1. Background

In February 2023, the UK government announced an independent review, led by Lord James O’Shaughnessy, into the UK commercial clinical trials landscape. The review aimed to support the life sciences sector to unlock UK growth and investment opportunities and suggest resolutions to the key challenges in conducting commercial clinical trials in the UK. The report made two recommendations relating to finding and contacting people about research:

• “agencies responsible for information governance within clinical trials should establish a common approach to contacting patients about research within the current legislative framework
• “a national participatory process should be conducted to examine how to achieve greater data usage for clinical studies in a way that commands public trust. This should seek to establish a publicly supported position around the proactive contacting of patients to take part in clinical trials and studies that could form part of their care.”

The government at the time accepted both recommendations. In May 2023 it tasked the Health Research Authority (HRA) to work with its Confidentiality Advisory Group, the National Data Guardian, the Information Commissioner’s Office, DHSC and NHS England to establish measures that streamline the processes to approach patients about research, establish the means by which the public should be consulted and identify whether legislation is needed to establish clinical research as part of individual care, making it easier to offer innovative treatments to patients.

The commission in the government response was primarily to undertake discovery work so that the Recovery, Resilience and Growth (RRG) Programme (RRG) (now replaced by the UK Clinical Research Delivery (UKCRD) Programme) Partners could design wider public consultation and engagement. Although the project therefore did not include a national participatory process, the work was informed by both a small UK-wide project group including public contributors, and a small public dialogue project in Wales. The project drew on earlier work, some of which included patient and public voices. A reference list of this work is included at the end of this report. The report was also informed by conversations with RRG (and later, UKCRD) Programme partners and other relevant organisations, and included conversations with researchers from both primary and secondary care. The HRA is grateful to those who gave time for individual and small group discussions.

The common law duty of confidentiality is decided through the courts rather than being set out in legislation. Because this common law is not written in legislation, and there have been few cases relating to research, different people have interpreted the law in different ways. This means that current practice in finding and contacting people about research is varied. Because researchers and information governance professionals are uncertain or cautious about what they are allowed to do, they are often not clear and transparent to the public about how they are using patient information to find and contact people about research.

In England and Wales, the common law sits alongside legislation set out in the Health Service (Control of Patient Information) Regulations 2002, and UK-wide alongside wider data protection legislation. This project has explored legal literature on confidentiality and implied consent, and taken account of parliamentary debate about the Health Service (Control of Patient Information) Regulations 2002.

When interpreting the common law, the courts draw on guidance from authoritative organisations as well as precedent from earlier cases in the courts. This project aims to bring greater legal certainty through a coherent review of the law relating to identifiable confidential patient information and guidance. The report also sets out areas for further engagement and involvement with the public to help earn public trust.

The primary purpose of this report is to address issues around identification of potential participants for the purpose of contacting people about research. The method and content of contact with people about research and the behaviours of those involved are not the focus of this report, and so it only has a few limited references to this. Furthermore, there are a wide range of issues relating to use of patient information in research and public trust that this report does not try to address.

The report acknowledges that there are some matters of law, policy, organisational structure, and practice that vary across the UK nations. Where possible, the report takes a UK-wide approach. However, each of the nations will need to consider how the findings and recommendations from this work inform their actions, to help support consistency in approach to support UK health research. Consideration of nation-specific elements will be drawn out in the future work responding to this report. Note that for simplicity this report uses the term NHS to also cover Health and Social Care (HSC) organisations in Northern Ireland.