Patients are to be given control of medical records under new IT plans

Dear Sir,

I read with interest the article written by Michael Cross entitled
'Patients are to be given control of medical records under new IT plans'
which was published in the BMJ on the 20th of October 2010.

This is a positive development for England. But the manner in which
Scotland addresses confidentiality and consent with respect to the use of
patients' medical records is still very much behind that of our southern
neighbour. This is especially true when medical records are being
considered for research.

Indeed, researchers in Scotland are increasingly being confronted and
restricted by the lack of specific statutory regulations in the use of
medical files of patients in biomedical research when it is not
practicable or possible to obtain their consent. This is happening in the
light of continuing uncertainty on the use of medical records North of the
border .

The situation in Scotland is indeed very different from that in
England where, ever since the Data Protection Act 1998 (which covers the
whole of the UK) additional legislation has been enacted concerning the
use of identifiable information of patients without their consent.
This happened in England with the Health and Social Care Act 2001 updated
in the NHS Act 2006 and finally amended in the Health and Social Care Act
2008.
Appropriate oversight of the use of these medical files was also made
possible in England with the establishment through the above legislation
of the National Information Governance Board for Health and Social Care
(NIGB). This is a statutory body which monitors the use of all medical
files from data controllers including in NHS trusts and GP practices.

The importance and sensitivity of regulating the use of these medical
files in England was reflected in the public debates in and out of the
Westminster Parliament in 2001 . For example, questions were asked in the
House of Lords about some of the wide ranging powers of the proposed
legislation when the Health and Social Care Act 2001 was being prepared.
A report from the London School of Economics also highlighted a number of
concerns where a perceived erosion of patient rights existed, especially
with respect to privacy and confidentiality .

In the end, legislation was enacted in a very careful way in England
making possible the use of medical files for research purposes that were
of interest to patient care or the wider public, where consent was not a
practicable alternative and where anonymised information would not
suffice.

In contrast, however, no equivalent parliamentary or societal
discussions about using patients' files in research without their consent
have taken place North of the border.

In Scotland, there is therefore no equivalent to the democratically
established NIGB, though the Scottish Chief Medical Officer did establish
the Privacy Advisory Committee (PAC) in 1990. This was created to advise,
amongst other things, on the use of NHS national datasets obtained from
patients without their consent.
However, PAC has no statutory powers and cannot give lawful authority to
the disclosure of identifiable information without consent. In addition,
researchers are under no statutory obligation to submit their applications
to PAC (it is just considered best practice). Because of this, any
eventual legal action cannot be taken before a criminal court (since there
would be no breach of the law) but only before a civil court.

Moreover, at a time when GPs are coming under increasing pressure to
release files containing patients' medical histories to the wider health
service , the use in research in Scotland of GP medical files without the
patients' consent is even more intricate because of the lack of
regulations.
Indeed, even the advisory remit of PAC in Scotland does not generally
address the use of health files stored in GP surgeries.

Furthermore, the Information Commissioner's Office in Scotland, which
was established through the Data Protection Act 1998, has just confirmed
in August 2010 that:

"The Data Protection Act 1998 (the Act) is quite clear that, in the
absence of reliance on any overriding exemption, explicit consent is
required prior to processing sensitive personal data such as a GP medical
file."

The Commissioner's Office also reiterated that strict consent
requirements were necessary, indicating:

"As the data controller, it is for the GP to obtain consent for
processing and this might be carried out via written invitation to
participate in the research by consenting to access to their medical file.
The invitation should provide an explanation of the nature of the research
and assurances that no individual will be identified in the results."

Adding:

"In no way could reliance on advertising in the GP surgery be
considered to be explicit consent which is deemed to be fully informed and
freely given: failure to object should not be assumed as active consent."

Thus, the obstacles in seeking to undertake research on, for example,
thousands of medical files from GP practices in Scotland remain
formidable. This is because there is no suitable legal setting or
organisation, such as in England, which could examine the needs of the
researchers and approve, where appropriate, the use of medical files
without the consent of the patients.
Moreover, it is difficult to see how NHS Research Ethics Committees in
Scotland would accept an application to use GP medical files without the
specific consent of the individual or without any additional legislation.

The Scottish Parliament should, therefore, consider discussing these
issues with a view to enacting new legislation in this area. This should
make possible, where acceptable and in appropriate circumstances, the use
of patient files to support medical purposes that are of interests to
patient care or the wider public, where consent is not practicable or
possible and where anonymised information would not suffice.

Scotland should also consider the establishment of a statutory body
similar to the National Information Governance Board for Health and Social
Care (NIGB) in England which monitors the use of all relevant medical
files including in NHS trusts and GP practices.