This document provides guiding principles to assist LMCs and GP practices in considering how to respond to these types of requests.1 These principles can, however, be applied to all disclosures of data for secondary purposes. These principles can, however, be applied to all disclosures of data for secondary purposes.
In the first instance, it should be established whether the request for patient data is for secondary uses or for direct clinical care.2 Examples of secondary uses include commissioning, risk stratification, financial and national clinical audit, healthcare management and planning, research and public health surveillance.
Requests for data for secondary uses may be presented in different formats, for example, a data sharing agreement between the PCT and a third party, a data sharing agreement between the GP practice and a third party, a request for PCT or third party remote access to GP practice electronic records, requests from researchers and, potentially in the future, requests at a national level for data, for example, from the NHS Information Centre.
Disclosure of effectively anonymised, pseudonymised or aggregated data3 will often satisfy a number of secondary uses and must be used in preference to patient identifiable data. Consent for disclosure of effectively de-identified data is not required. De-identification processes should occur before data leaves the GP practice.
If a request is for identifiable data5 and the GP practice feels that de-identified data would suffice clarification should be obtained as to why identifiable data is required other than, exceptionally, where mandated by law.
Express patient consent is needed for the use of identifiable information for secondary purposes, unless the provisions in bullet point five apply. Patients should have the right to dissent from the disclosure of their identifiable data for secondary purposes unless the law compels disclosure.6
Identifiable data may be disclosed for secondary uses without express consent if:
- the disclosure of identifiable information has been authorised by the National Information Governance Board's Ethics and Confidentiality Committee under Section 251 of the NHS Act 2006 (in England and Wales);
- it is a disclosure made under the 'Confidentiality and Disclosure of Information Directions 2013',7 which provide a limited statutory basis for some specific disclosures where it is not possible to obtain express consent and where it is not feasible to anonymise data. These specific disclosures include secondary uses relating to the financial and management arrangements of the NHS, for example, Quality and Outcomes Framework (QOF) reviews, investigating complaints or suspected fraud. In the BMA's view, in such circumstances, the conditions which would enable implied consent to be given must be put in place8 i.e. Requests for disclosure of data for secondary purposes NHS IT/Ethics Requests for disclosure of data for secondary purposes 2 patients must be clearly informed about the uses to which their data may be put, how to opt out, and complaints procedures;9 or
- it is otherwise required by law.10
Any disclosure of identifiable data must meet the requirements of the Data Protection Act 1998, and so:
- no data must be retained longer than is necessary;
- the minimum amount of data required for the purpose should be disclosed;
- data must be held securely;
- information should also be obtained about whether the data will be stored in the UK, EU or outside the EU and GP practices should seek assurances that appropriate security and contractual arrangements are in place; and
- assurances should be sought (preferably in writing) that information will not be transferred to a third party and it will only be used for the specific purpose for which it was disclosed.
A formal data sharing agreement or protocol may be advisable to ensure that both parties understand the limits and conditions of data sharing. Legal advice11 and advice from the LMC may be required particularly when the data are being processed by a third party.
If there are doubts as to whether a disclosure should take place for secondary purposes then guidance can be sought from Caldicott Guardians, indemnifying or regulatory bodies.
Further detailed guidance on information governance and data disclosure is available in the Good Practice Guidelines for GP Electronic Patient Records.
Requests for disclosure of data for secondary purposes (PDF)