This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies.

The Health Service (Control of Patient Information) Regulations 2002: regulation 5 decision procedure for research applications

Last updated on 20 Aug 2019


The Health Service (Control of Patient Information Regulations) 2002 (S.I. 2002/1438), as amended by Section 117 of the Care Act 2014 (hereinafter ‘the Regulations’), make provisions for confidential patient information in England and Wales to be processed without consent for medical purposes, including medical research, where it would not be reasonably practicable to achieve that purpose otherwise, having regard to the cost of and the technology available for achieving that purpose:

  • Regulation 5(1)(a) provides for confidential patient information to be processed without consent in the circumstances set out in the Schedule to the Regulations, provided that the processing has been approved, in the case of medical research, by the HRA.
  • Regulation 5(2) prohibits the HRA from approving the processing unless a research ethics committee (REC) has approved the medical research concerned.
  • Regulation 5(3) requires the HRA to put in place and operate a system for reviewing the decisions it makes under Regulation 5(1)(a).
  • Regulation 4 requires that anything done by a person that is necessary for the purpose of processing confidential patient information in accordance with the Regulations is taken to be lawfully done, despite any obligation of confidence owed by that person in respect of it.

1. Purpose

1.1. This document sets out the procedure for HRA decisions in accordance with regulation 5(1)(a), (2) and (3) of the Regulations.

2. Scope

2.1. This procedure applies to HRA employees with decision-making responsibilities on behalf of the HRA under regulation 5 of the Regulations. 

3. Reference Documents

  • The Health Service (Control of Patient Information Regulations) 2002 (S.I. 2002/1438)
  • Care Act 2014 – Sections 110(1)(d) and 117 and Schedule 7(8)(1)(a)
  • National Health Service Act 2006 – Sections 251 (as amended by Schedule 4(7) of the Cities and Local Government Devolution Act 2016) and 272(6)(a)
  • Governance Arrangements for the Confidentiality Advisory Group
  • Confidentiality Advisory Group Standard Operating Procedures
  • HRA Complaints Policy and Procedure

4. Responsibilities

4.1. The HRA is responsible for exercising functions under the Regulations. As provided by Schedule 7(13) of the Care Act 2014, the HRA’s regulation 5 functions are performed on behalf of the HRA by the Director of Policy (hereinafter ‘the approver’) or appropriate senior delegate.

5. Breakdown of activities covered by the procedure


5.1. The approver makes decisions with advice from the Confidentiality Advisory Group (CAG), a statutory committee appointed by the HRA for the purpose of giving independent advice to the HRA in connection with the exercise of the HRA’s approval function under the Regulations in relation to medical research.

5.2. The HRA operates a transparent process in documenting how it reaches its approval decisions on processing of confidential patient information without consent. The approver’s decision and whether it differed from CAG advice is published in the CAG minutes. 

5.3. The HRA has designated a named senior lead to take the approval decisions. The decision-maker will not have any direct management responsibility for the CAG secretariat. The decision-maker may be present as an observer for the CAG meetings where research applications are discussed. 

5.4. The approver will use the CAG advice as a basis for the HRA decision. The HRA has discretion to take into account other factors when reaching its decision. The HRA has confidence in the expertise and independent advice provided by the CAG and expects to rely upon the advice provided.

5.5. The following will apply when taking an approval decision:

a. When the HRA takes a decision in line with CAG advice, there will be a simple record to confirm acceptance of the advice.

b. Where the HRA is minded, for reasons within the CAG remit, to take a decision that differs from the CAG advice recommendation, it will refer issues back to the CAG for further consideration, documenting the reasons for further consideration. If the HRA identifies that further expert support is required for CAG, it will arrange for it to be provided. If the HRA is unable to accept the advice from CAG, it will explain and document the reasons why. This will be published in the CAG minutes.

c. The HRA expects that CAG will support the HRA in looking at wider issues of policy. Where the HRA is minded, for reasons outside the CAG remit, to take a decision that differs from the CAG advice, it will discuss these issues with the CAG.

Making decisions

5.6. The approver makes decisions with advice from the CAG, in accordance with Schedule 7(8)(1)(a) of the Care Act 2014.

5.7. The CAG receives and reviews applications (i.e. new applications and amendments to previous applications) to process confidential patient information and passes its advice to the approver to make a decision. The CAG's advice is presented to the approver in the form of a draft HRA decision letter that sets out the CAG's opinion of the application, having taken into account the public interest in the processing, the practicability of alternatives and other relevant considerations in accordance with the law, the Governance Arrangements for the CAG and its SOPs.

5.8. The approver has access to the application and supporting documents, including the REC opinion of the medical research concerned. The approver reviews this information and considers the CAG advice in light of it in order to arrive at a decision, which should be communicated to the CAG secretariat within three working days of receiving the CAG's advice. If the approver has any questions about the information or advice, these should be communicated to the CAG secretariat before a decision is reached and as early as possible within the turnaround time.

5.9. If the approver's decision is consistent with the draft HRA decision letter, the approver confirms this in writing to the CAG secretariat, which then issues the decision letter.

5.10. If the approver's decision is not consistent with the draft HRA decision letter, the approver communicates this in writing, as early as possible within the three-day turnaround time (see 6.2.3), to the CAG secretariat with an explanation, so that the CAG can understand the reasons and have the opportunity to comment and so that the draft HRA decision can be revised accordingly as soon as possible within the remaining turnaround time. The approver reviews the revised HRA decision letter and should confirm to the CAG secretariat within the remaining turnaround time that it should be issued.

5.11. A statement of the approver's decision and whether it differed from the CAG's advice is published in the minutes of the relevant CAG meeting.

Reviewing decisions made

5.12. If applicants wish to address issues raised in the decision letter in order to seek a different decision, they may do so in the form of a resubmission.

5.13. If applicants or third parties make a complaint about divergence from this procedure, this will be handled in accordance with the HRA Complaints Policy and Procedure.

5.14. If applicants or third parties are dissatisfied with the outcome of the HRA decision-making process, they can request, within 14 calendar days of the decision being issued, that the HRA reviews its decision. For applicants, this means 14 calendar days from the date of the HRA decision letter; for third parties, this means 14 calendar days from the date of publication of the minutes of the CAG meeting at which the application was considered; these minutes also record the HRA decision. The request should set out the grounds for review and present any other relevant information.

5.15. The CAG considers the request at its next available meeting. The CAG may either reaffirm its previous advice or modify its advice.

5.16. The approver reviews the decision following the CAG's consideration of the request, following the process set out in 6.2.

5.17. The decision in relation to the request for review is final. There is no appeal process against this decision.

6. Monitoring of activities covered by the procedure

Compliance with the requirement for REC approval

6.1. To ensure that the HRA does not approve processing for medical research without REC approval, the CAG secretariat passes the CAG’s advice to the approver in the form of a draft decision letter that takes account of the REC decision status, if known to the CAG secretariat. Where the CAG advice supports approval but the REC decision is pending or not known to the CAG secretariat, the CAG secretariat prepares a provisional HRA decision letter (i.e. processing approved subject to REC approval).

Monitoring timelines for HRA decisions

6.2. The HRA publishes key performance indicators, including the number and proportion of applications meeting the target processing time, from receipt to issuing decision letter, of 60 days for new applications (30 days for applications where a precedent has been set) and 30 days for amendments.

7. How lessons are learnt and incorporated into the procedure

7.1. The HRA will incorporate into this procedure lessons learnt from any complaints made about the decision-making process.

8. Management of Documents and Records

8.1. This procedure will be published on the HRA web site and stored in Word format in the HRA Hub CAG workspace, allowing authors/owners to review and amend. It will be reviewed in light of relevant legislation and policy and otherwise every three years. Superseded versions will be archived.

9. Dissemination and publication of the document

9.1. This document will be released onto the HRA web site at This replaces the superseded version. 

Back to guidance for cag applicants