Oral evidence: Care.data database, HC 1105Tuesday 25 February 2014

Oral evidence, 25 February 2014.

Witnesses

Dr Daniel Poulter MP, Parliamentary Under-Secretary of State for Health, Tim Kelsey, National Director for Patients and Information, NHS England, and Max Jones, Director of Information and Data Services, Health and Social Care Information Centre, gave evidence.

Chair

Minister, you don’t need any introduction to most members of this Committee because you were once, not very long ago, a member of it, but could I ask you to introduce your two colleagues, please?

Dr Poulter

Yes, certainly. We have Max Jones from the Health and Social Care Information Centre and Tim Kelsey from NHS England.

Chair

Thank you very much. Could I begin by referring back to the session we have just had where we had representatives of those who have expressed serious concerns about the conduct of the care.data programme, the chairman of the BMA GP committee and also two representatives of medical research charities? I think the striking thing was that all five witnesses said that they were in favour in principle of better handling of data and the use of data for research, and indeed improved patient care, which was perhaps the theme that was under-represented in that panel, but all five were in varying degrees critical of the way the care.data programme had been handled, and all five argued that it needed to be rewired to a greater or lesser degree—in most cases a greater degree. Do you agree with that analysis?

Dr Poulter

In terms of the way that the programme has been communicated, I will leave that to Tim Kelsey from NHS England to talk you through, but it is undoubtedly the case that this is a positive programme. It is one that, as you have outlined, Chair, has huge benefits, if we can link data effectively, in better helping us to understand how to integrate and join up the health and care system. It helps us to understand the basis of illness and disease processes much more effectively, not just in designing and improving care pathways in conditions like coronary and chronic obstructive pulmonary disease, heart disease, but also in getting a better understanding about the effects of medications and the damage that can be caused by various toxins to the system. There is no doubt that we would have known much more about the dangers of smoking and the like if we had had better joined‑up data in the first place.

Chair

Could I interrupt you because I think we need to get into the heart of this? Exactly the same case was made by Sharmila Nebhrajani from the Association of Medical Research Charities. Exactly the same argument was made, but it was she who said that the programme is flawed because there is no definition of who the legitimate users are, there is no definition of what the safeguards are that patients should be able to rely upon, and there is no legal foundation for the right of a patient to withdraw from the programme. So it is the definition of the safeguards that is in danger of derailing exactly the objective that you and I think the majority of people probably would share.

Dr Poulter

I don’t agree with the analysis that has been put across. A lot of it has been perhaps down to the more recent issues to do with how perhaps the message has been communicated, and I hope that today we will be able to bring some reassurance about this matter. The basis for the information centre in this is in the Health and Social Care Act, as we are all aware. There is a statutory basis for it, and safeguards for the use of information have been strengthened by that Act to make sure that information is used when it is used for the benefit of the health and care system. There are also requirements on the Health and Social Care Information Centre in sections 263, 264 and 265 of the Act to have rigorous processes in place for ensuring that data is used in the right way.

Rosie Cooper

So why do you sell it to insurers? Don’t make statements and have no evidence base to them.

Dr Poulter

The safeguards that are in place in the Act mean that the data can only be used for the benefit of the health and care system.

Rosie Cooper

So why did you sell it to insurers?

Chair

One by one. I will come to that point.

Dr Poulter

In terms of where we actually are with how those safeguards are, they have been put in place by the Act, which means that the Health and Social Care Information Centre is run with much stricter—

Rosie Cooper

Who is getting sacked for selling it to insurers then?

Dr Poulter

Let me finish. The Health and Social Care Information Centre has much stronger safeguards in place than the NHS Information Centre did, which was the predecessor body, because of the 2012 Act. I have tried to outline to you some of the safeguards in there and I was interrupted in the process. For example, there needs to be a code of practice set forward by the Health and Social Care Information Centre on making sure that information is kept. Confidentiality, I think, is under section 263 of the Act. There also need to be regular updates. These are new things that are in place that were not there before, and there are much stronger safeguards in place under that Act, and making sure that for the first time information that is used can only be used if it is being used—

Rosie Cooper

By health insurers.

Dr Poulter

No, for the benefits of the health and care system, except under very specific statutory exceptions, of which that would not be recognised as one.

Charlotte Leslie

Might I come in? You have mentioned section 263 of the Health and Social Care Act quite a bit and talked about the safeguards of the HSCIC. As you will know, under section 263, the HSCIC are required to publish a code of practice. You would have thought when you are embarking upon something that is quite risky in terms of patient confidentiality that you would have made sure this code of practice was in place before you embarked on the system. But, as you will know if you have read section 263, it requires that, and there is no code of practice. Can you tell us why there is no code of practice and when there will be a code of practice? If you can’t give me specific dates, could you possibly write to the Committee?

Dr Poulter

Mr Jones can talk you through the process in place, but the fact of the matter here is that this is not a revolutionary sudden change in the way the data is being used. In 1989 we had hospital inpatient data being put forward—

Charlotte Leslie

With respect, you are not answering my question, Minister.

Dr Poulter

In 2003 there was the use of outpatient data. In 2007‑08 was A and E data, and now we are going to be putting together general practice data into the mix.

Rosie Cooper

Were you listening before because it would help?

Charlotte Leslie

It is a shame you were not here for the previous session because you would have heard some of the concerns. Basically, the session was about all the questions that have not been answered before this scheme has actually rolled out. So it seems to have been done the wrong way round. One of the things that a code of practice would have answered is most of the questions that came out of the last session, so I repeat—

Andrew George

I suggest we let Mr Jones answer that.

Charlotte Leslie

Why have we not got a code of practice?

Dr Poulter

I am coming to that and Mr Jones will cover this. This is a body that has been in place as a new body for less than a year. It has been in place for 10 months. As that body, they have then taken on board as part of evolutionary development, and the move from being what was previously the NHS Information Centre, into the Health and Social Care Information Centre, additional responsibilities, some of which are coming in towards the end of the year. In terms of developing the code of practice, it needs to reflect how this new data will be used in the system.

Charlotte Leslie

But most people would have thought that you would develop a code of practice and develop your mechanisms before you switch the machine on. It seems like you have a half‑built machine, but you have switched the machine on, and, of course, the product that comes out is very flawed and is alarming a lot of people.

Chair

Shall we let Max Jones answer that question?

Charlotte Leslie

Of course, sorry.

Max Jones

Can I take you through some of the very helpful steps we have taken that can reassure you about the seriousness with which we take the obligation to control access to this data and to protect it? We have implemented processes for controlling access in line with the ICO’s code of practice on anonymisation and the Data Protection Act and, as the Minister said, the Health and Social Care Act. Access is very clearly, under the Health and Social Care Act, dependent upon the purpose for which you wish to use it. That is a fundamental shift in the way in which information access is controlled. So we need to have reassurance that the purpose for which this information is being used is to support the better implementation of health and social care. We also need to make sure that only the minimum amount of information is released for the purpose which is approved, and specifically for care.data the only purposes which are approved are for commissioning. That is a very significant further clarification that we have in respect of the care.data programme. In addition, there are two categories of information, both de‑identified and personal confidential information. For personal confidential information, we would require specific patient consent, or a section 251 exemption, or in the case of a public emergency.

Chair

So is it untrue that this information has been sold to an insurance company, to take Rosie Cooper’s point?

Max Jones

It is indeed untrue. If you are referring to the recent press—

Rosie Cooper

Are you suing The Daily Telegraph then? Are you going to the press complaints or whatever it is these days? Are you going to sit there and—

Max Jones

There has been a variety, I think, of misrepresentation of the facts, and if I can help to set some of those out then I will. As a public sector organisation, the Health and Social Care Information Centre does not seek to make a profit from selling data. It operates on a cost‑recovery basis only. We did release some data to the Institute and Faculty of Actuaries, which is a not‑for‑profit organisation—

Rosie Cooper

That is all right then.

Max Jones

—but that information was released by the predecessor organisation prior to the current statutory controls in place. It was not released by the Health and Social Care Information Centre.

Rosie Cooper

So who would get fired for this?

Barbara Keeley

Before you leave the point, Chair, could I ask for a point of clarification? You are talking about non‑profit organisations. Is it just that all industries like the insurance, pharmaceutical or life sciences industry—to take examples that are involved—have to do is set up a non‑profit body of some sort to be the front, and then you will say, “This is a non‑profit body. I can let them have this patient data for a very cheap price”?

Max Jones

Absolutely that is not what I am saying. I am saying that this was approved prior to the Health and Social Care Act being in place and prior to the existing organisation, the Health and Social Care Information Centre, had been formed.

Chair

So it would not be approved now.

Max Jones

Today this would not be approved because it does not meet the criteria for the benefit—[Interruption]

Chair

We will let Charlotte finish.

Charlotte Leslie

I am just conscious that this is a very key point. What you have told us is very interesting but you have not answered my initial question, which is why you have not published a code of practice within which this would have been published, and a lot of the questions that were raised in the last session would not have needed to arise. Why haven’t you, and when will you, because it is in section 263 of the Health and Social Care Act? Of course, if you had published a code of practice, what you are about to tell me about how things have changed would be set out because it is not clear exactly how things have changed. No rules and regulations are pointed to. If you had published that code of practice, everything that we are talking about here would have been set out. So I will just ask one more time and I want a yes and a no and/or a date. Why have you not published the code of practice and when will you? If you are not prepared to answer now, please could you write to the Committee and give us a date on which that code of practice will be published because that will be the first stepping stone in putting to bed a lot of the questions that are causing public lack of confidence? Can I have an answer possibly, please?

Max Jones

The code of practice is being drawn up. The Health and Social Care Information Centre, under the obligations of the Act, has to consult widely on that proposal, but I will be happy to come back to the Committee with a note on when we expect that to be.

Chair

Could you write to us with a timetable for the publication of a draft and then the later adoption?

Max Jones

Indeed.

Charlotte Leslie

And some details on consultation partners.

Max Jones

Indeed.

Charlotte Leslie

Thank you very much.

Andrew Percy

Just on the story that was in The Daily Telegraph, which is the one that has gained some public traction in the last few days, I want to be clear. I want to see data used and shared if it is for health benefits. I don’t want to see it flogged off to insurance companies. You have said very clearly that the data that has been reported on that was released to whatever the actuarial group was would not have been made available under the new regime. So that is very clear.

Max Jones

Yes.

Andrew Percy

What was the previous regime and where does the statutory framework for that date back to then? When was it released? When was the data released?

Max Jones

The contract was in 2012, but, as this refers to a predecessor organisation, I am not sure that I can directly answer the question—

Rosie Cooper

Own goal.

Max Jones

—about what the situations were at that point in time.

Andrew Percy

No. I wanted to know what the previous regime was and what piece of legislation underpinned the release of data under the old system.

Dr Poulter

The Health and Social Care Act 2006, I believe.

Andrew Percy

So the 2006 Health and Social Care Act allowed the release of this data. The new rules would not allow the release of this data. That is very clear, is it?

Dr Poulter

Yes.

Andrew Percy

Obviously this has now been conflated with the new regime, so the concerns are raised around the current—

Dr Poulter

I think that is an important point because clearly we are dealing with different regimes that were set up, and I think that the changes that were put in place under the Health and Social Care Act strengthened the safeguards, which—

Chair

Could we understand precisely what the changes are compared with the 2005‑06 regime and how it changes with the 2012 Act?

Dr Poulter

First, there is an express requirement that information has to be used for the purposes of health and social care for the NHS, for the benefit of the NHS and the health and care system effectively. That is very clear from the Act. But there are also additional safeguards in place, and we discussed, to some extent, the guidance that needs to be put in place. The protections at sections 263, 264 and 265 specifically talk about making sure that there is a rigorous and ongoing assessment process that is required of the Health and Social Care Information Centre to make sure it has safeguards in place about confidential data and protecting it.

Max Jones

If I might also offer, the board of the Health and Social Care Information Centre at its meeting, I think, in January also required that we publish on a quarterly basis details of all those people to whom we make information available, on what legal basis and for what purpose. That is anticipated in advance of the HSCIC’s board meeting in April.

Charlotte Leslie

Could you possibly send us a copy of the old rules and the new rules to clarify? Also, can I clarify whether the insurance company will have deleted the data that they have in line with the new rules? Can I just get clarification that you will send us the old rules and the new rules?

Max Jones

We will indeed.

Rosie Cooper

You said this was issued in 2012. Why did you do it? Have you given actuaries and insurance companies this information before? Is this setting out a mindset? It does not matter what the rules were; you actually did it. Why did you do it?

Max Jones

For the avoidance of doubt, we the Health and Social Care Information Centre did not.

Rosie Cooper

Who did it then?

Max Jones

The previous information centre which was in existence prior to April 2013.

Rosie Cooper

Who are they? Who are these anonymous people? Are you all recycled into this new organisation?

Max Jones

I was not part of the old information centre.

Rosie Cooper

Who headed up the old one?

Max Jones

Its chief executive was Tim Straughan.

Rosie Cooper

Who?

Max Jones

Tim Straughan.

Rosie Cooper

Can we have him visit us, please?

Chair

Well, maybe.

Rosie Cooper

No, it is quite important. These people are making decisions.

Chair

Can we be clear that the position now, Minister, is that the rules have changed? This is information that was made available within the law at the time to an insurance company. The law has now changed and it would not be made available in future. Is that an accurate summary of the position?

Dr Poulter

That is an accurate summary of what we have discussed, yes, and we will write to you, as discussed, giving an outline of what the previous arrangements were under what I believe is the 2006 Act, as Andrew Percy has asked for, and then we will make sure that we then indicate how the 2012 Act has put in place enhanced safeguards in terms of confidentiality and how—

Charlotte Leslie

I am just slightly confused because, as I understand it, the ISIS insurance report from the actuarial company has the new 2013 HSCIC logo on it. Can you comment on why that might be if it was under the old rules?

Max Jones

They asked for permission to use a logo to indicate that there was copyright for the information.

Charlotte Leslie

That is very confusing.

Chair

So who owns the copyright to this information?

Max Jones

I think we will need to write to you and clarify that.

Rosie Cooper

So basically it is, “The old lot did it. We wouldn’t do it today, but you can have our stamp to make sure everybody knows it is kosher.”

Chair

Could we accept your offer of written evidence to cover what happened in this insurance company information? Dr Wollaston wants to pursue that a step further and then we need to move on.

Dr Wollaston

On that point, I have the Staple Inn Actuarial Society report in front of me, and very clearly it says the “Health and Social Care Information Centre” within it, branded. Are you going to retrieve that information if it is currently illegal for it to have been released? I have to say I am very disappointed. What we are hearing from the panel is that this is somehow a communications problem, and in fact really we would share the objectives that there are huge benefits to be obtained by sharing data, but I am afraid the way it is being presented is fundamentally undermining public trust in this. To come before the Committee and present this as some kind of communications issue when there are very serious underlying problems here that need to be addressed is very disappointing and I have not heard an apology yet for the way this has been presented.

Dr Poulter

Tim Kelsey and NHS England have been handling the information side and it is important to hand over there, but this is something that was debated very robustly and fully as part of the Health and Social Care Act. There was a lot of debate around that Act; we had two standing Committees in the House on that Act and I remember being a part of those Committees. It was very thoroughly debated by the House. All of these processes had huge scrutiny and perhaps more scrutiny than any other Bill has had probably in a generation.

Rosie Cooper

So Parliament can’t protect us and people will just lose out. That is what you are saying.

Dr Poulter

So there has been very large scrutiny of this, and the benefits were discussed and talked through.

Dr Wollaston

We are not hearing anything other than this is a communications issue.

Dr Poulter

The point is that this is something that we believe and has to be a good thing for the health and care system because it is about improving research; it is about—

Dr Wollaston

Minister, can I stop you there? There is a kind of paternalism about this and it has not fundamentally addressed some of the very legitimate concerns about the data.

Dr Poulter

Absolutely there are concerns and we need to talk about those, but, fundamentally, this is a good thing and there is an opt‑out system—it is not a compulsory system—that allows people to say, “Actually I don’t want to do this.” The Secretary of State made sure that that was the case, and that was a very effective way of saying that if people don’t want to be part of this they can opt out. [Interruption]

Valerie Vaz

The leaflets did not go to everyone.

Chair

Mr Kelsey has some—

Tim Kelsey

Just to explain, NHS England is the body that commissioned this programme from the information centre on a tight legal basis which we have discussed. Can I slightly move this on a bit because the thing that I want to communicate, if I am permitted, is the fact that this is not a communications campaign? This is one of the most important things the NHS is currently doing and this is not some PR exercise.

Dr Wollaston

Can I take you back on that? It is the way it is being presented as some kind of communication problem.

Tim Kelsey

I took the decision that we were going to extend the period before collections begin for six months precisely to deal with some really big issues that have been raised for my attention by our partners in the BMA, RCGP and by a whole range of stakeholders with whom I have spent an enormous amount of time listening. The three things that I want to communicate to this Committee—

Valerie Vaz

Not to us.

Tim Kelsey

Actually to some of you in fact.

Valerie Vaz

You did not do it to Parliament.

Tim Kelsey

Oh no, I’ve been—well, not to Parliament—

Valerie Vaz

You have talked to everybody apart from Members of Parliament.

Tim Kelsey

Okay. The three things that we, over the next six months, need to get right, because this is such an important programme—I hope I don’t have to explain why, but I will—

Valerie Vaz

No, we know.

Rosie Cooper

We have heard it over and over again. We actually want to deal with protecting the public, and making it work, from arrogant people who are making decisions in their name.

Tim Kelsey

I share that view entirely.

Rosie Cooper

It doesn’t sound like it.

Tim Kelsey

The three things I heard—

Chair

Mr Kelsey, please go on.

Tim Kelsey

The three things I heard were absolutely that people are concerned about appropriate assurance of the purpose to which their data is being put. We do actually have some very strict legal safeguards but we need to talk about how we can strengthen those assurances. That is really important. That is something that everybody has said and I absolutely share that interest. So we are going to spend time talking with the Government and with as many stakeholders as we can about how we can ensure that appropriate assurance is in place that guarantees the purpose of the Act, which is that this data cannot be used for any other purpose than the benefits of health and care. That is the first thing to address. The second thing to address is some very real concerns, which I have spent a lot of time on with colleagues in the British Medical Association and the RCGP, about the degree to which GPs under very heavy workloads are suddenly finding that they are needing to communicate about this new programme to patients. They are feeling they have not had enough time or enough support in some cases. They feel they have not had opt‑out forms. There are some basic things that they feel they need more of, and certainly we are going to be talking to them about how we can support them much more closely to make sure that they are equipped with the right information to have a proper conversation with their patients. The third thing I think, although you have heard it today—and perhaps we are all too close to the benefits in the health service—is to some extent just to explain to the general public, to citizens at large, why this matters so much. I am not sure we have made the case for the benefits of this. Obviously people do have the right to opt out of the programme. We want to persuade them that this is way too important for them to exercise that right, and that is something else that we need to do. This is not a PR exercise, nor is it a stunt. My view is that it is one of the most important public debates we are having and it is about the future of the health service. So I welcome this Committee’s support for the principles of it and am very interested in listening to your views as to how we can ensure that we take the public with us.

David Tredinnick

I have to say—and I have been in this place a long time—that I think the Minister and you were badly advised not to attend the earlier session. The reason this Committee—

Tim Kelsey

We were in attendance.

David Tredinnick

You were at the back of the room.

Tim Kelsey

No, not personally, but our teams were all here in attendance. [Interruption] I also watched a lot of it on the television.

Chair

Order, order.

David Tredinnick

I am not chairing this Committee but order through you, Sir. The point I am trying to make is that the reason the Committee, through you Chair, to put it mildly, is excited about these issues is what we have just heard over the last two hours from witnesses who are saying that there are major, major concerns over issues such as pseudonymous data and what it means, what is data, when is data one sort of data and when is it another sort of data. You did not hear this intricate debate, which I think is a great pity. To sum up the answer to the question that I am about to pose, which is here and I asked the last session, “What do you hope to achieve by postponing the start date for data collection by six months?”, the five representatives who presented to us just now were saying that we have to go back to the drawing board. We have real concerns about the legal definitions of this data. The doctors’ representative was saying that they are in a panic—though he did not use the word—or very concerned as doctors that they have two duties of care: they have duties to pass information up and then it changes its status; they have duties of care to patients who can sue them if they release the data. It did sound like a very serious muddle. The impression we got from them was that they needed six months as a breather, and I hear from Dr Poulter—and I think this is the concern I am hearing round the table, although I am not chairing the Committee—that this is not a public relations exercise. What we have here are fundamental issues and these have to be addressed. I would ask you to comment on this. What are you hoping to achieve by postponing the start date for data collection by six months? What exactly are the key points?

Dr Poulter

I have one comment on that, David, and then I will get Tim to talk about the engagement exercise in which NHS England, we as the Department of Health and the Government have listened to stakeholders. We have been listening to those. We have had those discussions and we listen to things. My belief is that, once we have had further engagement with stakeholders, we will be able to reassure those stakeholders that there are very rigorous safeguards in place under the 2012 Act. I am sure we will be able to do that and to make sure we are in a better place. That is something I believe will be the case. I think it is down to how well it has been communicated as an exercise, and Tim from NHS England has said that. I am sure that, when we have the discussions with stakeholders and we have further reassurances, it will be something we can convey. Obviously, we listen to concerns and take those on board. That is important, and I am sure with those reassurances everyone will feel in a better place.

Tim Kelsey

We worked very closely, when this project was first initiated, with the BMA, the RCGP and other key stakeholders on designing the information that was first distributed to GPs back in the autumn and, subsequently, to the general public. We worked with them on the protocols for the patient and GP helplines. We published data in a whole myriad of different places with, in fact, in the end more than 350,000 patient bodies. So we didn’t do nothing, but it wasn’t enough. Towards the end of January I was picking up—as I say, mainly from GP organisations—real concerns about the degree to which GPs just had not had enough time or resource to have a proper conversation with patients, plus this big issue about the degree to which people were satisfied with assurances in what I think has been a very confused media reporting environment, where things like the illegality of insurance purposes, as it actually is, was lost in a melee of slightly ill‑informed reporting. What we, therefore, intend to achieve now is to work with our stakeholders, all of whom have committed to doing that—the BMA and the RCGP—none of whom have lost sight of the purpose of this health watch. We will be working with them incredibly closely to develop a whole programme that will meet the three things I just mentioned. The first of those is absolutely to provide more support to the public and the primary care community on raising awareness of the purpose of the programme, the rights that people have to opt out of it, and to be very clear about what the opt‑out means. Another thing that came back to me was that people were not clear about it. What did it mean? It is actually pretty straightforward. It means that, when you exercise the first opt‑out, no clinical data flows from your practice. That message has got lost, so we need to re‑embark on making that clear to people and also making it much easier for them to make that opt‑out. Unfortunately, in some cases GPs got a bit confused and were saying to people that they had to go physically into the practice and so on and so forth. We need to be a lot clearer about that and use available digital technologies to make it easier for people to opt out. Those are things that are real criticisms and I fully accept those. Those were the key issues. Essentially, for the next couple of weeks or so, we will be working with stakeholders to develop the programme, and then we will be able to make some very concrete proposals to this Committee and more broadly about what we propose to do to meet these criticisms.

David Tredinnick

I am sure colleagues want to come in on what you have just said, but I also would like to add from what I have heard. What we have heard in other inquiries is that there is not a proper understanding of this priceless asset of a primary and secondary national database—international, perhaps, if we look at devolved Administrations—which other countries, such as the United States of America, do not have because they have all sorts of protections. It is critically important that this is out there, as the professor from the British Heart Foundation said to us earlier on, because then you can work out why elm bark, I think it is, which is aspirin, actually does kill some patients, but you need a massive database to work out which patients get killed by taking aspirin in a certain situation. So you have got to get this message out too about just how important it is that what you have there is fundamentally important to the nation’s health, and I don’t hear that message.

Tim Kelsey

Very quickly on that point, I personally am at risk of colon cancer; it is something that, sadly, runs in my family. I recently went for a procedure in my local hospital in Taunton and I was besieged by the staff at the hospital there asking me why care.data was not happening quicker. [Interruption] Well, we have been very good at understanding lots of useful things about hospital care—

Valerie Vaz

This is anecdotal evidence.

Tim Kelsey

We have been able to improve quality in most surgical procedures because we have used the Hospital Episode Statistics database. Our ignorance of what happens to people outside hospitals is one of the key reasons why, at the moment, sadly, England has one of the lowest cancer survival rates in Europe. Care.data is not just about research. Care.data is also about genuinely saving lives in the NHS—I hope we are all agreed on that—and what I have to do, my job, is make sure that in six months’ time we have the public with us and we have GPs in a place where they feel they have been able to exercise the responsibilities they properly have to inform the public.

Charlotte Leslie

In the spirit of being helpful, we have had two suggestions for how we might use the six months. I don’t know if you have seen George Freeman’s Bill—

Tim Kelsey

Yes.

Charlotte Leslie

—on insisting that this is all done under a new statutory framework of patients’ rights and that we should also enshrine this idea that patients are responsible and own their own data. Is that something you have considered?

Tim Kelsey

Charlotte, you have known for years that my personal position on this has been absolutely that we need to be very clear that this is patients’ data. It is their data; it is our data; it is people’s data. I have been personally very supportive of George’s Bill.

Charlotte Leslie

Brilliant. The second thing is that we have a system that has worked well for some time in terms of being pseudonymised at source, and two of the largest companies are providing GPs with this 80% of coverage. TPP, I think, is one of the companies, and it is used in big research technologies, big research projects such as QResearch. This is already working. Why can’t we just do this? Yes, it might mean that the data can’t be because it is scrambled before it goes to the information centre; yes, it might be more difficult to pass on to third bodies such as insurance companies or the police, but this is already working. The public would have more faith in this. Why can’t we just use this?

Max Jones

The technical solution we have at the moment does not implement pseudonymisation at source. I am not yet convinced that pseudonymisation at source will indeed offer a technically viable solution at a national scale. However, we recognise that there is a need for us to continuously look to see whether or not we can find opportunities to do better. So, in November, we started an exercise to listen to some of those key stakeholders and what opportunities there are to further strengthen pseudonymisation, not only at source but also on publication, and we have been engaging with exactly those suppliers but also representatives from other suppliers and stakeholders, and will be looking to see whether or not that offers us some opportunities in the future. At the moment I am not yet convinced that it offers a sensible way forward. It is not only about making sure that we take best use of technology but also that we protect the quality of the data which will result at the end and the quality of the data linkage, making sure that in doing pseudonymisation at source we don’t prevent the ability to link data across datasets. In particular—though GP data may well not be the highest example of this—where you have other care settings that may not have quite as high a presence of NHS number, then pseudonymisation at source may well present some very real qualities to our ability to bring together the shared record and understanding of patient care. We have an open mind but we are not yet convinced.

Charlotte Leslie

The final recommendation has come to me via someone who wants to use them for research. As I understand it, the data will not be historical but will be taken, I think, from October 2013. Someone who does research said to me that that completely devalues the asset the data might have in terms of research because you can’t see the longitudinal effects of the drug. This is my final question. Is this going to be the case, and if we are going to jeopardise public confidence in where their data is going to go for a greater good—most people agree it is a greater good—could we please have data that is really useful to the research community, that is historical and longitudinal and not taken from October 2013?

Tim Kelsey

From the Commissioner’s perspective, we worked very closely with the BMA and the RCGP on the original specification for care.data, which is not the entire record and also is not the historic data. One of the things I want to do in this conversation is to take the research community to the BMA, the RCGP and other GP colleagues to understand better what the additional labour or burden might be in opening up more historic data. That is a proper real conversation. We are at the beginning of a journey here and this is a new thing for everyone, but that is exactly the kind of conversation we should be having.

Barbara Keeley

I want to say some things about context because over the last few days I have seen NHS England described as incompetent and arrogant over this database. I think that that is a serious thing because there are some seriously good uses here. It is a pity that you say you listened by proxy somehow to the previous panel. We heard from Dr Chaand Nagpaul that there was a real difference that he can see between GP data, which is personal, confidential and might include information that never would reach a hospital record—about domestic violence, mental health issues and all kinds of things that people would not want to just be out there and found out about them—and the sort of episodic data that is hospital data. I would think that most of us here would want you all on the panel to admit that information—whether or not you want to challenge it—such as the release of hospital data, patient data, to those insurance actuaries has undermined confidence. I did a BBC interview this morning, and the BBC person was on the street in Greater Manchester asking people if they had heard of the care.data database. Not a single person asked had heard of it—not a single one of all the people they stopped. When they had it explained to them what the database was, they said things like, “It is just another way the Government is going to spy on me,” and there was a very particular concern about somebody believing that it would be used either to sell things and so he would be bothered at home with phone calls or that information about possible mental health issues in the past would be disclosed to employers. Those are the real fears. Until and unless you can take those things seriously, even six months won’t be enough. One other thing I want to say is that there is a great deal of talk in the NHS these days about stakeholders. I think every single patient whose data you want to do something with is the real stakeholder. So that is just a thing about context. This project is about the personal, confidential medical data of patients, which, as Dr Nagpaul has said, is a thing based on trust, and if you get this wrong—and you are getting it wrong—you can undermine the trust between a patient and the GP, which will in itself be to the detriment of future medical care. Let’s not run away from that. These research arguments about benefits are very, very important, but if you undermine whether somebody will disclose a mental health problem, HIV status, alcohol or other things, then you really have an issue. I want to talk about how you propose to go back to the public and win back the trust you have lost. You have lost it—the organisations. You can say it was a previous organisation but that does not matter to the public at all, and, undoubtedly, the HSCIC has some people that used to be in the previous information centre. Let’s forget about saying, “It wasn’t me.” There have been suggestions in the previous panel of ways of safeguarding that important single database, ways that you could prevent the re‑identification of data. If you don’t think, Mr Jones, that what has been suggested— pseudonymisation at source—is a way to do it, how will you do it? It sounded a bit like “just me,” and I am surprised that it is just you that takes this decision about how to safeguard data. The second thing that was raised—and I think this is important—was the system of fines. The fines that people get for misusing personal patient data are derisory. I read an example of somebody misusing data in a GP practice being fined £990. That is a joke. To pharmaceutical companies, small fines are just not worthy. It is being talked about that we have a loophole whereby it is not a criminal offence to obtain and misuse personal data, and that is something for the Government to reflect on, I think. I used to work in IT, and what seemed to me to be very compelling is that, particularly at the start, you could run with a single copy of the database and run queries against that data for the organisations whose medical purposes you approve, not be in the situation of loading personal data out to people, because, as we have discussed in our previous panel, there is this problem, if somebody withdraws consent later, of how you are going to get it back, if you like, if a dataset has gone out to a research organisation. Those have been put to us as ways of moving forward and safeguarding the data. Could you tell us when you are going to go out with some sort of new offer to the public? Are you going to include any of those safeguards? More than anything—and we have had quite a debate already about what happened with the insurance actuary data and there might be other examples of dodgy applications—will you make available, or certainly will you make available to Parliament, Minister, all the minutes, attendees, and all the applications that were used that perhaps don’t fall within the new rules? Can we know about everything dodgy that went on in the past so that at least people can know and get that out of the way? What is going to kill this is if we keep having insurance actuary stories all the way down the road. There does seem to me to be floating about stories that GPs have been offloading data in exchange for IT systems and other support. There have been various examples of data floating about and being used out there. Let’s make a fresh start, get all of this information in and come clean with it.

Max Jones

Can I respond on a couple of those points very specifically? The GP extraction service that we have in place to support extracting the data from those GP systems for care.data took great care to make sure that we only extract the coded information in those records, not the free text notes which patients may well have shared during consultation with their GPs. In addition, we also created a number of explicit conditions which were excluded from those extractions, and those include HIV/AIDS, sexually‑transmitted infections, termination of pregnancy, IVF treatment, complaints, convictions, imprisonment and abuse by others. So we have already—

Barbara Keeley

But not mental health issues—

Max Jones

Not mental health issues specifically.

Barbara Keeley

—attached to which we know there is a considerable stigma.

Dr Poulter

Quite frankly, that is absolutely daft because we have a parity in this country between mental and physical health, and if we don’t have the data collected properly on mental health we are not going to be able to have the evidence in order to improve mental health conditions. So I think it is absolutely important that getting the right data in place is the right thing.

Barbara Keeley

Can we come on to the other point, because, clearly, in terms of what I said about people being stopped in the street, that is a worry to somebody? They fear that, if that data gets out, it would be disclosed and would affect their future from a whole variety of points of view. There is a real fear in the public. If they come up with that, unprompted in a street interview, then it is a real fear.

Tim Kelsey

I just want to make the point that we are going to be launching a very sizeable programme of activity to do the three things I mentioned, which specifically involve, first of all, articulating the purpose of this programme very clearly, articulating what the safeguards are very clearly and inviting people to make a choice about whether they want to opt out of that programme or not based on what we are saying about the safeguards. That is why we are having the six‑month extension.

Barbara Keeley

Will you reconsider any of the safeguards I touched on that were put to us in our earlier panel?

Tim Kelsey

I can’t speak for the Government, but, as far as NHS England is concerned, we are taking very seriously the fact that even with the existing provision of safeguards, which are the tightest they have ever been, we are still not satisfying people that somehow the state is not going to do dastardly things with their data, and we need to look very carefully at how we can—

Barbara Keeley

They don’t think it is the state. We are in a situation where—

Tim Kelsey

Or, yes, that the state might sell their data to some another party.

Barbara Keeley

Yes.

Tim Kelsey

We need to look really carefully at how we can provide appropriate reassurance that that is not going to happen. So the answer is yes. All the stakeholders you have before you I know very well, and, indeed, they are all engaged in the conversation we are having about what happens next.

Barbara Keeley

But Mr Jones has already told us that the suggested way of preventing re‑identification of data—pseudonymisation at source—is something that he considers not worth while. So already, at the start of the six months, you are seemingly rejecting things that other people have suggested you should look at.

Tim Kelsey

I don’t want to speak for Mr Jones, but—

Max Jones

Can I clarify? We take pseudonymisation as a critical key tool that we use inside the Health and Social Care Information Centre. Under the Information Commissioner’s Office code of practice on anonymisation, we implement and adhere to the limited access safeguards that it sets out, and I will read those to you: purpose limitation, making sure that the information is only available for specific purposes; training of recipients’ staff; personnel checks on those staff; controls over linkage to other data; limitations to specific projects; restrictions on the disclosure of data; prohibition of re‑identification; measures for the destruction of the data; technical security arrangements, including encryption; limited copying of the data; and contractual penalties for breach of rules. To go back to the comment that you made about the £900 fine, if someone was, let’s say, to do a jigsaw attack against this pseudonymised data, they would fall foul of the Data Protection Act, and my understanding is that, as of 2010, fines of up to £500,000 are possible.

Barbara Keeley

That would mean nothing to a drug or insurance company.

Tim Kelsey

In addition, they would breach the terms of the contract which they would sign in receiving that data, and then the HSCIC would need to—

Rosie Cooper

G4S. Don’t forget—

Chair

Order, order.

Barbara Keeley

I don’t expect you to answer these points now. What I am saying is that in the earlier panel a number of additional safeguards were suggested. I would just like to hear that you would think about them, that you would take them away and you have six months to think about them.

Tim Kelsey

Yes, absolutely.

Max Jones

What I was trying to say about pseudonymisation is that, absolutely, we are looking at that with those experts to see whether or not they feel, at a national scale, it is something we could do.

Barbara Keeley

If you think now that a £500,000 fine would stop anybody who had a data interest and a lot to gain from matching up their own data with this data, then you need to think again. It was suggested that there is a loophole in our legislation that we should look at and make it a criminal offence to do that. We are talking about the personal data of a lot of people.

Grahame M. Morris

I think that is an important point, Chair, and I hope that either Mr Jones or Mr Kelsey would respond to the Committee. If they can’t do it now, perhaps they could consider it and identify the appropriate statutes that members have raised. I want to ask some technical questions perhaps to Mr Jones and to Mr Kelsey regarding, first of all, the cost of care.data. What is the actual cost of the project? I would also like to ask a few questions about how the system will operate in practice. Is it true—and a number of members have suggested—that Atos will be providing the technology? I wonder if you could confirm or deny that that is the case and whether other IT suppliers would be involved in the mechanics, as it were, either nationally or regionally. If that was the case, are there any technical issues that have been reported to date in respect of problems over compatibility if there are different regional centres using different operating systems, or is that something that you have already addressed? In terms of the concerns that have been raised—and we all recognise the value of this—the Minister said it was an evolution, but I think it is a revolution in terms of the nature of the data. It is not just a kind of raw data; this is a kind of holistic approach covering all aspects—primary care, hospital care and lifestyles. My question is this. What is the critical point on opt‑out? If a certain percentage of the population do not have trust in the system, when does the dataset then become of limited value in terms of research and development—something that everybody wants to avoid? Have you made any assessment of that?

Max Jones

I will try and respond to each of those, but I will let Tim probably consider your last one.

Grahame M. Morris

Oh dear.

Max Jones

You are correct that Atos were awarded a contract to be the supplier that extracts the data from the GP systems. That contract was awarded under the old information centre regime. We are working well with Atos, but the data, once extracted from those GP systems, is brought into the safe haven of the Health and Social Care Information Centre. It is processed by our staff in our data facilities.

Grahame M. Morris

Is that on a national basis or are there regional offices?

Tim Kelsey

That is on a national basis. Although HSCIC does have regional offices, that information is processed and held on a national basis.

Grahame M. Morris

What about costs? Do you have any information about what it has cost?

Max Jones

I can tell you what we have spent so far if that would be helpful. The Health and Social Care Information Centre has spent £1.17 million so far on the care.data programme. I will let Tim respond to your latter point.

Tim Kelsey

It is very important on the opt‑out. To an important extent, any data at all is useful. Clearly, we want as many people as possible to agree to share their data in the programme. The larger the amount of data, the more use it will be, but there is no point at which the data is of no use. So there is no percentage at which this becomes useful or not. It is useful at every point of its sharing.

Grahame M. Morris

Mr Jones, as to that information you gave me on costings, would you just double-check it because I have seen a written answer that suggests the estimated cost is £33 million over three years? That might be incorrect, but I would be grateful if you could check. If the information is not correct, perhaps you could advise the Committee.

Max Jones

For the avoidance of doubt, the figure I gave you was our spend to date within the Health and Social Care Information Centre. I don’t recognise that figure that you were referring to.

Rosie Cooper

What is your budget?

Valerie Vaz

And the cost of the contract with Atos.

Max Jones

I don’t have that figure with me, but I can come back to you with a note.

Chair

Could you write to us with that piece of information, please?

Valerie Vaz

I want to follow up something that you said, Mr Kelsey. You said the information is never not going to be useful, but suppose 90% of people opt out.

Tim Kelsey

To some extent it depends how important you think this is for the future of the NHS. Do you think the NHS can fly blind in delivery of out‑of‑hospital services? If 90% of the population decide that they would only give the NHS that proportion of their data, we won’t have a health service for very much longer. We won’t be able to run services effectively.

Valerie Vaz

That is scaremongering.

Tim Kelsey

It is just a view I have. I have had it for a long time.

Valerie Vaz

Information has been flowing for a while, hasn’t it?

Tim Kelsey

Not in out‑of‑hospital services. In hospitals, of course, it has, and look at the degree to which we have managed to improve outcomes there.

Valerie Vaz

Don’t let’s go to Dr Foster because actually Professor Black is looking at the way Dr Foster’s figures have come out.

Tim Kelsey

I am not sure that Dr Foster—

Valerie Vaz

You are not associated with Dr Foster any more, are you?

Tim Kelsey

No, I am not.

Valerie Vaz

There is some concern about the information that is coming out of it.

Tim Kelsey

Obviously 90% would not be a good position for us to be in.

Dr Wollaston

We heard from the last panel that the concern was not just about the identity of those accessing this data but the purpose. One of the specific examples given was whether or not Government would access the data, like the DWP, and what the purpose would be. As you will know, there are many sensitivities around Atos in any case, so I think it is reasonable to see how the public could be concerned about that. Are you going to have a very clear, concrete offer to the public at the end of this six‑month delay as to how these requests will be handled, how transparent that will be and, therefore, they can see if their data is going to be accessed by the DWP, because I suspect a lot of people would choose to opt out at that point? I accept that that might not be for purposes that would be harmful, but it is what the public believe and I suspect they would not trust that. They need to be able to see that very clearly. Also, it would be helpful if they could see this information backdated, and the point has already been made by another member of the Committee. Will you set out who up to now has made requests for data, how it has been adjudicated on and the minutes of those meetings, so that we can have a clear transparency about who is making these requests and how it is being decided upon? Will you give us a clear guarantee that that will be in place?

Tim Kelsey

I can’t say. The information centre handles, as it were, the process for applications, so I am sure that Max will give you some assurance about that. Can I just say that, for certain, for care.data—that programme—there will be full transparency of all uses and all users will be audited? In terms of time scales, we have delayed the initial collections till the autumn. The actual linked data files will not be shared for some time after that. We can give you the project plans as those develop. The timetable for the initial collections will be 1 October, from that point onwards. But from the moment at which data is shared, I give the assurance that there will be complete transparency of all organisations and of all uses to which that data is put and that there will be appropriate audit of those organisations to ensure that they can be properly regarded as safe to handle this kind of information.

Dr Wollaston

Are you planning currently to share this information with the DWP?

Tim Kelsey

At the moment we are completely prohibited from doing that unless the DWP can make a case that somehow it is helping health and social care.

Max Jones

Reading directly from the Health and Social Care Act, this has to be “in the interests of the health service in England or of the recipients or providers of adult social care in England.” That is the test that would be applied.

Dr Wollaston

But you could see a situation in which the DWP might argue that it would be quite helpful for them to contribute to the process, say, for example, in fitness to work. Would you say now that you would not be giving other Government Departments that data?

Dr Poulter

The Act is, in my view, very clear about the purposes for which data can be used, so I think the purposes you are describing do not fall within what is written in section 254(2)(b) of the Act.

Valerie Vaz

What is the definition of “the interests”?

Dr Wollaston

But how will that adjudication be made and will that be very clear to people so they can opt out at that point? We will have a clear offer to the public. Thank you.

Chair

Ultimately by a court.

Andrew Percy

Can I ask one point?

Valerie Vaz

No, sorry.

Andrew Percy

But I had my hand up.

Valerie Vaz

I actually did too. What is the definition? Who is going to decide what is in the interests of people? You read out a definition. Who decides that?

Max Jones

I do, or I did, but I am not a lawyer and we will obviously, during this period, want to provide further evidence to assure the public that they can work through case studies and understand all the steps that we will take to show people.

Valerie Vaz

Are you doing it now?

Grahame M. Morris

Is it you that decides?

Max Jones

I am sorry. The board of the Health and Social Care Information Centre does have a responsibility at the moment to make sure that it is adherent to the terms of the Health and Social Care Act.

Andrew Percy

Just on this issue of Government Departments—and I share the concerns of the DWP accessing some of these records—would the old system have allowed Government Departments to access that information or not, because obviously we understand that this flogging of information to the insurers that happened under the old regime could not happen now? Would the old regime have allowed Government Departments to access that information?

Max Jones

I am not aware of any cases where other Government Departments have had access, but I will be happy to come back with a note that clarifies if—

Andrew Percy

That would be helpful because it is very clear we want to know what the new regime allows—which I think was Barbara’s request earlier—as opposed to what the old regime would have allowed. The two have been conflated in a very dangerous way.

Barbara Keeley

We did not have this data—

Andrew Percy

I accept you are accessing different data, but we are still dealing with people’s personal data. I understand we did not have the GP data but we had plenty of other information which was incredibly personal, so it would be important to know what the difference is.

Dr Poulter

Chair, we would be very happy to clarify that in the note. There has been a lot of conflation of what things were before the 2012 Act and how things are and operate now, and I think that has led to some of the misunderstanding that has been about. I hope that we have brought some reassurance today and we will do so further in writing. It is important just to clarify that point, and it cannot be clearer in the legislation, that it must “be in the interests of the health service in England or of the recipients or providers of adult social care in England.” That is very clear; that is not about DWP. It is about the health service and social care.

Valerie Vaz

With the greatest respect, Minister, I have been a lawyer for the Government previously and I had to make a definition of what is in the public interest that was as wide as possible.

Dr Poulter

It is not “the public interest.” It is “in the interests of the health service.”

Valerie Vaz

But “in the interests of” has an extremely wide definition.

Dr Poulter

That is a very narrow definition, that the health service, the NHS in England and the social care system in England, which is very—

Chair

Valerie wishes to pursue the point.

Valerie Vaz

Not particularly that, but others, and I do want to pick up something. I want to put this to you. If someone has already opted out, what happens under the new regime? Are we going to have to opt out again?

Tim Kelsey

Opted out of what?

Valerie Vaz

I have already opted out of care.data UK.

Tim Kelsey

You won’t have to do so again, no, no.

Valerie Vaz

I won’t have to do it again, even though you are coming up with a new system with new safeguards and you are discussing—

Tim Kelsey

It is not a new system. We are not going to change the mechanics of opting out, nor, for example, the definition of the datasets being collected from GP practices. So, if you have opted out, that remains; you are opted out.

Valerie Vaz

Could I ask you, Mr Jones, were you told to commission the dissent codes in such a way as to flow any data whatsoever from GP records who have opted out?

Max Jones

For the type 1 opt‑out, so this is someone who does not want their patient—

Valerie Vaz

Don’t do type 1 and type 2. You need to explain.

Max Jones

Which is what I am about to do. If you choose to opt out of information at a patient level going to the HSCIC, then the HSCIC will not extract anything associated with your patient record through that GP extraction service I have just described. We will extract a count of the number of people in each practice who have objected. That will not contain any details about individuals. That will be to help us in monitoring the way in which opt‑outs are proceeding.

Valerie Vaz

But once you have opted out, that is it: your data can’t be extracted at all, all the way up the chain.

Max Jones

That is correct, yes.

Valerie Vaz

On what basis will you NHS England, or you HSCIC, decide to allow patient data to be shared outside the European Union, say, for example, in America, which has a much more relaxed attitude to data protection? [Interruption—someone asking “Does it?] Yes, I also advised the Government on that.

Chair

Let us stick to the question.

Max Jones

We are clearly bound by the Data Protection Act and, though I am not an expert, it does provide guidance on the European economic area and safe harbour.

Valerie Vaz

On what basis will you allow it to flow out?

Tim Kelsey

On the basis that we have established that this data can only be used in the interests of the health service.

Valerie Vaz

Sorry?

Tim Kelsey

This data can only be used on the basis of the Health and Social Care Act. We have just had the discussion about what a health service means.

Valerie Vaz

Suppose you get an American company, for example, who will be outside the jurisdiction.

Tim Kelsey

I think we need to do a note on this because I am pretty convinced that we are specifically only allowed to handle this data in the UK.

Valerie Vaz

This is why I am asking. I want clarity.

Tim Kelsey

I will come back on that, but I am pretty certain that is the case.

Grahame M. Morris

What about the application of the Transatlantic Trade and Investment Partnership?

Chair

Order, order.

Valerie Vaz

My colleagues have also made an important point about the transparency of the people who apply to you. Will you be publishing a list of people who have actually applied to have data on your website?

Max Jones

That is what I said earlier on. In fact, in advance of any of these kinds of discussions or requests to attend this Committee, the board of the HSCIC, in a bid to increase transparency and thereby public confidence, had already asked for us to produce, ready for its April board, a very clear set of transparent information and to do so on a quarterly basis such that we could reassure the public about who was having access, for what purposes and under what legal basis.

Rosie Cooper

Would it be on the website—public?

Max Jones

Yes, public.

Tim Kelsey

For the avoidance of doubt, can I confirm now that the data connected to care.data will not be allowed out of the United Kingdom? Let me confirm that before we have further hares running.

Chair

Yes. Can we allow Valerie to pursue her line of questioning and then others can come in?

Valerie Vaz

Rosie, what did you want to say? It was really that and you answered that very carefully. So we will know who has applied for the data and what reason they have applied for the data.

Max Jones

And the legal basis upon which we have provided it.

Valerie Vaz

Okay. So your discussion with what you call stakeholders, and Barbara actually mentioned discussion with patients—

Tim Kelsey

Yes, people.

Valerie Vaz

—are you going to do that?

Tim Kelsey

Yes.

Valerie Vaz

How are you going to do that?

Tim Kelsey

I will come back with the plans in relation to public‑awareness raising and all the things I have discussed, but I am literally having a variety of engagement with people in all sorts of different kinds of respects, whether as individuals, voluntary organisations or as professional bodies. NHS England has at its core a fundamental commitment to prioritising the patient in every decision it takes, and that is not just rhetoric—it is actually the way the organisation operates. I will demonstrate—we will collectively demonstrate—that the importance of this data and its implications for patients will be promoted, and the choices people have to opt out if they want to are promoted by the very broadest sort of coalition of different organisations. But I can’t give you specific details because we are starting on it now.

Valerie Vaz

Okay. So I suppose my question is why had you not started on it before?

Tim Kelsey

As I tried to explain, we did do this in good faith. We spent an awful lot of time with, as you would expect—

Valerie Vaz

I understand that, but—

Tim Kelsey

Through a conflation of media and all sorts of things, we ended up with a level of confusion, suspicion and anxiety, which I needed to bring to a halt and, in a sense, to restart the awareness process. We also recognised that there are some very real issues that people have with assurance around access to the data, which we have discussed.

Valerie Vaz

But the reason why you needed to put a stop to it was because you did not do it in the first place. That is the point. You did not explain it and that is why people were confused. They were not confused for any other reason. You did not explain it.

Tim Kelsey

In the end you are right; I can’t deny that is the case. For many people, let’s be clear, many GPs did and are doing a fantastic job and making it absolutely plain to their patients. My own GP has a website on which you can opt out. There are lots and lots of GPs who have done a really good job in doing exactly what they are supposed to do, and patients, I think, are having a proper level of informed choice about whether they want to participate. But I am not denying that there are lots of people who don’t feel in that position, so we need to do better. But please don’t think for a minute we did not, at the beginning of this and throughout it, engage with all the people you would expect us to engage with. The BMA and the RCGP helped us to write the infamous leaflet which landed on people’s doorsteps during January.

Valerie Vaz

Or did not land on people’s doorsteps.

Tim Kelsey

Or did not land on people’s doorsteps.

Valerie Vaz

You were not here—you had people in the room—previously, but the point was made about who is controlling the data. Who is the data controller? There is a conflict of who actually does do it and at which point. One of the queries that came up—and I am asking you because you have not had this conversation presumably with the BMA or the RGCP—was whether you will be indemnifying any GPs.

Tim Kelsey

I went to the General Practitioners Committee of the BMA to talk about what we were going to be doing.

Valerie Vaz

I am just asking a question. Will you be indemnifying them, because that is what they want to know?

Tim Kelsey

What I understand—

Valerie Vaz

Just a yes or no is fine.

Tim Kelsey

I don’t know at the moment.

Valerie Vaz

You don’t know; okay.

Tim Kelsey

No, because I think there is a misunderstanding. I don’t know.

Chair

Are you finished?

Valerie Vaz

Yes, thank you.

Chair

Could we go then to Sarah, please?

Dr Wollaston

Can I please be picky, Mr Jones, and say that I welcome that you are now going to start publishing quarterly, but could you just confirm to the Committee that this is going to be a retrospective process—that there will be transparency about previous, perhaps inappropriate, data releases? If we just see a drip, drip, drip of negative stories, that will be very damaging. Putting this in the public domain now would be very helpful. Are you able to confirm that there will be a retrospective release of the data around who made decisions, who the data has been released to and why?

Max Jones

For the HSCIC, yes.

Dr Wollaston

And for your predecessor body?

Max Jones

I don’t think I can say that.

Dr Wollaston

But for everything that the HSCIC has adjudicated on.

Max Jones

Yes.

Dr Wollaston

I would like to see it for things like this document, which clearly had your branding and logo on. I personally find it very disappointing that you are not going to be able to do that for your predecessor bodies, but you are definitely going to do it for the HSCIC.

Max Jones

Indeed.

Dr Wollaston

Thank you. Can I just turn to the issue of GPs? As you will know, GPs are under huge pressure at the moment, and the process is that you are encouraging people to go and speak to their individual GPs. I have heard from people who have told me that they have contacted their GP practice only to be told that it is nothing to do with them. So even GPs themselves in some parts of country clearly are not aware that this is their duty. How would somebody check? I e‑mailed this person back and said, “Why don’t you contact the practice manager?”, to which the response was, “It was the practice manager.” How are people going to have confidence where they have asked to opt out that it has been put in place—that they have been opted out? How will people check? As you say, you are going to allow people to opt out through online routes. I certainly would not want to have to go in person to see a doctor about this.

Tim Kelsey

Many practices already offer that.

Dr Wollaston

Will you allow people to opt out by telephone as well?

Tim Kelsey

They can already do that.

Dr Wollaston

That is very reassuring to know.

Tim Kelsey

But you are right. Some GPs just do not seem to realise that that is what—

Dr Wollaston

They have not engaged at all is the message I am getting, in which case do you not think that, in retrospect, the programme of informing GPs was inadequate? This is not just an issue about poor communication to the public; it is also about poor communication to the individuals who you were asking to put this in place.

Tim Kelsey

I am not trying to be defensive here because I recognise all the things you have said, but we did work very closely with the BMA and the RCGP on their channels of communication with practices. They provided editorial input and all the various informational resources and so on. I think you are right—and what I have learned through this process is—that, even though you send everybody all these things over and over again, with quite a few of them something does not happen when it should do. We need to think about different strategies for engaging with the general practitioners, who, as you say, are working under incredible stress and all the rest of it, so I can understand why things get lost and key issues may not land. I am also anxious, in a sense, not to suggest that this is necessarily very widespread. Many, many of the GPs that I am aware of and in my own local area have done exactly the thing you would expect, which is to provide people with online forms and all the rest of it. So I am not sure at the moment that we really have enough data to decide just what proportion of GPs are doing what or are not doing, but I think the point about this extension to the point at which we begin collections gives us a chance to properly make sure that GPs are fully aware.

Dr Wollaston

Can you confirm that people will be able to check that if they have asked to opt out that really has happened—that they have actually opted out?

Tim Kelsey

Yes. We have agreed with the BMA that we are going to have a sort of committee that will review both areas where there are very high levels of opt‑out exactly for that reason, just to review how things are going.

Dr Wollaston

But can patients check whether their instructions have been followed? That is the question I asked.

Tim Kelsey

I will take that away. That is a good question. They should be able to, but I will take that away.

Dr Wollaston

For the record, I think this is a fantastic project and I will not be opting out, but I do think it is very important that we make it clear to people that they have absolute trust and confidence in what is happening.

Tim Kelsey

I agree.

Charlotte Leslie

I want to go back to some of what we have covered in terms of governance systems. Mr Jones, I think you referred to the HSCIC as a safe haven. Of course, most of the debate is as to whether people can be confident that it is a safe haven. What we have embarked upon is very ambitious and can do great good but also carries great risks. In that light, I am slightly puzzled about some of the actions that HSCIC has taken and NHS England. As you know, there was the Independent Advisory Group which looked at data going into the HSCIC, and there was a Data Access Advisory Group which looked at data going out and where that goes. What puzzles me is that, in embarking upon a potentially very risky data gathering, these organisations should be disbanded. You would think there would be more governance and scrutiny, but the advisory group was disbanded; then someone realised this was a bad idea and they were asked to re‑assemble, but only for six months until November. On the DAAG, which has only four people on it, two of those, I understand it, have now gone. Can you explain why, at a time when you would need more governance, actually we have less scrutiny about data going in and out?

Max Jones

It is very clear that we need to provide assurance to everybody that what we are doing is sensible and to make sure that, in taking important decisions, we have effective governance mechanisms in place to do that.

Charlotte Leslie

Can you tell me how that feeds into—

Max Jones

The Independent Advisory Group is a group which still exists, which we have committed to, which continues to operate and we see as extremely valuable. It provides a representation from across a wide number of organisations, including the BMA, the RCGP and the BCS—

Charlotte Leslie

I understand the BMA IT Committee was disbanded and dis‑invited to discussions. Is that correct?

Max Jones

Not that I am aware of. We see IAG as continuing as being important. On the other hand, during this six‑month period it would be helpful, I think, for us to review those arrangements and see if there is anything we can do further to reassure the public that there is greater transparency and also that we have representative representation. That is something that we would want to do and will do during this period.