Section 2 – Consistent identifiers
7.This section amends Part 9 of the Health and Social Care Act 2012 (‘HSCA 2012’) which enables the Secretary of State or the NHS Commissioning Board to set information standards for health and adult social care services in England; and which establishes the Health and Social Care Information Centre. This section inserts new section 251A (consistent identifiers) into Part 9 of the HSCA 2012.
8.Subsection (1) of section 251A imposes a duty on the Secretary of State to make regulations specifying a description of consistent identifier.
9.Subsection (2) defines a consistent identifier as any identifier such as, for example, a number or code used for identification purposes, that relates to an individual and forms part of a set of similar identifiers that is of general application. An example of a consistent identifier that meets these criteria which the Secretary of State may specify in regulations is the NHS number.
10.Subsection (3) sets out the conditions which must be met before the duty in subsection (4) applies. There are two conditions: (a) a ‘relevant person’ (i.e. a ‘relevant health or adult social care commissioner or provider’ as defined in new section 251C(2) of the HSCA 2012, inserted by section 4) processes information about that individual; and (b) a consistent identifier of the description specified under subsection (1) relates to a particular individual. An effect of condition (b) is that if a description of consistent identifier, for example the NHS number, has been specified in regulations but there is no such identifier in respect of a particular individual, for example that individual does not have a NHS number, then the duty in subsection (4) will not apply.
11.Subsection (4) sets out the new duty in respect of a consistent identifier specified in regulations. The duty is imposed on the relevant person, who must include the consistent identifier when processing the information. The duty applies whether the processing is internal record keeping, disclosure to another relevant health or social care commissioner or provider, or anything else recognised as ‘processing’ under the Data Protection Act 1998 (‘DPA’).
12.Subsections (5) to (8) set out qualifications to the duty in subsection (4) above.
13.Subsection (5) provides that the duty only applies so far as the relevant person considers that the inclusion is (a) likely to facilitate the provision to the individual of health services or adult social care in England, and (b) in the individual’s best interests. New section 251C(5) expands upon the provision in (a). The term ‘best interests’ in subsection (5)(b) bears its ordinary meaning, and is not to be construed in accordance with section 4 of the Mental Capacity Act 2005, which provides for what is in a person’s best interests for the purposes of that Act.
14.Subsection (6) provides for certain criteria which, if any apply, mean the relevant person need not comply with the new duty. The criteria are: (a) the relevant person does not know the consistent identifier and is not reasonably able to learn it; (b) the individual objects, or would be likely to object, to the inclusion of the consistent identifier in the information; (c) the information concerns, or is connected with, the provision of health services or adult social care by an ‘anonymous access provider’ (as defined in new section 251C(6)); (d) for any other reason the relevant person is not reasonably able, or should not be required, to comply with the new duty. The effect of criterion (a) is that where the relevant person does not know the individual’s consistent identifier (as specified in regulations) and has taken reasonable steps to find it out, such that the relevant person is not reasonably able to learn it, then the duty will not apply. Criterion (c) , interpreted in light of section 251C(6), will apply where the individual is receiving health or adult social care services anonymously, whether from the ‘relevant person’ or another commissioner or provider, for example services relating to sexual health or any other sensitive services. The effect of criterion (d) is that if, for any other reason, the relevant person is not reasonably able, or should not be required, to comply with the duty, then the duty will not apply. Other reasons may include where the cost of compliance for the relevant person would be too burdensome or disproportionately high. For example, some small or voluntary organisations may not have the capacity or infrastructure to comply with this duty, in which case they should not be required to comply with it.
15.Subsection (7) means that the relevant person must still comply with any applicable provisions of the DPA and with any common law duty of care or confidence, and that this section does not permit doing anything inconsistent with the DPA or those common law duties.
16.Subsection (8) means that if the relevant person would be required to do anything under subsection (4) which they are already required to do under a contract by virtue of any provision of the National Health Service Act 2006, then the requirement under subsection (4) does not arise. This is for clarity and certainty as to the legal basis of certain obligations and to avoid any unnecessary duplication of obligations. For example, paragraph 74B of Schedule 6 to the National Health Service (General Medical Services Contracts) Regulations 2004 (S.I. 2004/291), as amended by the National Health Service (General Medical Services Contracts and Personal Medical Services Agreements) Amendment Regulations 2014 (S.I. 2014/ 465), inserts contractual terms which require general practitioners to use NHS numbers in clinical correspondence relating to patients. The effect of subsection (8) is that the requirement on GPs to use the NHS number in clinical correspondences arises out of their contracts, not the new duty in subsection (4).
