(1)The Medicines and Medical Devices Act 2021 is amended in accordance with subsections (2) to (9).
(2)In Part 2, for the heading of Chapter 1 substitute “Regulations: general”.
(3)After that Chapter insert—
(1)The appropriate authority may by regulations make provision about the establishment and operation by the Health and Social Care Information Centre (“the Information Centre”) of one or more information systems for purposes relating to—
(a)the safety of human medicines, including the safety of clinical decisions relating to human medicines;
(b)the quality and efficacy of human medicines.
(2)The regulations may (among other things) make provision—
(a)about the information in relation to human medicines which may or must be entered or retained in an information system established under subsection (1);
(b)requiring information to be provided to the Information Centre for the purposes of its functions under the regulations;
(c)about the use or disclosure of information contained in an information system established under subsection (1);
(d)requiring the Information Centre to have regard to specified matters in exercising its functions under the regulations.
(3)The provision mentioned in subsection (2)(a) and (b) may relate to—
(a)information for specified purposes,
(b)information that the Information Centre considers it necessary or expedient to have for the purposes of its functions under the regulations,
(c)information (including information relating to individuals) which is of a specified description, or
(d)information (including information relating to individuals) which is of a description set out in a direction in writing given by the appropriate authority.
(4)The provision mentioned in subsection (2)(b) may include provision—
(a)requiring, or enabling the Information Centre to require, specified persons or descriptions of persons to whom subsection (5) applies to provide information to the Information Centre;
(b)about the manner in which, and the time at which, those persons must provide information, or for those matters to be determined by the Information Centre;
(c)about any procedural steps the Information Centre must follow in requiring a person to provide information to it;
(d)requiring specified persons or descriptions of persons to whom subsection (5) applies to record or retain information which they are, or may be, required to provide to the Information Centre under the regulations;
(e)in relation to the enforcement of any requirement imposed by or under the regulations.
(5)This subsection applies to any person who provides services, or exercises any powers or duties, relating to—
(a)human medicines,
(b)health, or
(c)education.
(6)The provision mentioned in subsection (2)(c) may include provision about—
(a)the analysis by the Information Centre of information that is contained in an information system (whether alone or in combination with other information) for the purposes mentioned in subsection (1) or for other purposes;
(b)the publication by the Information Centre of information that is contained in an information system or has been analysed in combination with such information;
(c)the disclosure (other than by way of publication) of information mentioned in paragraph (b) to specified persons or descriptions of persons, or for specified purposes;
(d)the use or further disclosure by any person of information disclosed to them under the regulations.
(7)Regulations conferring on the appropriate authority a power to give a direction by virtue of subsection (3)(d) must —
(a)provide that the power includes power to vary or revoke the directions by a subsequent direction, and
(b)in the case of a power exercisable in relation to Wales or Scotland, require the Secretary of State—
(i)where a proposed direction relates to Wales, to consult the Welsh Ministers before giving it, and
(ii)where a proposed direction relates to Scotland, to consult the Scottish Ministers before giving it.
(8)Where regulations under subsection (1) include provision by virtue of subsection (4)(a) which requires, or enables the Information Centre to require, the provision of individual health information held for the purposes of the health service established under section 1 of the National Health Service (Scotland) Act 1978, the regulations must provide for the information to be collected by the Scottish Ministers, or a person designated by them, on behalf of the Information Centre, subject to specified exceptions.
(9)Regulations by virtue of subsection (8) may—
(a)confer powers or duties (including discretions) on the Scottish Ministers, a designated person or the Information Centre;
(b)provide for powers or duties conferred on the Scottish Ministers to be treated for the purposes of section 2 of the National Health Service (Scotland) Act 1978 as functions relating to the health service (within the meaning of that Act).
(10)Where regulations under subsection (1) include provision by virtue of subsection (4)(a) which requires, or enables the Information Centre to require, the provision of individual health information held for the purposes of the health service in Wales, the regulations must provide for the information to be collected by the Welsh Ministers, or a person designated by them, on behalf of the Information Centre, subject to specified exceptions.
(11)Regulations by virtue of subsection (10) may confer powers or duties (including discretions) on the Welsh Ministers, a designated person or the Information Centre.
(12)Regulations under subsection (1) may provide that the disclosure of information by virtue of this section does not breach—
(a)an obligation of confidence owed by the person making the disclosure, or
(b)any other restriction on the disclosure of the information (however imposed), other than a restriction imposed by the data protection legislation.
(13)In this section—
“data protection legislation” has the meaning given by section 3(9) of the Data Protection Act 2018;
“health service”, in relation to Wales, has the meaning given by section 206(1) of the National Health Service (Wales) Act 2006;
“human medicine” has the same meaning as in Part 2 (see section 9);
“individual health information” means information (however recorded) which relates to—
the physical or mental health or condition of an individual,
the diagnosis of an individual’s condition, or
an individual’s care or treatment,
or is (to any extent) derived directly or indirectly from information relating to any of those matters;
“specified” means specified in regulations under subsection (1).
(1)A person to whom information is disclosed under regulations under section 7A(1) commits an offence if the person uses or discloses that information in contravention of the regulations.
(2)A person guilty of an offence under this section is liable—
(a)on summary conviction in England and Wales, to imprisonment for a term not exceeding 51 weeks, to a fine or to both;
(b)on summary conviction in Scotland or Northern Ireland, to imprisonment for a term not exceeding 6 months, to a fine not exceeding level 5 on the standard scale or to both.
(3)In relation to an offence committed before the coming into force of section 281(5) of the Criminal Justice Act 2003, the reference in subsection (2)(a) to 51 weeks is to be read as a reference to 6 months.”
(4)In section 19 (medical devices: information systems)—
(a)in subsection (6)—
(i)in paragraph (b) for “contained in an information system” substitute “that is contained in an information system or has been analysed in combination with such information”;
(ii)in paragraph (c) for “contained in an information system” substitute “mentioned in paragraph (b)”;
(b)after subsection (7) insert—
“(7A)Regulations under this section may provide that the disclosure of information by virtue of this section does not breach—
(a)an obligation of confidence owed by the person making the disclosure, or
(b)any other restriction on the disclosure of the information (however imposed), other than a restriction imposed by the data protection legislation.”
(5)In section 43 (power to make consequential etc provision)—
(a)in subsection (1), for “This section” substitute “Subsection (2)”;
(b)after subsection (2) insert—
“(3)Provision made by regulations under section 7A or 19 by virtue of subsection (2)(a) may include provision—
(a)changing the territorial extent of provisions of Chapter 2 of Part 9 of the Health and Social Care Act 2012 (constitution and functions etc of the Health and Social Care Information Centre), or
(b)otherwise amending that Chapter.”
(6)In section 44 (scope of powers of Northern Ireland departments) after “2(1)” insert “, 7A(1)”.
(7)In section 45 (consultation)—
(a)after subsection (1) insert—
“(1A)In relation to proposed regulations under section 7A(1), the Secretary of State must—
(a)where the regulations relate to Wales, specifically consult the Welsh Ministers, and
(b)where the regulations relate to Scotland, specifically consult the Scottish Ministers.”;
(b)in subsection (6), for paragraph (a) (but not the “and” at the end) substitute—
“(a)in relation to regulations made under section 2(1) or 7A(1), the appropriate authority within the meaning given by section 2(6),
(aa)in relation to regulations made under section 10(1), the appropriate authority within the meaning given by section 10(6),”.
(8)In section 46 (reporting requirements)—
(a)in subsections (1), (3)(b) and (4)(a), after “2(1),” insert “7A(1),”;
(b)in subsection (5), in paragraphs (a) and (b) of the definition of “relevant authority”, after “2(1)” insert “, 7A(1)”.
(9)In section 47 (procedure for regulations), in subsection (2), after “2(1)” insert “, 7A(1)”.
(10)In section 253 of the Health and Social Care Act 2012 (general duties of Information Centre), after subsection (2) insert—
“(2A)Subsections (1) and (2) do not apply in relation to the functions of the Information Centre by virtue of the Medicines and Medical Devices Act 2021.”