My goodness—I thank noble Lords for their brevity. I am afraid that I shall not be as brief as I would want to be. I would like to confine myself to single-word answers, but I do not think that would give the reassurance that noble Lords are looking for.
I begin by thanking all noble Lords who have engaged with me on this, especially the noble Baroness, Lady Brinton, and the noble Lords, Lord Clement-Jones and Lord Hunt. As they know from our discussions, this issue is very close to my heart and something I feel very strongly about, so I welcome their pressing the Government on this and their continuous engagement—in fact, right up to this morning. I do not think that this is the end of that engagement but I hope to give some reassurances. I completely understand the interest in the integrated care boards’ power to disclose information that is personal data. I hope I will be able to clarify some of the intentions.
New Section 14Z61, inserted by Clause 20, recreates the section that applies to CCGs, which sets out the circumstances in which CCGs are permitted to disclose information obtained in the exercise of their functions. The clause in question already restricts ICBs’ powers to disclose information, by limiting these to the specific circumstances set out in the clause.
In addition, the existing data protection legislation, including UK GDPR, provides several key protections and safeguards for the use of an individual’s data, including strict rules and key data protection principles for the sharing of personal data. Health data is special category data—that is data that requires additional protections due to its sensitivity. For this type of data to be processed lawfully, a further condition must be met as set out in UK GDPR and the Data Protection Act.
In addition, the common law duty of confidentiality applies to the use of confidential patient information. This permits disclosure of such information only where the individual to whom the information relates has consented, where disclosure is of overall benefit to a patient or is in the public interest—for example, disclosure is to protect individuals or society from risks of harm or where there is a statutory basis for disclosing the information or a legal duty, such as a court order, to do so.
Every health and care organisation has a Caldicott Guardian—a senior person responsible for protecting the confidentiality of people’s health and care information and making sure that it is used properly. Caldicott Guardians decide how much information it is appropriate to share—they may decide that even legally permitted information may not be shared—and they advise on disclosures that may be in the public interest. They act in accordance with the eight principles, which are the framework to ensure that people’s confidential information is kept confidential and used appropriately. The UK Caldicott Guardian Council works closely with the independent statutory National Data Guardian, whose role is to advise and challenge the health and care system to help ensure that the public’s confidential information is safeguarded securely and used properly.
Nothing in the clause overrides the range of requirements in law that provide key protections and safeguards for the use of an individual’s personal data. I can also confirm that NHS England’s power to issue guidance for ICBs will apply to their functions relating to data sharing, and that may be a helpful route in making it clear to ICBs what their duties and responsibilities are, in respect of any confidential data they may hold, in a way that illustrates how legislation applies.
The effect of the amendment is to prevent the effective operation of the clause as drafted. This would prevent the ICB from effectively discharging its functions where it may be necessary to disclose personal patient data, including investigating complaints, making safeguarding referrals for patients whose welfare is at risk, complying with court orders and assisting criminal investigations. It would also risk a confusing data-sharing system where different rules apply to different organisations.
On Amendment 116, once again I thank the noble Lord, Lord Hunt of Kings Heath, for bringing this issue before this House. Our aim is to put data and analytics at the heart of NHS delivery and remove incoherence in the organisational leadership, for the benefit of patients and their outcomes. It is a solid recommendation for improving how health and social care data is used more effectively, closing that gap between delivery and the use of data to inform and improve services.
I understand that noble Lords fear that the movement of the statutory data functions from one world-class arm’s-length body, NHS Digital, to another, NHS England, which indeed runs the NHS itself, would result in a decline in the exercise of those functions. We feel that this fear is perhaps overexaggerated but I would be very happy to continue discussions on this.
However, that movement would be accompanied by the transfer of several thousand expert staff and all their supporting expertise and technology, along with the existing statutory safeguards, which would be preserved. NHS Digital and NHS England have a history of very close working on data, most recently of course in how the management of data has underpinned efforts to defeat Covid-19, through the protection of shielded patients and the management of data on vaccinations. The Government and Parliament held NHS Digital to account for the delivery of its functions, and they will continue to hold NHS England to account for the delivery of any functions which transfer.
As to the concern about a conflict of interest, the data collections which NHS Digital undertakes are the result of directions from either the Secretary of State or NHS England, and obviously the direction-making power of the former will continue to be relevant should the proposed merger take place. Directions include details of how data must be shared or disseminated. NHS Digital is required to publish details of all such directions and maintain a register of the information it collects. There is also a rigorous process for external data access requests and audits of how data is used.
The intention here is that such safeguards would continue when the functions transfer to NHS England and would make it very difficult for the organisation to suppress or otherwise refuse to make available any data which it is required to collect and disseminate in fulfilment of its statutory role. I hope, perhaps overoptimistically, that I have reassured the noble Lord, Lord Warner—clearly not—in terms of suppressing information.
There is a rigorous process for external data access requests. NHS England’s Transformation Directorate will be assuming responsibility for NHS Digital’s functions, and for accomplishing the alignment of delivery and data proposed in the Wade-Gery review. There will continue to be external, independent scrutiny—for example, by the Information Commissioner and the National Data Guardian—of the use by the NHS, and NHS England in particular, of health and care data.
I hope that I have given noble Lords some reassurance that these important issues have been considered by the department, and that they will feel able not to move their amendments when reached. Of course, given my strong interest in this subject, I am prepared and happy to have further conversations to make sure that we close any remaining gaps and for me push the department and NHS England as appropriate.