Dr Tony Calland MBE, Chair of the Confidentiality Advisory Group (CAG)
2023 was a busy year for the Confidentiality Advisory Group (CAG). We reviewed over 100 applications for the use of confidential patient information without consent and we were proud to maintain the speed of review at a consistently high level throughout the year.
Overall, the CAG advised on 337 decisions taken by the HRA or Secretary of State for Health and Social Care, which included new applications, amendments and annual reviews, 70% of which related to research.
In addition to our bimonthly meetings to discuss all of the above, the CAG meet twice a year to discuss topics that are currently relevant. At our recent away day, we reflected on the public perception of CAG's role.
A balancing act
CAG's formal role is to provide advice to the HRA or the Secretary of State on the use confidential patient information without consent. During our away day, we acknowledged that some may see us as the guardians of patient information, some as the facilitators of research that can improve patient care, and some may not know of us at all.
The CAG motto is to ‘get the information to flow’ but of course, it has to be within the confinements of law and regulations, as well as the public perception of what is acceptable. Ultimately, we must ensure that any use of confidential patient information benefits the public, and that its controlled use continues to uphold public trust. This can be a fine balancing act between protecting the confidentiality of the patient data that will be used in a research project, whilst also ensuring the greatest public benefit to people or patients through its use in that project.
Three themes for 2024
We also noted some particular themes that will influence our work in 2024.
Patient and public involvement
One is a lack of relevant patient and public involvement in the unconsented use of confidential patient information, which would support the public interest.
In 2023, we updated our applicant guidance section on the HRA website to provide more information for applicants on this subject. We are further reviewing the patient and public involvement section and will publish updated guidance soon, so that applicants know what is expected of them at the earliest opportunity.
CAG advises applicants to take time to review this guidance and address each area before submitting the application. A well written and clearly explained application makes the review process easier for the Confidentiality Advice team (CAT) at the HRA and for the members of the CAG. It ultimately benefits the applicant as the final support outcome letter can be finalised quickly, which means the data can flow in a timely manner.
Applicant uncertainty
The combination of law and regulation which governs the use of confidential data without consent is complex and it is common for applicants to be uncertain if they need to apply to CAG for Section 251 support. The CAG recommends that, in the cases of doubt, that applicants contact the CAT office to discuss the requirements for the project. The decision whether to apply or not to CAG for Section 251 support is one for the applicant to make but the advice will clarify the options available.
Artificial Intelligence
The world of electronic data never sleeps, and although the remit of the CAG is narrow and focussed, it is not unaffected by the way this data world is changing. For example, the very rapid development of Artificial Intelligence (AI) will require careful management and the CAG is pleased to have recently recruited new members with expertise in this evolving field. This will help CAG better understand the nuances and risks involved in future applications for access to confidential patient information involving AI processing.
It is the magnitude of the changes which are so interesting and need careful management. The merger of NHS England and NHS Digital is a very significant realignment which is still 'bedding in' but will hopefully help place the UK in an optimum position to compete internationally for years to come.
Secure Data Environments on the horizon
Building on the momentum of the Goldacre Review, a nationwide initiative is on the rise, with Secure Data Environments (SDEs) being constructed at key hubs across the UK. SDEs are data storage and access platforms, which uphold the highest standards of privacy and security of NHS health and social care data. The data has all personal details removed before it becomes accessible by approved users.
The use of confidential data in these data banks involves decisions made by the CAG. Several projects trialling this approach have already undergone CAG review, raising interesting questions about their development and potential implications. These developments need careful consideration so that CAG can maintain consistent review principles whilst accommodating innovation in a rapidly changing environment.
The great benefit of these databanks is that the data never leaves the safe NHS environment. Access to the data is regulated and controlled so the researchers can only access relevant data that has been already curated to their specification but is not shared outside the NHS. This is a major step forward in improving public trust in the use of confidential data.
I expect 2024 to be another year of significant work for the CAG. Not only in reviewing applications, but in working with key stakeholders and partners such as the National Data Guardian, Department for Health and Social Care and NHS England, to ensure that the use of confidential patient information without consent is used safely, and that the public have ‘no surprises’ in how their health information is used.