Legal background

This page provides information on:

Section 251 of the NHS Act 2006

Cancer registries have legal support to collect data relating to cancer under Section 251 of the NHS Act 2006 (and formerly under Section 60 of the Health and Social Care Act 2001).

Section 251 allows the Secretary of State for Health to make regulations to set aside the common law duty of confidentiality for medical purposes where it is not possible to use anonymised information and where seeking individual consent is not practicable. The regulations made under Section 60 of the Health and Social Care Act 2001 (Health Service (Control of Patient Information) Regulations 2002 (SI 1438)) continue to have effect under Section 251.

Responsibility for administering powers under Section 251 lies with the National Information Governance Board for Health and Social Care (NIGB) which delegated these powers to the Ethics and Confidentiality Committee (ECC). This role was transferred from the Patient Information Advisory Group (PIAG) under the Health and Social Care Act 2008. The ECC is required to make regular reports to the NIGB on its activities.

The support given to cancer registries under Section 251 is subject to annual review by the ECC on behalf of the NIGB.

For further information see:

Section 251 of the NHS Act 2006
Health Service (Control of Patient Information) Regulations 2002 (Statutory Instrument 1438)

National Information Governance Board for Health and Social Care (NIGB)
Ethics and Confidentiality Committee (ECC)

Health and Social Care Act 2008

The Health and Social Care Act 2001
The Health and Social Care Act 2001 describes powers taken by the Secretary of State to regulate and require use of confidential patient information without consent.

Section 60 of the Health and Social Care Act 2001 provides a power to ensure that patient identifiable information needed to support essential NHS activity can be used without the consent of patients. The power can only be used to support medical purposes that are in the interests of patients or the wider public, where consent is not a practicable alternative and where anonymised information will not suffice. It is intended largely as a transitional measure whilst consent or anonymisation procedures are developed, and this is reinforced by the need to review each use of the power annually.

Extracted from the Department of Health, Information Policy Unit site.

For further information see:
'The Health and Social Care Act 2001: Section 60 and 61 – Background Information'.

The Statutory Instrument

In 2002 the UKACR sought, and obtained, relief within a Statutory Instrument under Section 60 of the Act, to continue to use patient-identifiable data for cancer registration. This was approved by Parliament on 23 May 2020 and came into effect on 1 June 2020.

Specifically, Regulation 2 makes provision relating to "the processing of confidential patient information in connection with the construction and maintenance of databases by bodies (known as "cancer registries") which undertake the surveillance of health and disease of patients referred for the diagnosis or treatment of neoplasia. Regulation 2(4) provides powers under which the Secretary of State may require certain persons to process information for those purposes. Regulation 2(5) makes provision for information on the operation of these Regulations to be passed to the Secretary of State."

What are the concerns over patient consent?

Many patients would not be asked for consent, because their doctor judged that seeking consent for registration would be too burdensome at the time of diagnosis, or that the diagnosis should not be revealed to the patient at that time. Patients for whom consent was not available might differ in age, socio-economic status, ethnicity (etc.) from those who had consented. Complete and unbiased coverage of the entire population would be lost. Comparisons of cancer patterns from year to year, or between geographic areas or social groups, would rapidly cease to be reliable.

Even with a small loss of information, the biases introduced would have an immediate distorting effect on, for example, tables showing survival from cancer by Health Authority. Such comparisons would lose validity and credibility.

No country in the world operates an effective population-based cancer registration system in which informed consent is required.

In Germany a requirement for informed consent rapidly led to unacceptable loss of completeness (70% or less) and bias in Hamburg and Saarland. Recovery has been slow, leaving large gaps in data series.

In Hungary, the Personal Data Protection Act stopped cancer registration in 1992. Despite a 1997 ministerial decree on data collection, designed to overcome the constraints of that Act, it took two more years before the cancer registry began operating again.

In contrast, all the Nordic countries operate highly efficient and complete registration systems, backed by legislation, without informed consent

Informed consent would have legal limitations that would reduce its utility.

Consent is likely to be limited in law to release for the purposes that can be specified at the time – it cannot readily apply to questions that will arise later, which is inevitable in research using retrospective records. A consent that is adequately broad for such research is unlikely to be legally acceptable and may mean that worthwhile research will not get done.

Consent is unlikely to have lifetime validity, as required for estimating survival, which requires follow-up until the time of death. In order to maintain existing public health surveillance systems, renewal of consent might therefore need to be sought at every NHS contact. That could never happen sufficiently completely to be useful. In the case of children, consent is initially given by parents. It would not be practicable to go back to the patients when they reach adulthood to seek consent.

The United Kingdom Association of Cancer Registries fully endorses the need for better and more accessible information for cancer patients about the uses that are made of data relating to their illness and plans to work with patient groups to ensure appropriate information is available for all cancer patients at the time of diagnosis.

Cancer registries collate data from multiple sources over long periods of time and it is essential that all information related to an individual is appropriately matched. This requires patient identifiers. In the absence of such cross-checking, patients would be double-counted and analyses would become unreliable.

Cancer registries are, wherever possible, making use of the NHS number for record-matching purposes. This is, however, not a panacea. The NHS number is still frequently missing from NHS records (approximately 50-60% of NHS records currently have the number, private hospitals may not collect it and it is not supplied on death certificates) and occasionally it is wrong. Also the GMC guidance states that a record with NHS number should be regarded as equally identifiable as a record with a name. Unless the NHS number is universally supplied, is totally accurate and can be legally regarded as providing anonymisation, the problems of data release can not be resolved by substituting the number for a name. Even then, anonymisation would not obviate the need to access medical records, for example, to reconcile apparently conflicting information received about an individual.

It should be noted that in New Zealand, despite well developed anonymisation procedures for some health related data the idea of working with anonymised data for cancer registration was thoroughly explored but rejected as unworkable. Legislation was enacted to allow transfers of identifiable data without consent.