Watchdog issues warning over government patient data sharing

In an interview with HSJ, Dame Fiona Caldicott said she herself was not clear how different national projects that deal with NHS patient data for research and planning connected together. As national data guardian, Dame Fiona is responsible for ensuring the public’s trust in secure and appropriate use of their health and care information.

She said: “There is a sense of there being quite a complicated jigsaw of initiatives and I think if we’re going to have great clarity for the public and the professionals, we need to see how they relate to each other.

“I am concerned at the moment and this is one of the things I do say to colleagues in the Department of Health [and Social Care].”

According to Dame Fiona, areas of confusion include how regional “local health and care records” link into programmes to share more patient data with industry or how this would link into NHS Digital’s plans to collect more patient data held by GPs in the centre for planning and research.

Dame Fiona said greater clarity was needed around the application of different privacy laws, such as the duty of confidence and the General Data Protection Regulation, in health and social care, echoing similar comments made by NHS Digital chief executive Sarah Wilkinson in March.

“We haven’t been very good at persuading the lawmakers to get these legal instruments into the clearest position they possibly can be for the lay public,” she added. “It is very difficult. This is one of the problems with the public conversation.”

Optimistic about lessons learned

Over the past quarter-century, Dame Fiona has written three landmark reports regarding the handling of patient’s confidential health and social care information. The most recent, released in 2016, lead to the closure of the NHS’ controversial data sharing scheme, Care.data.

Since Care.data, the government has developed several plans for collecting and sharing patient data for planning, research and sharing with industry. These include the local health and care record, a national “data lake”, regional health data research units, and collecting and linking more data nationally within NHS Digital.

Despite her concerns, Dame Fiona said she was confident these latest efforts would avoid the mistakes of Care.data, which was plagued by privacy concerns and hostility from GPs. 

She said: “I’m pretty optimistic that sufficient lessons were learnt… to make sure we don’t go through that again. It’s very unlikely but I would be very naive to say it was out of the question.”

Dame Fiona’s role was enshrined in law late last year, taking effect in April this year. She now has the power to issue guidance on the handling of health and social care information and a requirement that organisations give them “due regard”. She is also developing an agreement which would allow her to refer organisations that failed to heed her guidance to the Care Quality Commission or Information Commissioner’s Office for penalties.

One of Dame Fiona’s four priorities in the newly legally-secured role will be ensuring a more open conversation about how the patient’s confidential data is being shared for purposes beyond direct care.

Other priorities include helping patients access their own health and care data, improving information sharing for direct care, and safeguarding confidential information.

She said early feedback from a consultation on priorities, launched in February, showed public trust  in data sharing for research remains “a big issue” as well as frustration with the NHS’ complex rules inhibiting data sharing for direct care.

“Our experience generally is that most members of the public don’t know a lot about how the systems work and how data within it moves around,” she said. “So I would say that there is quite a big gap.”

Earlier this month, NHS England and the Wellcome Trust’s understanding patient data unit said they would run a public consultation on how the NHS could provide appropriate patient and operational data with researchers and industry.