the way in which medical records have been commoditised and shared with public and private sector organisations.  Everyone should read it.

I am sure that many better informed people than I will pour over the detail.  Others will use it to strengthen their case that we should put a stop to any manner of data sharing.

I hope not.  I hope that the Partridge review will actually be a cathartic moment in the debate about how personal data is collected, stored and used to help people get well, now and in the future.  That it will bring to their senses, those people who believe the ends justify the means.

I have published below the HSCIC news release incorporating its action plan in response to the review. I think it is important that people have a chance to see it.

As you would expect from a previous Chair of INVOLVE, Nick Partridge, has secured fundamental changes in the governance of HSCIC and data releases going forward.  These include patients and the public sitting on the main committees reviewing data releases, open publication of data releases and a programme of ‘active communication’ with the public.

It’s my view that the Partridge review, its recommendations, and the swift response from the Health and Social Care Information Centre (HSCIC), offers us the opportunity of a fresh start with the public on this issue.  It will be criminal if we do not take it.

HSCIC News Release

The Health and Social Care Information Centre (HSCIC) today (June 17) sets out a series of steps to guarantee greater openness and reassurance to the public, stricter controls over data use and better clarity for data users.

This follows completion of a review of information released by its predecessor organisation, the NHS Information Centre (NHS IC), which is published today and concluded there were significant administrative lapses in recording the release of data. In some cases the decision making process was unclear and records of decisions incomplete; when handling medical records this is unacceptable.

Sir Nick Partridge led the review and made a series of recommendations to the HSCIC Board which have been all accepted. The Board fully acknowledges that while the issues exposed by the review began in a previous era, they are the HSCIC’s responsibility to address.

Sir Nick Partridge, the HSCIC Non-Executive Director who led the review said:

“The HSCIC must learn lessons from the loosely recorded processes of its predecessor organisation. The public simply will not tolerate vagueness about medical records that may be intensely private to them. We exist to guard their data and we have to earn their trust by demonstrating scrupulous care with which we handle their personal information.

“Although there is a new Board and largely new senior executive team, the HSCIC inherited many of the NHS IC procedures and staff. This included data agreements with organisations, which have been highlighted by my review and which will subsequently be listed in future versions of the register of all data releases, first published by the HSCIC in April. We can now make sure we conform to recent legislative changes, so that data is released when it will benefit the health and social care system.”

“I am happy that the HSCIC Board has accepted my recommendations, which I believe will help build a robust, rigorous organisation that the public appreciates is working on its behalf. Without that external trust, we risk losing our public mandate and then cannot offer the vital insights that quality healthcare requires.”

Andy Williams, HSCIC Chief Executive, said:
“In the interests of building an organisation which gains public confidence I want to draw a line under the past. It is vital we learn valuable lessons from a previous time but we need to move forward now and focus on ensuring our processes and decisions are robust, clear and transparent.

“The valuable work that the HSCIC does for the health and social care systems needs the endorsement of the public if it is to be effective. We want people to be certain their choices will be followed, clinicians to feel supported in their roles and data users to know where they are with us.”

Kingsley Manning, Chair of the HSCIC, said:
“We welcome the government’s commitment to set up appropriate oversight for the system as a whole in relation to protecting confidentiality. We look forward to our work being subject to the same scrutiny and also want to encourage the public to scrutinise our activities – this is supremely important to me as Chair of the HSCIC and to our new Chief Executive.”

The HSCIC Board has agreed a programme of work put forward by Andy Williams for positive change:

1. Patients and public representatives will be part of the new membership of the HSCIC’s data oversight committee, the Data Access Advisory Group (DAAG). This work will be overseen by the Confidentiality Advisory Group which will gain statutory powers later in the year.

2. All data agreements will be re-issued, to ensure activity is centrally logged, monitored and audited, resulting in a clear and transparent process. Decisions will be documented and published.

3. A new, strengthened audit function will monitor adherence to data sharing agreements and halt the flow of data if there are any concerns exposed. This will also monitor that data has been deleted when an agreement comes to the end. Any failure on the part of data users to abide by their agreements will entail no further release of data to them.

4. A programme of active communication to the public and patients will help bring greater clarity about an individual’s right to object to their data flowing to or from the HSCIC.

5. A list of all active data sharing agreements will be published in the HSCIC quarterly register, including 14 which originated in the NHS IC. Numbers of all people tracing requests by law enforcement agencies will also be included.

6. Working with partners through the National Information Board we will begin a public consultation and vision for a new national collection strategy for health, public health and social care data and report by May 2015 on its findings.

7. The HSCIC will take forward its new responsibility to oversee NHS data security across the health and social care sector, to ensure best practice is followed and the most up-to-date technology is employed to protect patients.

8. The HSCIC will plan a new ‘data laboratory’ service which will protect the public’s information by allowing access to it in a safe environment with HSCIC managed networks and facilities.

9. The HSCIC will work towards the externally assessed, highest industry standards of ISO27001 for data security and ISO9001, for data management, as part of its efforts to build public confidence.

10. The HSCIC intends to invite stakeholders to a meeting to discuss the implications of these actions and gain views about their effectiveness in helping maintain secure and trusted information systems on July 15.

The review is at: www.hscic.gov.uk/datareview

ENDS

---

Notes to editors

1. The Health and Social Care Information Centre (HSCIC) was established on April 1 2013 as an Executive Non Departmental Public Body (ENDPB). It is England’s trusted data source, delivering high quality information and IT systems to drive better patient services, care and outcomes. Its work includes publishing more than 220 statistical publications annually; providing a range of specialist data services; managing informatics projects and programmes and developing and assuring national systems against appropriate contractual, clinical safety and information standards.
2. The NHS Information Centre (NHS IC) was established in 2005. In March 2012 it reverted to its legal, statutory name, The Health and Social Care Information Centre (HSCIC), to reflect its broader social care responsibilities. It ceased to exist on April 1 2013.
3. Agreements that were approved by the NHS IC, which were still live when the HSCIC was formed can be broken down into the following four categories: i) 284 agreements which were live when the HSCIC was formed that have now ceased and no data has flowed since April 2013; ii) 251 agreements which were live when the HSCIC was formed that are still live and no data has flowed since April 2013; iii) 19 agreements which were live when the HSCIC was formed that have now ceased, that data was released under; iv) 314 agreements which were live when the HSCIC was formed that are still live and which data has been released under. Within category (ii) the HSCIC has identified three insurers who the Chief Executive of HSCIC has written to, asking them to delete the data ahead of when the Care Act amendments come into force. Category (iii) and (iv) are 319 are for Medical Research Information Service (MRIS) releases and 14 are for releases made through the Data Linkage and Extract Service (DLES). Of the 14 releases made by DLES, 7 are in Category (iii) and 7 are in Category (iv).
4. MRIS, the Medical Research Information Service, provides a service to researchers undertaking longitudinal studies. Of the live MRIS agreements, nine have been suspended as the review identified that they did not have the correct, up-to-date legal approvals in place. MRIS helps organisations, for example, universities, to track cohorts of patients which typically range from around 1,000, with the biggest one being 1.3million.The suspended studies are historical studies that were originally fully covered by section 60 of the Health and Social Care Act 2001, but their approvals were not updated following a legislative shift in 2008.