Health Bill (Second sitting)
Q Of course, it would need to be viewable across the whole country for people who travel around. What about the security of this data? Lots of people have expressed concerns about the security of the data, both from people who are a bit nosey and who want to have a look, and from people who would wish to do the country harm, hacking large volumes of data. How do we keep it safe? Dr Cocker: That is a pertinent question. I know that that has been the focus of a lot of concern since the Bill was publicised. I believe that the structure of the SPR would be recognised as a critical national infrastructure-type of project, so it would have access to more resource to protect it. But there will always be inherent risk, when you have something centralised, that it is a single target rather than multiple targets that could be attacked—for example, in a cyber-attack. Role-based access would be important—for example, having an understanding that the information should be accessed only for the provision of clinical care. How it would be delivered on a technical level would have to be finalised; that was not the type of the prototyping work we did, because it was more about a proof of concept than those more minute technical challenges. Dr Byrne: I am glad that Dr Cocker took that question first, because he has given you a helpful technical answer. As National Data Guardian, my mission and concern is primarily around public and professional trust. Trust in whether this system can be relied on in terms of people’s confidentiality is something that concerns me very much, as well as people’s trust and confidence in secondary purposes, how the system will be used and what the safeguards around it will be. I would be happy to answer from that perspective when it comes to people’s confidence. I think you have heard a lot about the potential benefits of this system, but it is important to bear in mind that if people do not trust it, the programme will fail, however great the potential benefits are. As a clinician, I would share the excitement, and I am very supportive of the ambition, but people will not trust it if they perceive the risks to the security of their data and confidentiality to be too great. With that in mind, I want to draw attention to two things that concern trust. I want to emphasise that trust is not simply important—I know that the word “trust” has come up repeatedly today—but absolutely foundational to the success of this. The question about how demonstrably trustworthy the system is should be the primary foundational question; all other questions, including the technical ones, flow from that one question. On the confidentiality aspect, I think there is a provision under clause 47 that potentially has very significant unintended consequences. I understand that that is not the intention of the drafting, but I have concerns about it and I have a potential solution to suggest. In clause 47, proposed new section 250E(3) creates the power for the Secretary of State to remove the duty of confidentiality for any processing in the SPR in line with regulations. I need to register my concern about that wholesale lifting of the duty of confidentiality from the entire system. At a system level, there are two risks. One is to patient and professional confidence in the confidentiality of the data once it is accessed or in a system. Confidentiality is absolutely the cornerstone of all clinician-patient relationships. It means that people are comfortable to share the most sensitive information about themselves and often loved ones—it is not just information about ourselves on our records; it is often also information about our loved ones. If people do not trust that that confidentiality is a constant ethical constraint for anyone accessing the record further on, they may be less able to share information about themselves or their loved ones. Clinicians may also be less likely to document that information if they have ethical concerns about who may access it further on if it is particularly sensitive. That will negatively impact on care and the quality of data for any secondary purposes in future. The second point I will make about that confidentiality provision is that I understand that the drafting intent is to remove any ambiguity in terms of people’s concerns about duty of confidence when allowing access to their data at an organisational level. However, as currently drafted, the provision could be interpreted to remove the duty of confidentiality for not just direct care but secondary purposes. Secondary purposes in future could be dealt with by regulations. That lack of clarity poses a risk. The solution I suggest is to redraft that provision, drawing on the precedent already set in the Health and Social Care Act 2012. Section 259 prevents disclosure of data from an organisation from being a breach, so people could allow access at an organisational level with confidence. You have removed that ambiguity, but it does not remove wholesale that duty of confidence—that ethical safeguard for the data in the system itself. I think that that is important for people’s own direct care, and, as I said, it is particularly important if there are any questions around secondary uses in future. Dr Imam: That was a comprehensive answer; I have nothing to add.