Health Bill (Eleventh sitting)
Before I was rudely interrupted by the fire alarm—I am not taking it as a hint, much to the Minister’s disappointment—I was saying that this is a unique system and that with the unique benefits come unique risks. I was trying to answer the points made by the hon. Member for Ashford. As my hon. Friend the Member for Sleaford and North Hykeham and my right hon. Friend the Member for Melton and Syston have mentioned, we already know that despite the regulations, whether they are from professional regulators or the ICO, people will get round the system. One of the biggest concerns that patients will raise is not simply whether patient records will be accessed by nefarious people from outside, such as cyber-hackers, hostile states and so on, but whether they are secure from inappropriate access by people who have access to the system. As my hon. Friend the Member for Sleaford and North Hykeham pointed out, those people could be situated anywhere across the country. Patient records should be accessed only where there is a clear clinical, professional need. The public rightly expect robust safeguards, strong audit trails and meaningful consequences where the rules are breached. Amendment 48 raises that important issue. The Minister should explain how inappropriate access will be prevented, how misuse will be detected and what sanctions will apply when the standards are not met. My hon. Friends have already mentioned a number of cases and I pick another one: the unfortunate case of the three-year-old boy who was hospitalised after being attacked by a crocodile at a zoo. Cambridge University Hospitals trust is currently investigating 40 members of staff who appear to have accessed that boy’s medical records inappropriately. While we would always hope that that would not happen, unfortunately it clearly does. This single patient record means that someone will potentially be able to look at patients’ records regarding anything and from anywhere in the country. My hon. Friend the Member for Sleaford and North Hykeham slightly generously described some people as “nosey”. Along with those who have an actual ulterior motive, that presents a real challenge. I say to the hon. Member for Ashford that just because the current system is in place to protect patient records as they currently exist, that should not be a bar to making sure that we make the system even more robust given its potential risks. It goes directly to proposed new section 250F(4B)(b) of the National Health Service Act 2006, which is the system of audit logging to be applied to each record, so that every time someone accesses a patient record or part of that patient record, the identity of the person obtaining that information should be recorded. I believe that the patient should be able to easily see, hopefully in real time, who has been accessing their record and at what time. We on this side have mentioned a number of big events: that poor boy with the crocodile, terrorist attacks in Southport and so on. I suspect that those data breaches have been identified because they were big events. People have gone out to check that nobody has been inappropriately accessing those records. I worry that every patient record will potentially be available to every single person, and I doubt that there will be an ability to check every single person proactively rather than reactively. That means patients need access themselves to look at their record and see who has been accessing it. If the name of the person who has accessed the record, or the organisation they belong to is available, patients can say, “Well, there is Mr Smith, my child’s paediatrician, and that is fine. However, who is this guy from elsewhere in the country who has looked at the record?” They can then raise that. That is absolutely vital.