MPs express “serious concerns” about ability of NHS Digital to protect patient data

MPs on the influential Health and Social Care Committee have raised “serious concerns” about NHS Digital’s ability to protect patient data, in a report into a memorandum of understanding on data-sharing between NHS Digital and the Home Office in relation to potential immigration offenders.

The Committee said it was not satisfied that the Chair and Chief Executive of NHS Digital had been sufficiently robust in upholding the interests of patients, understanding the ethical principles underpinning confidentiality, or in maintaining the necessary degree of independence from Government.

In January the Committee wrote to NHS Digital requesting it to suspend its involvement in the MoU and undertake a "further and more thorough review" of the consequences and wider implications of sharing addresses with the Home Office for immigration tracing purposes.

The government rejected the request which led to the Chair and Chief Executive of NHS Digital being summoned to give further evidence to the Committee.

In the report, the Committee repeated its call for NHS Digital to suspend its participation in the MoU until the current review of the NHS Code of Confidentiality is complete. “This should include proper consultation with all interested parties, and with the full involvement of experts in medical ethics.”

Its decision should also take full account of the public health concerns raised by Public Health England and the outcome of PHE's review of the impact of the MoU on health-seeking behaviours, the MPs said.

Chair of the Committee, Dr Sarah Wollaston MP, said: "There is a clear ethical principle that address data held for the purposes of health and care should only be shared for law enforcement purposes in the case of serious crime.

“NHS Digital's decision to routinely share information with the Home Office with a lower threshold is entirely inappropriate. This behaviour calls into question NHS Digital’s ability to robustly act on behalf of patients in the event of other data sharing requests including from other government departments in the future.

“It is absolutely crucial that the public have confidence that those at the top of NHS Digital have both an understanding of the ethical principles underpinning confidentiality and the determination to act in the best interests of patients."

The Committee said the NHS Code of Confidentiality should also consider and consult upon the statement of Government policy on data-sharing which was contained in the Ministers' response to the letter of 29 January (which included the MPs’ request for suspension), and advise Ministers on whether it is an appropriate statement of policy on the sharing of data collected and held for the purposes of health and care.

“The Committee is deeply concerned that accepting the Government’s stated position would lead to sharing non-clinical data such as addresses with other Government departments and that this would have serious implications for patient trust. We believe that patients’ addresses, collected for the purposes of health and social care, should continue to be regarded as confidential and only shared where this is in patients’ best interests or, in exceptional circumstances and only on a case by case basis, where a serious crime is under investigation,” the MPs said.

In the ministerial response, the government said it considered that , "in the circumstances provided for under the MoU, the public interest is in favour of maintaining the effective enforcement of the UK's immigration laws. The secure and confidential sharing of non medical data between NHS Digital and the Home Office supports this. The Government and NHS Digital will continually keep this under review, not least when the outcomes of the PHE review are known."