Since there are matters of law, policy, organisational structure, and practice that vary across the UK nations, the conclusions and recommendations are not necessarily equally applicable to all four nations. Nevertheless, we hope that findings and conclusions drawn from this work serve as a basis for, and can inform guidance, practice, and processes in each of the UK nations.
This report clarifies the criteria that must be met under which access to identifiable confidential patient information is permissible, so that the choice of providing patients with care through research can be offered. This clarification is consistent with the common law duty of confidentiality as decided by UK courts. The report sets out the safeguards that the HRA thinks should still apply when identifiable confidential patient information is used to find people who might be eligible for care through a research choice. The report does not conclude that it is currently necessary or justifiable (based on people-centred principles) to try to allow wider disclosure through specific legislation.
The report describes several ways in which patients can be found and contacted about research that maximise privacy and reduce burden on clinical teams. It is important that as these are taken forward, the result is not to remove other clinical teams that are not delivering research from contact with information about research. Opportunities should be found to inform clinical teams about research to which their patients are being invited, so that they can support discussions with patients about research options as part of conversations about providing them with care. In addition, even if the mechanisms proposed in this report reduce burden and time for clinical teams, consideration should be given to appropriate and transparent financial recompense to care organisations for supporting and enabling research participation. With more decentralised models of trials, there are also opportunities for clinical teams in different parts of the patient pathway to get involved in research in other ways.
This report will not have achieved everything expected of it by all stakeholders. There will be some patients or some in the research community who want greater access to identifiable confidential patient information now to make it simpler to do important research. There may be some patients and members of the public who think there is too much risk to their privacy. This report aims to balance an approach to research that is aligned with normal clinical care, and therefore likely to be in line with the reasonable expectations of the public.
The report does not rule out potential future changes to guidance, and consideration of changes to legislation as a potential option, to provide more clarity and reassurance about the safeguards surrounding access to identifiable confidential patient information for finding and contacting people about research. But it is critical that the involvement and engagement work is done first. For example, driving through a change in legislation to create legal gateways for access by people outside patients’ reasonable expectations is highly likely to backfire, as shown by opt out increases and media responses to earlier attempts to change how patient information is used for other purposes. If it is deemed necessary to broaden the reasonable expectations of the public as to who may access their data for research that is care, this can only be achieved through extensive communication and engagement about how patient information supports research, greater transparency about the use of patient information, and clearer opportunities to register dissent. For example, public engagement may yield findings that justify carrying out a public consultation to road-test an extension to legislation in specific use cases, which could also be used to clarify the existing common law position described in this report. While a legislative option (if considered necessary) would take time to implement, further evidence gathering on reasonable expectations would allow the potential for future development, including guidance of the position in response to the feedback obtained.
This report draws attention to work exploring a method for patients to say in their medical records whether they wish to be informed about research options. This model has several technical and human complexities that would need significant public involvement, piloting, and evaluation. Asking patients to subscribe to hearing about research options may create confusion with other approaches outlined in this report that aim to promote research as a care choice. Significant public engagement would be needed to explore whether such a subscription model is better suited to research that is not a care choice (for example, epidemiology research) and how this should be communicated to the public. It would also be important to explore how this subscription model for research might interact with the National Data Opt-Out.
This report has found opportunities to explore with patients and the public how sign-up registers can be of value to them, including beyond the immediate purpose of contacting people about the choice to take part in research. Further work with researchers is also needed to explore how to make best use of these registers.
This report recommends that further work is done on the technical means, and value of, linking digital intermediaries and sign-up registers using secure and privacy-protective methods. This could allow more effective channels for contacting potential participants in ways they are more likely to be expected by patients and the public at large.
This report acknowledges the value of the Confidentiality Advisory Group in England and Wales, the Public Benefit and Privacy Panel in Scotland, and equivalent review in Northern Ireland - to lift the common law duty of confidentiality, or provide advice on whether permission should be given to access in compliance with the law on behalf of NHS organisations. These processes give a mechanism to support medical purposes that are in the interests of patients or the wider public, where consent is not a practical alternative and where anonymous information will not suffice. The role of these reviews is to reassure the public that the disclosure of identifiable confidential patient information in each case is in the public interest, justified, and transparent. The report concludes that these processes give an important safeguard for the public.
Some researchers have called for a permanent use of the legal notices issued by the Secretary of State and Welsh Government during the COVID-19 pandemic, which instructed NHS organisations in England and Wales to share identifiable confidential patient information for research and other purposes. These notices were issued under The Health Service (Control of Patient Information) Regulations 2002. The notices were issued in recognition that the pandemic created a clear public interest and a clear requirement for identifiable information. Any change to the existing processes for review - by the Confidentiality Advisory Group in England and Wales, the Public Benefit and Privacy Panel in Scotland, or equivalent review in Northern Ireland - would either require the assurance to the public to be abandoned, or give the assurance by another means. This report concludes that there is not sufficient evidence of public support to recommend abandoning the current arrangements for review by the Confidentiality Advisory Group in England and Wales, the Public Benefit and Privacy Panel in Scotland, or equivalent review in Northern Ireland.
In line with the original expectations when the legislation was created, this report shows how use of technology and privacy enhancing arrangements can reduce the need to rely on reviews, on behalf of the public, by the Confidentiality Advisory Group. The HRA are working with the Confidentiality Advisory Group to streamline processes and make sure that there is a proportionate balance between what is needed from applicants to the Confidentiality Advisory Group and ensuring it continues to support public trust in its considerations. Several improvement activities are either underway of being considered in this respect, including:
- Ensuring applicant attendance at all meetings as standard from January 2024. This will allow for an informed discussion between the Confidentiality Advisory Group and applicant to discuss any matters arising and allow resolution of most issues at the meeting.
- Discussions are ongoing about how the Confidentiality Advisory Group can support programmes of work in a proportionate way without requiring multiple applications for individual research studies within the programme, whilst ensuring that each supports a public interest.
- The Confidentiality Advisory Group already has a proportionate review route for applications to find a cohort of patients and then seek their consent, through an individual who does not have a legitimate care relationship to the patient reviewing medical records. However, few applications of this type are received. Future work is under consideration to further streamline processes and test the possibility for the Confidentiality Advisory Group to set the boundaries on how this approach can be checked by staff only, for alignment with standards, and reviewed by a Research Ethics Committee for a public interest test. This work would need resourcing before careful consideration, engagement and piloting with the Confidentiality Advisory Group, Research Ethics Committees, and staff, and tested with the public before introducing.