Health and Social Care Committee
Oral evidence: Memorandum of understanding on data-sharing, HC 677
Thursday 15 March 2018
Ordered by the House of Commons to be published on Thursday 15 March 2018.
Members present: Dr Sarah Wollaston (Chair); Luciana Berger; Johnny Mercer; Dr Paul Williams.
Questions 95 - 171
Witnesses
I: Sarah Wilkinson, Chief Executive Officer, NHS Digital; and Noel Gordon, Chair, NHS Digital.
Written evidence from witnesses:
Witnesses: Sarah Wilkinson and Noel Gordon.
Q95 Chair: Good morning. Thank you for coming. This is our second follow-up session on the sharing of data with the Home Office by NHS Digital. Will you introduce yourselves to those following from outside the room, starting with Sarah Wilkinson?
Sarah Wilkinson: Yes, certainly. I am Sarah Wilkinson, chief executive of NHS Digital.
Noel Gordon: I am Noel Gordon, chairman of NHS Digital. For disclosure, I also sit on the board of NHS England and chair the specialised services commissioning committee of the board, which deals with patient care services for minority groups and 141 rare diseases.
Q96 Chair: Thank you. Will you, Noel Gordon, start by explaining why NHS Digital was established as a non-departmental public body so that people who are following this understand what that means?
Noel Gordon: It was established as an ALB and—
Chair: I am sorry, but some people following this will not know what an ALB is.
Noel Gordon: It is an arm’s-length body. It is established as an ALB, as indeed is NHS England. It is independent—designed to be independent under the Act—of Government influence. Although the chair and the board are appointed by the Secretary of State, we are free to make our own judgments and decisions, obviously cognisant of Government policy and of the wishes of Parliament.
Q97 Chair: In other words, it has been specifically established so that you have a degree of independence and can act on behalf of patients in standing up to Government if necessary.
Noel Gordon: Exactly.
Q98 Chair: Right. May I then take you to your duties under section 23 of the Health and Social Care Act—that you have to have regard to the need to respect and promote the privacy of recipients of health services? On your own website you claim, “We are the guardians of patient data, making sure it is protected and handled securely, and only ever used for the good of health and care.” Is that correct? Is that how you see yourselves?
Noel Gordon: That is exactly how we see ourselves.
Q99 Chair: Can you explain how you are having respect to those obligations in regard to patients when you are sharing their addresses with the Home Office?
Noel Gordon: Under the Health and Social Care Act, section 261(5), we also have an obligation to provide, on a lawful and proportionate basis with due respect for confidentiality, information of an administrative kind—which addresses are—to those who seek to pursue criminal offences. The nature of our MOU with the Home Office is indeed lawful in that respect. We regard it as proportionate in that respect and appropriate to comply with section 261(5).
Q100 Chair: The point about that, though, is that it is not an obligation; it is a power. There is a difference between an obligation and a power. It is completely at odds that you have a different standard around the bar for confidentiality than other parts of the health service—and also with the duties of doctors under the General Medical Council. Patients view you as being part of the NHS family.
Noel Gordon: Patients do view us as being part of the NHS family. In fact—
Q101 Chair: In fact, you sit on the NHS England board.
Noel Gordon: By design, I do. Patients do regard us as part of the NHS family. Patients also rely on us 12 times a second, 440 million times a year, to provide transactions, e‑prescribing, information, and to take care of their data. The health and care system would not be as modern as it is today without the infrastructure that we provide.
Q102 Chair: This is not about the infrastructure.
Noel Gordon: With respect to your point, patients trust us to perform our activities under the statute with great resilience and with great confidentiality. Under the MOU we provide lawfully and proportionately the information that is requested of us by the Home Office.
Q103 Chair: In other words, you see yourselves as suppliers of data rather than custodians of data. This cuts to the heart of this issue. You see this as “our duty to supply” rather than “our duty to act on behalf of patients” and understand the ethical principles of confidentiality. Is that not part of the problem?
Noel Gordon: I do not think it is part of the problem. We hold 66 million patient records. We hold them under intense degrees of security. We are a national safe haven. The patient data we hold and the infrastructure we use are national assets, so that when we provide information to the Home Office it is under lawful conditions. We apply it under the discipline of the MOU and we apply a public interest test to the confidentiality and disclosure of the information. In all those respects, the board of NHS Digital has come to the view that our stewardship and custodianship over the information we have is of the absolute, utmost importance.
Chair: I am afraid I do not think you have demonstrated that you understand the ethical principles of confidentiality at all, but I am going to hand over to my colleague Luciana to explore that further.
Q104 Luciana Berger: Why is there a discrepancy between how NHS Digital treats requests for information for immigration enforcement purposes and how it treats requests for information from the police?
Sarah Wilkinson: There are clear processes and guidelines in place for both. We do share data, as you say, with the National Crime Agency and with police forces, and we share address data with the Home Office for immigration enforcement purposes.
Q105 Luciana Berger: There is a distinction, is there not? Do you know what the distinction is?
Sarah Wilkinson: The public interest test that is applied is not the same.
Q106 Luciana Berger: The distinction, according to your own guidance, is that information is only ever released to the police where the alleged crime is serious, such as rape, murder or an offence against children, but immigration offences are not, reasonably, considered to be in the same realms as serious crime. Would you accept that?
Sarah Wilkinson: There is pretty poor clarity of definition about what is or is not serious crime, but I certainly accept that there are significant differences in the codes of confidentiality.
Q107 Luciana Berger: You yourself set out what you consider to be a serious crime.
Sarah Wilkinson: There is no question: the Health and Social Care Act refers to crime and other codes refer to serious crime. That discrepancy is unhelpful, but we refer to the Health and Social Care Act, which, as you know, at section 261(5) does only refer to crime as opposed to serious crime.
Q108 Luciana Berger: Further to the Health and Social Care Act, in 2013 the Health and Social Care Information Centre, which I understand is part of NHS Digital—
Sarah Wilkinson: It is its predecessor.
Q109 Luciana Berger: It is its predecessor—forgive me. The document that it released in the wake of the Health and Social Care Act—“A guide to confidentiality in health and social care”—said, “Where informed consent is not feasible, a legal basis allowing the sharing of confidential information should be explored,” and, “There are a very few limited examples where the individual’s right of confidentiality may be overruled for the ‘public interest’.” That document seems to be in stark contrast—
Chair: It is still current.
Q110 Luciana Berger: It is still current, but it is in stark contrast to the decisions you have made to release information to the Home Office.
Sarah Wilkinson: I do not think it is in contrast to our decision. We have very carefully assessed this particular request for address data- sharing from the Home Office. We have looked, as you know, at the legal gateways. We have looked at the public interest in disclosing versus not disclosing. We do not have any other equivalent data‑sharing arrangements in place.
We have looked extremely carefully at the need to do this. We are very cognisant of the differences in the treatment of the confidentiality of address data in different codes and we think it is quite problematic. We have written, as you know, to the Department of Health and Social Care asking for or recommending clarification on that as a result of the Goddard review. We know that they are looking at the code of confidentiality and we hope that there is a consensus in the system about the treatment of personal demographic data.
In the meantime we have looked at case law. The most pertinent bit of case law was the W, X, Y and Z case, with which you will be familiar, which was about sharing health charging data. The Court of Appeal in that case described a spectrum of confidentiality and talked about address data being at the lower end of the spectrum of confidentiality and being less intrusive. It was on that basis that we made the judgment that it was appropriate to respond to this request.
Q111 Luciana Berger: I have three things in response to what you have said. First, if you had concerns, why would you go for the lowest common denominator and continue to release the information while those investigations were ongoing?
Sarah Wilkinson: It is not the lowest common denominator. It is the law. We have looked to the law and at the case law that exists, and that is the most pertinent piece of case law from the appeal courts.
Q112 Luciana Berger: In fact, we heard from the GMC during the course of this investigation about how the release of address data cannot be seen in isolation from wider patient concerns around confidentiality.
Sarah Wilkinson: That is clearly the BMA’s case. The BMA, I think, would treat address data as a very highly confidential item. There are many codes, as you know, such as the BMA’s. There is a series of codes, some of which treat address data as highly confidential, and some of which barely mention it at all. We think that needs clarifying and are looking for the new work on the code of confidentiality to clarify that. In the meantime we have looked at case law, which is very clear.
Q113 Luciana Berger: I bring you back to the document I referenced before, “A guide to confidentiality in health and social care,” and to one other line in it that again seems to be in stark contrast to what you are saying. It says: “Confidential information can be disclosed to support the detection, investigation and punishment of serious crime and/or to prevent abuse or serious harm to others.”
Sarah Wilkinson: That is clearly a correct statement, but it is not an exclusive statement. We also look to the Act, as I say, which does not have the prerequisite of seriousness associated with crime. We have explained how we have made the judgments. We looked at the Health and Social Care Act and its gateways, and we looked at case law with respect to confidentiality because we felt the large discrepancy in the codes made it very difficult to look at codes.
Q114 Luciana Berger: When the review of the NHS codes of confidentiality is complete, will NHS Digital end information-sharing for immigration enforcement if the conclusion of the review is to maintain the code’s current position on the seriousness threshold?
Sarah Wilkinson: We will obviously look at the code very carefully when it is clarified. We have written again in the last few weeks to the Department to ask that when they review the code of confidentiality they are absolutely explicit about the confidentiality status of personal demographic data, because that needs to be set out very clearly. We will look at what they say about crime and whether they are more explicit about the categories of crime that can be covered.
I do not want to speculate on what the code says as I have not even seen a draft copy of it. I have no idea what it says or what thinking is going into it. We clearly will read it incredibly carefully and, as we have to date, will be very diligent about considering what is appropriate when we have looked at that information.
Q115 Luciana Berger: In the interest of maintaining public confidence, do you not think you should stop until the review of the code of confidentiality is complete?
Sarah Wilkinson: We thought about that very carefully. The analysis done with respect to deciding that it was appropriate to respond to these requests is pretty watertight and clear based on the information we have today—we cannot speculate, we cannot guess at what is going to happen or how the codes might evolve. I can tell you that when we get that new code we will look at it incredibly carefully.
Q116 Luciana Berger: What advice have you received from your independent group advising on the release of data—IGARD—on the practice of data-sharing for immigration enforcement?
Sarah Wilkinson: The IGARD people have not looked at the data-sharing. What they look at for us are the laws and the contractual structures that we need to put in place when data are being shared either with the research communities—the bulk of their work—or with local authorities. They have not looked at any intragovernmental sharing arrangements.
Q117 Luciana Berger: Why not?
Sarah Wilkinson: It is just not in the remit that we set up for them at the moment. The other thing to note is that this was in place before IGARD was put in place and IGARD is not looking back at anything. It already has a huge backlog of work in outstanding requests for research data today, so it does not have time to review historical decisions. As I say, it is not set up to review intragovernmental data‑sharing arrangements.
Q118 Chair: Will you explain what IGARD is, because not everybody following this hearing will know what the organisation does?
Sarah Wilkinson: Of course. It is a group of independent advisers that was set up by NHS Digital to help advise us when we get, as we do quite frequently, requests from the research community—large or small—to access data from the health system to be used in medical research and for similar purposes in local authorities. We go to this independent group of advisers and ask them to have a look at the intended use of that data with respect to legal frameworks and ethics, and to help guide on the conditions we might want to put in place for the use of that data.
Q119 Chair: In other words, they are the ethical advisers, if I am right. You did not involve your ethical advisers in this very important decision.
Sarah Wilkinson: No. They are ethical advisers with respect to the sharing of data with the research community and with local government. Their purview does not cover any of the intragovernmental data sharing.
Q120 Chair: You could have had the option to seek ethical advice. Did you seek ethical advice?
Sarah Wilkinson: We indeed looked very carefully at ethics and we—
Q121 Chair: Did you seek ethical advice—external, specific medical ethical advice?
Sarah Wilkinson: I do not believe that we went specifically to professional medical ethicists, no.
Q122 Chair: May I follow up on this again? Anyone following this will probably take a view that you have taken an entirely process‑driven approach and that you could have taken the opportunity to adopt the higher standard. You say that you think it is problematic that there are different bars, yet, as an organisation charged with safeguarding the interests and confidentiality of patients, the public will see that you have adopted a different standard—the lower standard, rather than opting for the higher standard. Do you see how that is deeply worrying for the public?
Sarah Wilkinson: I do not think it should be deeply worrying and we have looked very carefully at the law—the legal gateways—and at the clear written guidance that is in place that we are mandated to follow. That may sound relatively process-focused, but I would also—
Chair: Entirely.
Sarah Wilkinson: I think people will be confident that we are very diligent in following law and process. I would say as well, as you know, that when the Goddard review was undertaken, surveys were sent to 70 people, of whom 60 responded—my colleague Sir Ian Andrews outlined this last time—so there was a significant amount of input from the community. There were a large number of one‑to‑one interviews, and when the review concluded that went to our board, on which there are four senior clinicians, and it was approved by them. It was also signed, as you know, by three parties, including the Department of Health, so it was not simply a case of ticking boxes.
Q123 Chair: It is the process.
Sarah Wilkinson: It was also consulted on quite extensively.
Q124 Chair: Returning to your website, you say, “We are the guardians of patient data,” including the point that it is “only ever used for the good of health and care.” I am afraid this is not the approach you are taking.
Do you recognise the potential damage this is doing, at a time when we want the public to trust NHS Digital to be making ethical decisions about sharing data for research purposes? That is crucial: we need to bring the public on board so that they understand why it is in everybody’s interests to do that. At the same time, they see the organisation charged with understanding why this matters taking an entirely process‑driven approach to a really serious ethical issue.
Sarah Wilkinson: We take a very rigorous law‑driven approach to what data we can share.
Q125 Chair: “A law‑driven approach,” not an ethics‑driven approach.
Sarah Wilkinson: Law and ethics, and, as I say—
Q126 Chair: Where are the ethics in this?
Sarah Wilkinson: It was the fact that it was consulted on very widely with a large community and reviewed by our board, on which there are four senior clinicians. It was not just a case of following the boxes. We are very, very, very careful in how we handle clinical data. I accept absolutely that you have a concern about where address data is in terms of the confidentiality treatment of it. I appreciate we are not in the same place on that, but we have looked to the law, we have looked to case law and we have sought to follow that carefully.
Q127 Luciana Berger: You have mentioned the consultation that you conducted, and I reflect on the letter received by the Committee in which we were told that there were a number of workshops planned but subsequently cancelled. Did any workshops take place on the consultation process for this decision?
Sarah Wilkinson: There were—as I think my colleague Sir Ian Andrews said last time—a number of cancelled workshops, for which there was a degree of regret. Seventy surveys were sent out and 60 responses were received, and tens of one‑to‑one interviews were conducted. I do not believe the workshops happened, but the consultation was extensive.
Q128 Luciana Berger: How many one‑to‑one meetings took place?
Sarah Wilkinson: I do not know. Do you recall that data, Noel?
Noel Gordon: I do not recall that data, but the attempt to schedule the workshops took place, as you may or may not recall, over the summer. There were a number of interventions that prevented those taking place. Maria Goddard wrote to everybody expressing our apologies for not being able to schedule them, but the intent at the outset in the terms of reference—the scope of the Goddard review—was to consult as widely as we could at the time.
Luciana Berger: Chair, can we request the one‑to‑one meetings?
Chair: Yes.
Noel Gordon: Of course, we will happily provide them.
Q129 Chair: I understand that this was about the wider back-office issues, the national back office review. Did you consult specifically on the practice of data-sharing for immigration purposes?
Noel Gordon: It was in the terms of reference and it—
Q130 Chair: Did you consult on it specifically?
Noel Gordon: Yes, and we got replies that specifically addressed the issue of our disclosure. We addressed those issues in the context of the Goddard report, in three ways: first, by requesting that the memorandum of understanding was put in place, which is a form of service agreement that had not existed before; secondly, that we take advice from PHE on the impact of health‑seeking behaviours; and, thirdly, that the code of confidentiality of the NHS be reviewed again to see whether it could be updated and made more compliant with the legal framework under which we are operating.
Q131 Chair: Further to that point, is it not correct that Public Health England, the National Data Guardian, the General Medical Council, the BMA Medical Ethics Committee—the list goes on—very specifically warned you against this practice and why it could be harmful not only to the individuals but to the wider public good?
Noel Gordon: We obviously have listened carefully to the NGOs who presented evidence to you last time.
Q132 Chair: But you did not meet them.
Noel Gordon: We met them in the course of the back office review and we certainly get representations from medConfidential, for example, on many issues. I met and meet medConfidential, among others, on several occasions. Our position is—and in fact if you think about the NHS, as you will know better than me, over the last 20 years—the NHS does not make policy on the basis of anecdotal data.
We have argued repeatedly that the science behind the presentations and the evidence is poor. It is bad science. Actually, over time we have sought with tremendous effort to get better evidence of the impact of our policy on health‑seeking behaviours, but that science is not there. If you refer to the evidence that was presented last time based on US data, it is not only ambiguous but it implies that the complex process of health‑seeking behaviours is influenced by factors that are entirely outside the issue of releasing their location and address, so while we sit in—
Chair: Paul has a follow‑up point, I am sorry.
Q133 Dr Williams: When you were conducting the public interest test—you say you are asking for a higher degree of evidence around the effective harm to public health and behaviour—did you require statistical evidence of the harm to public services and of the adverse economic effects of uncontrolled immigration to the same degree as you require that statistical evidence around harm to public health?
Noel Gordon: We are completely open minded about the research conclusions that will come from the PHE—
Q134 Dr Williams: Did you require that information—
Noel Gordon: Being totally open minded about new evidence, we will take into account all new evidence. If PHE includes in its terms of reference the inclusion of the impact on economic behaviour or economic consequences as well as the impact on the cost to the health service of health‑seeking behaviours, of course we will take that into account.
Q135 Dr Williams: You have made the case that this is legal, and I think we accept that it is not a legal requirement for you to give the information but that you are able to give the information legally. What we are talking about here is proportionality.
Noel Gordon: Indeed.
Q136 Dr Williams: You have conducted this test and said you have not accepted the evidence that has been presented around the harm to public health. My question is that you have not even looked at the evidence around harm to public confidence in maintaining a robust immigration system, so you are asking for a high degree of evidence around the harm to public health but you have not even looked at the evidence around immigration.
Noel Gordon: Around the trust issue?
Dr Williams: Yes.
Noel Gordon: I disagree. I think we take into account and hold in incredibly high regard the public’s belief that the NHS holds their data confidentially. I totally believe that. I believe we have built an organisation in NHS Digital that places that principle at the absolute highest.
Chair: I am afraid you have shown that you do not, but I am going to come to Johnny now.
Q137 Johnny Mercer: I am slightly perplexed by some of this. Are you concerned that everybody else is on the other side of the argument to you? Do you see any of the points that have been raised that you think are valid, or do you just think we are slightly missing the point?
Noel Gordon: We have complete respect for the positions that are taken on the basis of situational cases that have identified that health‑seeking behaviour is dysfunctional as a result of our policy—so we hear it; we are not deaf and we are not blind. I deal every month in specialised commissioning in NHS England with equally complex cases of individuals in rare diseases in minority groups who seek different services from the NHS, or different access or different drugs. These are incredibly complex judgments to make and I do not for one moment—
Q138 Johnny Mercer: But there are fundamental principles that underpin them, are there not?
Noel Gordon: There are fundamental legal principles that underpin them and—
Q139 Johnny Mercer: And ethical principles.
Noel Gordon: Our job is to apply a public interest test that balances the judgment in a very complex set of factors.
Q140 Johnny Mercer: In fact, when you make that very public balanced judgment and everybody else is on the other side, does it not make you think, “We need to double check we have got this right. We should perhaps look at evidence more closely”?
Noel Gordon: To repeat myself, we do—
Johnny Mercer: You do not need to repeat yourself.
Noel Gordon: We do want more evidence.
Q141 Johnny Mercer: Do you share information with the Department for Work and Pensions as well?
Noel Gordon: No.
Q142 Johnny Mercer: You have never shared any data with the Department for Work and Pensions as NHS Digital.
Sarah Wilkinson: As far as I am aware, no.
Noel Gordon: No. I think if it resulted from a serious crime and there was a request from the police or the National Crime Agency—
Q143 Johnny Mercer: What about the Department for Education?
Noel Gordon: No.
Q144 Johnny Mercer: No? Would you agree with Ministers who say that a person using the NHS cannot have a reasonable expectation when using this taxpayer‑funded service that their non‑medical data, which lies at the lower end of the privacy spectrum, will not be shared securely between other offices within Government?
Sarah Wilkinson: That is a policy statement that has been extracted from the Minister’s letter. As I say, we are simply looking at the moment at the legal gateways and the case law.
Q145 Johnny Mercer: What do you mean by “that is a policy statement”?
Sarah Wilkinson: The “expectation of an individual” part of it, I suppose, which you are highlighting.
Q146 Johnny Mercer: Is it not fair for an individual in this country to seek help from the NHS and not expect information at the lower end of their privacy data to be shared? Is that not reasonable?
Sarah Wilkinson: As you can see from the Minister’s letter, the Government position is that there is not a reasonable expectation. From our perspective, we have put on our fair processing notice that we may share address data with the Home Office for immigration enforcement tracing purposes, so we have sought to be completely transparent about the potential use of the data.
Q147 Johnny Mercer: Do you personally think that is right? If that is going to reduce people’s willingness to access healthcare, do you personally think that is right?
Sarah Wilkinson: We do not have empirical evidence that says that this will impact people’s use of the health system. Let us be clear that this data-sharing impacts a very specific set of the population. They are individuals who have been previously in contact with immigration enforcement, were communicating with them, whose immigration status is under assessment, who were aware of the duty to remain in contact and who are no longer in contact. It is a very small, set community of people.
Q148 Johnny Mercer: Right. You simply have not seen the evidence that sharing data with immigration services reduces access or willingness to seek healthcare treatments among some of our minority communities.
Sarah Wilkinson: Clearly, you have seen lots of anecdotal evidence that those communities of individuals will be deterred in some way from seeking healthcare.
Q149 Johnny Mercer: What would that empirical evidence look like to you? What would be good enough for you to have a look at it and think—
Sarah Wilkinson: We would not necessarily need to pick over the maths, but if Public Health England said quite clearly that it thought this data‑sharing arrangement was specifically impairing the behaviours of the small community at which it is targeted, that would be a significant concern to us. When it produces its research, absolutely, we will look at it in great detail.
Chair: But it has asked you to stop.
Q150 Luciana Berger: I would like to give a very practical example—an extension of Johnny’s question. I received representations to let me know that, as a result of the Home Office securing information via NHS Digital, a deportation notice was sent to a GP to pass on to a highly vulnerable patient. Do you think that is acceptable?
Sarah Wilkinson: We are not part of the Home Office. We have nothing to do with how the Home Office handles this.
Q151 Luciana Berger: No, but, as a consequence of you releasing that data, you have to take some responsibility for what then happens with it.
Sarah Wilkinson: I know nothing of the case that you are talking about, I am afraid.
Q152 Luciana Berger: Whether or not you know about it, I am telling you it happened, so, on that basis, do you think that is appropriate?
Sarah Wilkinson: I am afraid I really cannot comment on what the Home Office do. I do not know enough contextually about that case or the way immigration enforcement works to be able to make a comment on it.
Q153 Chair: This is dismal. You have been told very clearly by Public Health England that there is a risk. Why would you not apply a precautionary principle and at least suspend data-sharing until it has completed its review? You have established that it is perfectly within your powers. You do not have a legal obligation: you have a legal power to share this, but it does not necessarily mean it is the right thing to do.
As I say, you are an organisation that the public need to have absolute confidence will respect and understand the ethical principles behind data-sharing. You have not shown us at all that this is part of what you are considering. It is an entirely process‑driven approach that you are taking as an organisation. It is simply not good enough.
Sarah Wilkinson: We have not been told clearly by Public Health England that this data-sharing impacts communities’ health‑seeking behaviour. Duncan Selbie’s last letter to you says: “Whilst there is a wealth of statistical evidence about migrant health behaviours there is no robust statistical evidence about the impact of knowledge of data sharing on deterring immigrants from accessing health treatment.” We do not have clear guidelines.
Q154 Chair: Are you saying to me that Public Health England told you it thought it was a good thing for you to continue data-sharing, or was there advice that there was danger?
Sarah Wilkinson: No, it did not. It said it was conducting research and would let us know when the research was completed. The very fact that it has accepted the research mandate and says that it will take two years to conduct that research suggests to me that this is far from absolutely clearcut in its mind.
Q155 Chair: You do not think that you should apply the precautionary principle and listen to the very serious concerns that have been raised with you, including by the National Data Guardian and medical ethicists, about the approach you are taking.
Sarah Wilkinson: We will look at the evidence when we have clear empirical evidence. The guidance we have from Public Health England is that there is not yet “robust statistical evidence,” to quote Duncan Selbie’s letter, and that it will be conducting a two‑year research project after which it will report, and we will consider that carefully.
Q156 Chair: The nub of this, as I see it, is the point that Johnny has raised with you from the Minister’s letter, where it says that a person using the NHS cannot have a reasonable expectation when using a taxpayer‑funded service that their non‑medical data, which lies at the lower end of the privacy spectrum, will not be shared securely between other offices within Government. In other words, where do we go next? What happens when people start asking you, because it might be a criminal offence, about whether people are cohabiting? What if the DWP starts approaching you to ask for that data? Having established and said that this is all right, how can the public have confidence that you will not start telling them addresses if it is wanting to look at benefit fraud?
Sarah Wilkinson: Let me first say that I very much hope that the work being done on the code of confidentiality makes it extremely clear, by achieving consensus in the system, what the confidentiality status of address data and personal demographic data is. That is enormously important.
Q157 Chair: In other words, if they decide that that is at the lower end of the spectrum for everything, you will start handing over to other Government agencies, will you?
Sarah Wilkinson: No. If we were in receipt of requests for data-sharing for other governmental purposes, which we are not, we would go through the same rigorous assessment, and the factors would doubtless be significantly different. We would have to—
Q158 Chair: Or not rigorous assessment, as the case may be.
You sent us a copy of a public attitudes survey you have done on whether the public view their address as being confidential. It is pretty clear that the public think it is important that you view their address data as confidential, but then you go on and ask them about whether they think that sharing it for immigration offenders is okay: you ask about whether it would be okay for people that some of the public do not like, but then you specifically ask about other things, such as tax evasion and benefit fraud. You are clearly thinking that this might be the next stage because you are actually surveying people about it.
Sarah Wilkinson: No. As you know, we undertook that survey with Ipsos MORI in an attempt to clarify our understanding of public opinion. When asking the public if they thought it was acceptable to share address data for immigration enforcement—and, as you can see, 71% of them were in favour of that—we tried to set it against something lighter and something heavier, if you like, so we asked the public what their opinion was of sharing address data for serious crime and whether they thought it would be reasonable to share address data across Government for other crimes, just as reference points in the survey—that is all.
Q159 Chair: Yes, but it is pretty concerning for the public, given the Minister’s view about this. Does the fact that 96% of the public feel that the NHS should treat their address details as confidential register?
Sarah Wilkinson: It does register. Those survey results, as you know, came in on Tuesday so we are still chewing them over, but I would say that it has never been more important that we clarify the confidentiality status of address data in the health system.
Q160 Dr Williams: I have worked and still work as a clinician within the health service. Mr Gordon, clinicians understand that their code of conduct from the GMC does not distinguish between clinical and demographic information. Clinicians’ understanding, at the moment, is that any information given to them by a patient should be treated under the code of confidentiality. In practice, that information is not being dealt with according to the same code of confidentiality, so what advice would you give to clinicians about what they should inform their patients so that this information is classed “with consent”?
Noel Gordon: I think Lord O’Shaughnessy answered that question last time round. I do not have a view on what advice an individual general practitioner should give an individual patient. I do know, first, that we do not give patient data away to anyone; secondly, we have put in place significant safeguards over the control of the data we hold, and indeed the release of the data that we hold; thirdly, I think it would be unusual if we were requested by another Government Department to follow the process that we have adopted with the Home Office for immigration offences; fourthly, we have had no requests as such and we do not expect requests as such to come from other Departments that might require us to put in place a similar arrangement to the one we have today.
Q161 Dr Williams: We are coming back to proportionality here. Who has made the decision that immigration offences are on the same side as rape, murder and offences against children and that other offences do not meet that proportionate threshold?
Noel Gordon: With respect to the judgment we have to make, which is fundamental to the PIT—public interest test—we had to take account of factors that favoured disclosure and factors that favoured non‑disclosure, and in the public interest test that we apply we take account of, first, Parliament’s intention to control immigration offences. It is very clearly stated as a parliamentary intention to do so.
Q162 Dr Williams: Tax evasion and avoidance and benefit fraud have been clearly stated as well.
Noel Gordon: Secondly, we have to take into account on the other side the risks to patient confidentiality and we have a complex public interest test, which we offered to share with you on a private basis last evening.
Q163 Chair: Excuse me, but that was yesterday; that is not sufficient. How can we examine a document of that complexity the night before? As I have made clear to you, it is a decision for the whole Committee as to whether to make it public, but we will come on to the public interest test and this rather sorry late offer. I am sorry, Paul, I interrupted you.
Noel Gordon: I was going to apologise for the lateness of the offer of the public interest test, but, as you know, we are now subject to judicial review and the legal advice we obtained over the course of the last 48 hours indicated to us that we would be putting the organisation in harm’s way by providing you with a public interest test that was subject to public disclosure. The position is—I apologise—that it arrived late. We could not get to you earlier. On the basis that it would have been held confidential by the Committee, we would have been happy to provide it. The judgment is embedded in the public interest test.
Q164 Dr Williams: That judgment was made by the board of NHS Digital.
Noel Gordon: It followed from the Goddard review, which was a board review, as a principal recommendation that we build a public interest test. The judgment that is made on the factors in favour of disclosure and the factors against disclosure are the consequence of our own internal governance and, in fact, our own information governance process, which led to a balanced test. The result of the balanced test is that we came down in favour of disclosure. If new evidence emerges from the actions that are being taken, we will be open minded about how that public interest test needs to be revised, and we have stated that very clearly.
Q165 Dr Williams: Were senior clinicians involved in applying that public interest test?
Noel Gordon: The head of our information governance division team, which defines public interest tests for many other purposes—mostly to do with FOI releases—is a senior clinician. He is a gerontologist but he is also our Caldicott guardian, and he heads up the clinical information governance team, so that has gone through a process of our own internal information governance, which is dominated by a clinical view.
Q166 Dr Williams: You talk about the robust statistical evidence that you require around deterrence to health‑seeking behaviour that you seemingly do not necessarily require around the effects of uncontrolled immigration, but I think we need to acknowledge that there is an inherent difficulty in collecting that robust statistical evidence. You are talking about a population who, by their very nature, are undocumented and among whom, as a result of the changes that have been made—people do know about this on the street; there is awareness among this small population group—there is awareness and a real reticence. We have heard not just anecdotes but a collection of anecdotes, which, when you bring them together, become evidence that health‑seeking behaviour—we heard it very clearly—has changed as a result of this.
The great difficulty, though, is that getting robust statistical evidence for such a group of people who are undocumented is probably a test that is not going to be met. What would persuade you that the public interest test was not being met in this case?
Sarah Wilkinson: It is really important that we clarify something. This is not a population of undocumented migrants. By their very nature, they are documented. They are people who have been in contact with immigration enforcement, whose immigration status has been discussed with them, who have had a duty to remain in contact with immigration enforcement and who are no longer in contact with immigration enforcement.
The Home Office has been seeking them for a period of typically more than six months and has looked at a lot of other datasets to see if they can find out where they live, and they come to us as a last resort to ask us for the address information. We are not scanning the country for undocumented migrants.
Q167 Dr Williams: They were documented by the Home Office.
Sarah Wilkinson: They are documented; it is just that their address is not.
Q168 Dr Williams: I do not think that the average person in that position understands the distinction between Public Health England, NHS Digital and the Home Office. If a Government arm’s-length body is seeking information from them, as Public Health England is going to have to do, it is going to resist giving that information to Public Health England in the same way as it is going to resist giving information to the Home Office. I think it is going to be almost impossible for Public Health England to do the job that it has been tasked with doing, so I will come back to you and ask: what evidence of harm do you need to be able to see what we have all clearly seen—that health‑seeking behaviour is being deterred as a result of this?
Sarah Wilkinson: I accept your logical argument that if people are seeking to hide from authorities it might be hard to find them for research purposes. I do not dispute that. Public Health England has accepted the research mandate. I do not know how it intends to go about this. I cannot comment on that, but it has accepted the research mandate and it has said it is going to seek evidence about how those communities are reacting. I do not know that I can help any more than that.
Noel Gordon: May I come back on your central contention, because I think it is the important one, which is the extent to which people are being harmed, because that is, ultimately, the core purpose that we are debating? First, nobody is refused, as you know, access to a GP, A&E or a walk‑in clinic by virtue of their legal or illegal status. It is not within the NHS’s ability to deny them that access.
Secondly, I totally recognise the complexity of performing research in this area; you just have to look at the US peer group analysis of the studies. I totally get that, and we find that frequently in specialised commissioning with very small populations, which in themselves are disadvantaged through various degrees of access to services. I totally understand that.
The point we need proven is that there is sufficient burden of proof in the PHE conclusions that leads us to a robust, defensible and sustainable conclusion. I do not expect—and I do not think anybody does—that there is overwhelming, 100% pure science here, because there is not and we would not expect there to be. But there needs to be sufficient burden of proof emerging from the PHE work that says, by disentangling a variety of factors, what might cause health‑seeking behaviour, one of which, from the US evidence, suggests it might be their location data, but there are other factors in the US research that have nothing to do with location factors, including access to services.
We hope it will disentangle the causality. We hope it will show a reasonable burden of proof. We hope the evidence will be clear. The fact they are taking 12 to 14 months to deliver this research, even with the commitment that John Newton gave you last time to give you an early view of the report in November—I totally get the point: this is complex.
Q169 Chair: May I point out, going back to an earlier point that was made, that the conclusions of the Public Health England evidence say: “In summary, it is the opinion of PHE that sharing demographic data from health records to facilitate the tracing of individuals in relation to possible immigration offences is concerning from a public health and personal healthcare perspective”? That seems pretty clear to me. That is the conclusion: it is concerning. Would you not therefore want to apply the precautionary principle?
Noel Gordon: May I come back to you also, Chair, with a quote from John Newton at his evidence last time: “As we have tried to make clear in our evidence, it is difficult to identify the specific effect of confidentiality concerns, let alone the specific effect of confidentiality concerns about” the agreement in question?
Q170 Chair: Exactly, so why are you not applying the precautionary principle? This is what I come back to again and again—that the public trust you to be guardians of their data. They would assume that you apply the precautionary principle on their behalf, but you seem to be taking an entirely process‑driven approach—“we cannot be blamed because we are acting within the law”—rather than considering whether you should be doing it, not whether you can and legally can.
The other thing I want to come back to is a point you made earlier where you said that one reason why you are not going to disclose the public interest test that you applied is that “it would be putting our organisation in harm’s way.” Should that not be ringing alarm bells? If what it contains is likely to be damaging to you as an organisation, why should we not expect, as an absolute right, that you would want to be transparent and allow the other side to have access to that in the run‑up to the court case? It is not about protecting your organisation. We are talking about the interests of patients here.
Noel Gordon: I am sorry. My reference was in the context of legal advice we had received about disclosing, before it is disclosed to the court, which it will be in our submission, data and evidence prematurely to this Committee, which would then make it public, evidence that would compromise our legal position. It is not about putting the organisation in a position of transparency and therefore harm from transparency. It is purely a technical legal issue.
Q171 Chair: It is a technical legal issue, but I see no reason why you would not wish to be transparent in discussing why you have taken the position you have, and having the detailed evidence available to all sides at an early stage. If you say you are going to have to disclose it in the run‑up to the court, why not make it disclosable now so that we can all see it?
Noel Gordon: I refer to my earlier answer. We obtained legal advice that discouraged us from doing that.
Chair: I am not surprised. I have finished my questions. Do colleagues have any other points they would like to make? Thank you for coming this morning. We will be producing a report.