NHS Trusts (Data Protection)

Part of the debate – in Westminster Hall at 3:30 pm on 27 April 2004.

Alert me about debates like this

Photo of Mike Gapes Mike Gapes Labour/Co-operative, Ilford South 3:30, 27 April 2004

The Data Protection Act 1998 has been topical over recent months with regard to the sad murders at Soham and the way in which some public authorities, particularly police authorities, seemed to misinterpret it. My purpose today is not to enter a wide debate on the Act, but to focus on it in relation to the role of representatives and Members of Parliament taking up cases on behalf of their constituents. I do so knowing that the issue has been considered in the House before.

A Library standard note on the issue—SN/HA/1936—was published on 4 December 2002. Its first sentence states:

"A number of MPs have reported difficulties in carrying out their constituency duties stemming from the Data Protection Act 1998. The legal issues involved also apply to other elected representatives such as councillors, MEPs, MSPs etc."

The note was produced to try to explain the position in December 2002, before the coming into effect on 17 December 2002 of the Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002. I contend, on the basis of my recent experience, that there are still difficulties, despite the advice given by the Lord Chancellor's Department and despite that order, which came into effect one and a half years ago.

The matter was drawn to my attention as a result of correspondence from my local NHS trust, but, on the basis of e-mails that I received, including from officials in other NHS trusts, after I raised the matter during business questions just before Easter, I suspect that it is a wider issue. Certainly the reaction that I provoked when I raised it in the House suggested that similar issues have been raised with other hon. Members.

Data protection in the NHS does not relate simply to NHS trusts. I will not break the embargo, but I think that I can at least refer to the publication tomorrow of a code of practice by the Healthcare Commission, which is starting a process of public consultation on how it will deal with data protection issues. These matters do, therefore, have wide concurrence at the moment.

I have been a Member of the House for more than 12 years, in which time I have received many representations from my constituents on health-related issues, as do all MPs. The vast majority have been by telephone initially. Many are simply telephone calls from elderly and distraught people or from relatives of such people. Sometimes there are letters, but more often than not there are telephone calls or visits to my advice surgery.

In view of my 12 years' experience, I was surprised in early March to receive a letter from the chief executive of Barking, Havering and Redbridge Hospitals NHS trust—the trust that serves my constituency and covers King George's hospital, Ilford, which is in my constituency. The letter stated:

"As you are aware, we have recently been reviewing the whole of the complaints procedure in order to ensure that we are both responsive to, and learn from, our patients' experience.

As part of this review we have developed a new complaints policy, part of which covers our responsibilities under the Data Protection Act. The Act requires that we seek the permission of the patient, wherever possible, to disclose information of a clinical or personal nature to a third party.

Although I appreciate that by writing or talking to their MP, patients and their relatives are implicitly providing consent, it is important that we as a Trust also have that permission in writing.

I have therefore enclosed a supply of consent forms and would be grateful if you could ask your constituent to complete the form and send it to us with your letter."

That letter, with the consent form, was from the chief executive, Mark Rees, to me and, I presume, to other Members of Parliament in the area, and was dated 9 March. The form is a standard form for consent to access to information and, where necessary, for health care records to be disclosed to relevant personnel.

I thought that the letter raised fundamental questions about the role of elected Members of Parliament. I telephoned the trust immediately on receipt of the letter. I was not able to speak to the chief executive at that time, but spoke to senior officials within the trust, and was informed that there had been discussions among compliance officers in north-east London about how to deal with such matters. I asked if there was any documentation or guidance, and was told that there was none of which the person to whom I spoke was aware. I thought that, in those circumstances, I would write to the chief executive and see where that got me, because I felt that wider issues were raised. I wrote to Mark Rees on 18 March 2004 and pointed out that I had read his letter with considerable concern. I wrote:

"I, of course, accept that in the case of a 'third party' neighbour or friend making representations to Members of Parliament issues of confidentiality and Data Protection can arise. However, in the vast majority of cases, representations are made to me directly by constituents or by a close relative on their behalf.

A considerable number of cases are brought to my attention by individuals or their relatives or friends, who telephone my Office. Your letter to me appears to accept that an elected Member of Parliament is not in the same category as another member of the public to whom provisions of Data Protection procedures might be applied.

Indeed, you state that 'patients and relatives are implicitly providing consent'. You are also aware that a very large number of my constituents do not have English as their first language and find it difficult to give written consent or to write letters in English.

Your letter also appears to be in conflict with the advice to Government Departments issued by the Lord Chancellor's Department which is based on The Data Protection (Processing of Sensitive Personal Data) (Elected Representatives) Order 2002: (SI 2002 No. 2905).

The advice states 'If the elected representative says that he or she is asking for information on behalf of someone else, Departments should normally be able to take the elected representative's word for it. The elected representative may often provide a letter or other form of written 'mandate' from the individual. But there is no requirement for the individual to put the request to the elected representative in writing, and getting a written mandate may not always be possible. For example, in urgent cases the individual's approach to the elected representative may have been made by telephone. If Departments are in particular doubt, they may wish to check the position with the individual.'"

I continued:

"It is not acceptable to me, as a Member of Parliament, to be faced with a bureaucratic obstacle course when I take up cases on behalf of my constituents. I therefore expect that you will modify your policy without delay and clarify to all members of your organisation the correct procedure for responding to representations and letters from myself as a Member of Parliament."

I also gave notice that I intended to raise the matter in the House.

I received a reply to that letter on 26 March, which sought to clarify the trust's position. Mark Rees said:

"I am writing further to your letter and our recent telephone conversation . . . I appreciate your views in this matter and as indicated in my original letter, accept that by talking with or writing directly to you as their MP, constituents are giving their consent.

The area of concern that the Trust has is that if a relative or friend raises issues about individual patient care without that person's knowledge or consent, then the Trust would be in breach of the Data Protection Act.

I can understand that you have a view that the Trust is being overly bureaucratic and therefore we shall take up the responsibility of checking, as necessary, with the patient involved."

I still thought that that response did not entirely meet my concerns, so I sent the correspondence to the Secretary of State for Health in a letter dated 30 March. I shall not quote the letter in full because it repeats many of the things that I said in the earlier correspondence. However, I shall quote one paragraph, in which I made the point that the way in which those matters were being considered undermined my position as an elected Member of Parliament and

"could place a bureaucratic obstacle course in the way of making timely and effective representations to NHS Trusts."

I continued:

"I would therefore be grateful if you could intervene to require the withdrawal of this policy and issue advice to NHS Trusts on the role of Members of Parliament in representing their constituents."

The day after sending that letter to the Secretary of State for Health, I received a further letter from Mark Rees in which he further clarified the trust's position. He wrote:

"The issue you raised with me in relation to the Data Protection Act (Processing of Sensitive Data) (Elected Representatives) Order 2002: (SI 2002 No. 2905) required some clarification with regard to obtaining consent to divulge information to a third party.

In my original letter, I acknowledged that if a complaint is raised with an MP directly by the patient involved, then clearly consent has been obtained.

The area of concern that the Trust has is that if a relative or friend raises issues about individual patient care, without that person's knowledge, or consent, then the Trust would be in breach of the Data Protection Act.

Although I want to avoid excessive bureaucracy at all costs, it is considered best practice for the Trust to obtain the consent of the patient involved wherever possible. Therefore, the Trust undertakes to write to the patient directly. However, I appreciate that you have been supplied with some consent forms, which need only to be used if you are in a position to provide one to the relative or friend, who can then obtain the patient's consent and forward the form to the Trust.

I apologise if this was not made clear in my earlier letter."

It seems, therefore, that there are consent forms but that it is not an absolute requirement to use them. I was still not entirely convinced, so I raised the matter at a meeting with the NHS trust in my constituency on Friday 2 April.

I also raised the matter during business questions in April, just before the House rose for the Easter recess, and will refer to that exchange because I was struck by the reply I received from the Leader of the House. He said:

"The Department of Health and the health service are in a slightly different position, as information held by hospitals about the health of individuals is likely to be held in confidence and disclosure to a third party is governed by the common law of confidence. However, the crucial point for my hon. Friend is that the Department of Health has issued guidance for NHS organisations, including trusts, that they should accept an MP's word, when an MP clearly states that he or she has the patient's consent."—[Hansard, 1 April 2004; Vol. 419, c. 1783.]

I had not seen that NHS guidance; I was working on the information that the Lord Chancellor's Department had given. I therefore asked the House of Commons Library if it could tell me where the NHS guidance was, and whether it was available. The Library was helpful and, eventually, after a few telephone calls, obtained a document called "Confidentiality: NHS Code of Practice", which was published in November 2003. It looked through it—it is a long document. The letter from the Library says that the only reference to Members of Parliament that could be found was in

"annex C, Model B3, Example 13, which is about 'non statutory investigations e.g. Members of Parliament."

This says:

"If an investigation is appropriately authorised, disclosure will meet tests of necessity and appropriateness. The minimum necessary information should be disclosed. There is a balance to be drawn between ensuring that a patient has understood and properly consented to a disclosure of information and needlessly obstructing an investigation. Careful consideration of any written authorisation and prompt action are key, e.g. where an MP states, in writing, that s/he has a patient's consent for disclosure this may be accepted without further resort to the patient."

That is very clear. I find it extremely to difficult to ask where that balance is; and if it is published in the annexe as a footnote to a document, it is not particularly helpful to managers in the NHS trust or to Members of Parliament when they deal with these matters.

My intention in securing this debate was to ask the Minister to clarify the Department of Health's position and the position with regard to data protection and Members of Parliament, and to say in what circumstances information should be given in response to letters or telephone calls from Members of Parliament when those hon. Members do not have written consent. It is not my intention to bother the possibly distressed elderly relatives of people in hospital with serious illnesses who cannot themselves respond to such requests.

Members of Parliament are not third parties; they are representatives of their constituents. We are our constituents' advocates; we are here to represent them and, without going into further detail, I hope that the Data Protection Act 1998, having been misused by police authorities in some circumstances, is not to be used by NHS trusts as an impediment to getting the truth about issues or to hon. Members making effective representations in a timely manner on behalf of our constituents. It is sad that Select Committees have less ability to get information than judicial inquiries and that the Freedom of Information Act 2000 may be a more effective way to get information than representations from Members of Parliament.

I hope that the Department of Health will come up with a clear, explicit, public and understandable explanation so that NHS managers and compliance officers and the trusts' chief executives are put clearly in the picture about the circumstances in which they can release information, and when they will have to think about obtaining written consent from the individual on whose behalf a Member of Parliament or another representative is taking up the matter.