Legal background

This page provides information on:

  • The Health and Social Care Act 2001
  • The Statutory Instrument
  • What are the concerns over patient consent?

The Health and Social Care Act 2001

The Health and Social Care Act 2001 describes powers taken by the Secretary of State to regulate and require use of confidential patient information without consent.

Section 60 of the Health and Social Care Act 2001 provides a power to ensure that patient identifiable information needed to support essential NHS activity can be used without the consent of patients. The power can only be used to support medical purposes that are in the interests of patients or the wider public, where consent is not a practicable alternative and where anonymised information will not suffice. It is intended largely as a transitional measure whilst consent or anonymisation procedures are developed, and this is reinforced by the need to review each use of the power annually.

Extracted from the Department of Health, Information Policy Unit site.

For further information see:

'The Health and Social Care Act 2001: Section 60 and 61 – Background Information'.

The Statutory Instrument

In 2002 the UKACR sought, and obtained, relief within a Statutory Instrument under Section 60 of the Act, to continue to use patient-identifiable data for cancer registration. This was approved by Parliament on 23 May 2002 and came into effect on 1 June 2002.

Specifically, Regulation 2 makes provision relating to "the processing of confidential patient information in connection with the construction and maintenance of databases by bodies (known as "cancer registries") which undertake the surveillance of health and disease of patients referred for the diagnosis or treatment of neoplasia. Regulation 2(4) provides powers under which the Secretary of State may require certain persons to process information for those purposes. Regulation 2(5) makes provision for information on the operation of these Regulations to be passed to the Secretary of State."

What are the concerns over patient consent?

Many patients would not be asked for consent, because their doctor judged that seeking consent for registration would be too burdensome at the time of diagnosis, or that the diagnosis should not be revealed to the patient at that time. Patients for whom consent was not available might differ in age, socio-economic status, ethnicity (etc.) from those who had consented. Complete and unbiased coverage of the entire population would be lost. Comparisons of cancer patterns from year to year, or between geographic areas or social groups, would rapidly cease to be reliable.

Even with a small loss of information, the biases introduced would have an immediate distorting effect on, for example, tables showing survival from cancer by Health Authority. Such comparisons would lose validity and credibility.

No country in the world operates an effective population-based cancer registration system in which informed consent is required.

In Germany a requirement for informed consent rapidly led to unacceptable loss of completeness (70% or less) and bias in Hamburg and Saarland. Recovery has been slow, leaving large gaps in data series.

In Hungary, the Personal Data Protection Act stopped cancer registration in 1992. Despite a 1997 ministerial decree on data collection, designed to overcome the constraints of that Act, it took two more years before the cancer registry began operating again.

In contrast, all the Nordic countries operate highly efficient and complete registration systems, backed by legislation, without informed consent.

Informed consent would have legal limitations that would reduce its utility.

Consent is likely to be limited in law to release for the purposes that can be specified at the time – it cannot readily apply to questions that will arise later, which is inevitable in research using retrospective records. A consent that is adequately broad for such research is unlikely to be legally acceptable and may mean that worthwhile research will not get done.

Consent is unlikely to have lifetime validity, as required for estimating survival, which requires follow-up until the time of death. In order to maintain existing public health surveillance systems, renewal of consent might therefore need to be sought at every NHS contact. That could never happen sufficiently completely to be useful. In the case of children, consent is initially given by parents. It would not be practicable to go back to the patients when they reach adulthood to seek consent.

The United Kingdom Association of Cancer Registries fully endorses the need for better and more accessible information for cancer patients about the uses that are made of data relating to their illness and plans to work with patient groups to ensure appropriate information is available for all cancer patients at the time of diagnosis.

Cancer registries collate data from multiple sources over long periods of time and it is essential that all information related to an individual is appropriately matched. This requires patient identifiers. In the absence of such cross-checking, patients would be double-counted and analyses would become unreliable.

Cancer registries are, wherever possible, making use of the NHS number for record-matching purposes. This is, however, not a panacea. The NHS number is still frequently missing from NHS records (approximately 50-60% of NHS records currently have the number, private hospitals may not collect it and it is not supplied on death certificates) and occasionally it is wrong. Also the GMC guidance states that a record with NHS number should be regarded as equally identifiable as a record with a name. Unless the NHS number is universally supplied, is totally accurate and can be legally regarded as providing anonymisation, the problems of data release can not be resolved by substituting the number for a name. Even then, anonymisation would not obviate the need to access medical records, for example, to reconcile apparently conflicting information received about an individual.

It should be noted that in New Zealand, despite well developed anonymisation procedures for some health related data the idea of working with anonymised data for cancer registration was thoroughly explored but rejected as unworkable. Legislation was enacted to allow transfers of identifiable data without consent.