My Lords, I am enormously grateful for that really important discussion of these critical amendments and provisions. I will take a moment to run through them in some detail. Device safety is absolutely critical to patient safety, and that is why the Government amended the Bill to include Clause 16. I pay tribute to my noble friend Lady Cumberlege, whose team helped inspire that amendment, and to the noble Baroness, Lady Finlay, who has participated in discussions on this clause. We have the benefit of her insight now.
Amendment 86 in the name of the noble Baroness, Lady Finlay, would add the unique device identifier number to the provisions in Clause 13(1)(g). These provisions currently allow the Secretary of State to make regulations about package labelling, provision of information and instructions for medical devices. UDIs would be one of the matters included within regulations made in reliance on Clause 13(1)(g), as drafted. It is therefore our belief that the amendment is not necessary.
The noble Baroness, Lady Finlay, and my noble friend Lord Ribeiro made important and fascinating remarks on Scan4Safety. I will limit my comments, which could be extensive, to the importance and value of that scheme. We are extremely supportive of the principle of fast and accurate traceability. Scan4Safety is not the only scheme of its kind, but it is a particularly good one. It is the hope that any UDI created by these regulations will empower these valuable services. We have a session on medical device information systems coming up in the diary, when I hope very much that we can discuss how that might work. If the concern of the noble Baroness is whether we intend to make provision to require manufacturers to provide a UDI, I reassure her that that would be a condition for being placed in the UK market.
Amendment 88 to Clause 13, as the noble Baroness, Lady Finlay, has indicated, is intended to support the tracking of devices used in medical procedures by recording the UDI in a register provided for in Clause 13 or within hospital episode statistics. I completely acknowledge the noble Baroness’s intent, but there is a difference between a register at Clause 13 and a database
at Clause 16, or a registry. Clause 13 provides for a register or a number of registers. The register or registers we intend to create under Clause 13 will be a list of medical devices for sale on the UK market, held by the MHRA. It will not include the individual product identifier part of the UDIs and it will not contain data or monitoring information related to individual devices. The register forms part of wider market surveillance and vigilance activity. Regulations will be able to make provision requiring information to be entered into a register, such as the unique device identifier, which all manufacturers will be required to put on their devices. Amendment 88 is therefore unnecessary.
While the registers will enable some device identification to track individual devices, it is the information system, created under regulations made under Clause 16, which will ensure that devices and procedures are tracked in the event of a concern being identified, through which patients can be contacted and appropriate action taken in each case. The use of MDIS, which I will come on to, could prompt the MHRA to use the information in the register established under Clause 13 to identify the manufacturer and take action.
Amendment 102 would add information to be recorded in any information systems established under Clause 16. All the information set out in Amendment 102 can already be required under regulations made under Clause 16, but the regulations do not have to set out all those matters and can set out other descriptions of information.
A UDI may not always be available, such as for a custom-made device, so it may not always be possible for the providers to capture this. Amendment 102 would also require the recording of every procedure that related to a medical device. I have spoken before about the number of different medical devices on the market and that they vary greatly in risk profile. It would not be necessary or cost-effective to record every procedure related to a medical device, but they could be recorded in one of the registers provided for by regulations under Clause 12, as being on the UK market.
Amendment 103 in the name of my noble friend Lady Cumberlege deals with the important issue of patient consent. It would introduce an obligation that regulations made under Clause 16 would require the Secretary of State to set out the categories or types of information that are subject to patient consent that are held by the Health and Social Care Information Centre, otherwise known as NHS Digital, or by other persons.
My noble friend has raised this with me and with officials, and she is a tireless champion of patients. I am moved and affected by the accounts she has heard. As the testimony in her review shows, the absence of data in the healthcare system is absolutely medieval, and it is exactly the purpose of the Bill to fix that. Before any data can be collected relying on the provisions at Clause 16, regulations must be made. Those regulations are subject to consultation, as at Clause 41. It is absolutely right that the system is informed by patient views, and that the process is one where it is easy to engage, to understand what we want to do and to build consensus that it is the right thing.
My noble friend Lady Cumberlege has views on what data should be subject to opt-out versus opt-in. Privacy is a higher-order value that we should protect. The question of patient consent is really important. The noble Baroness, Lady Finlay, campaigned on the importance of opt-out organ donation and I congratulate her on her contribution to the recent change to organ donation privacy protocols, which are widely supported by the public and will save thousands of lives. She knows as well as I do that choosing to opt into measures is not as comprehensive as choosing to opt out. It is important to have enough data to draw conclusions.
Consent will not be required to input information about the surgical procedure and the UDI of the implanted device, linked to the patient, into the information system. The medical device information system is about protecting all patients who have had similar procedures, not just a particular patient. The detail of the specific device inserted, the procedure information and, if necessary, the effect that device has caused is what will be necessary for the information system to work. If there is no adverse report made by the clinician on behalf of that patient, that data acts as a control sample. It allows for other patients’ reports, where there have also been adverse reactions, to be understood as part of a wider data picture.
In her report, my noble friend raised the recommendation that detailed data should require consent in order that the data collected is necessary and proportionate. I reassure her that all data collected for the system will be necessary and proportionate. Data held by clinicians should be shared only under those circumstances, and data shared by the information system with, for example, a clinical registry for clinical assessment of whether there is an issue, should be only that which is necessary.
The intention is, that in the event there is a reported adverse reaction with a device, the medical device information system would send a report to a clinical registry. That report, suitably anonymised and stripped of patient-identifiable information but including the device UDI, would have the detail of all procedures, not just those involving adverse reactions, to further anonymise the incident. A clinical assessment would be conducted and, if it is concluded that the device is the issue, only relevant and necessary information would be sent to the MHRA to conduct its own tests.
This is a very important paragraph and one that I will emphasise. We do not need patient-identifiable information to determine whether compliance or enforcement action needs to be taken, but device information. There are routes to identifying that there are issues with adverse reactions when a clinical registry is not present, such as manufacturers’ reports or Yellow Card reports.
5 pm
It is important to be clear that the medical devices information system will collect and hold only whatever information is necessary for it to deliver its function. I understand that patients often have a confidential, private relationship with their GP or physician. It is right that this information and these conversations are private. It is important too that information necessary to protect patients is collected. However, I do not
think it helpful now to set out in the Bill which information is subject to explicit consent under Clause 16. It is right that, through consultation, we identify what data is necessary to capture in order to deliver the improvement to patient safety that patients want. We are speaking to the devolved Administrations and will speak to patients, registries and clinicians.
I can assure my noble friend with absolute clarity that the GDPR stands as a requirement. Her amendment also refers more broadly to information held by NHS Digital and other persons. It goes beyond the intent of Clause 16 and into the wider work of NHS Digital under the Health and Social Care Act 2012. This Bill solely enables the establishment and operation of the medical devices information system by NHS Digital, and does not deal with information held under other powers. I hope my noble friend would agree that these matters are not materially in scope.
I can confirm to the noble Baroness, Lady Jolly, that these data will not be accessible to the private sector, although they will need to share some of their data with the registries in accordance with the regulations. I hope that the noble Baroness, Lady Finlay, and my noble friend Lord Ribeiro are content with my explanation, and that my noble friend feels able not to move her amendment.