Introduction

The first part of this commentary considers the statutory powers of the NHS Commissioning Board (the Board) to share information about patients in connection with matters of interest to the police and other public protection agencies.

Following on from this, this commentary then considers developments in the common law due to the influence of the European Court of Human Rights have created a new landscape for the lawful sharing of personal information for the purposes of public protection. This commentary considers the new statutory powers of the Board in the light of these developments in relevant case law.

The NHS Commissioning Board and its statutory powers to share information in public protection contexts

The Board is an important body within the NHS; indeed, it is the most senior body within the new NHS structure brought about by reforms under the Health and Social Care Act 2012.

Given reforms under the 2012 Act, section 2 of the National Health Service Act now reads as a ‘general power’, in that:

‘The Secretary of State, the Board or a clinical commissioning group may do anything which is calculated to facilitate, or is conducive or incidental to, the discharge of any function conferred on that person by this Act’.

As Grace and Taylor have noted, the Board can use the national Health and Social Care Information Centre (the Information Centre) to obtain confidential information about individuals from NHS patient records in an efficient, centralised manner.J. Grace and M.J. Taylor, ‘Disclosure of Confidential Patient Information and the Duty to Consult: The Role of the Health and Social Care Information Centre’, Medical Law Review 0 (2013): 1-33, 16, (published online 29 March 2013 doi: 10.1093/medlaw/fwt.013).

There are limits on how the Information Centre can disclose information that identifies, say, individual NHS patients. One exception to the statutory rule that prohibits identifiable patient information from being disclosed by or with the assistance of the Information Centre is where the Information Centre may be helping another body, namely the Board, fulfil any statutory duties under section 254 of the Health and Social Care Act 2012.

As a result, the Board may come into possession of confidential patient information gathered from any part of the NHS. It may search for this information in response to a request from an agency concerned with public protection, such as the police or local authorities.

The Secretary of State for Health (Health Secretary) has a broad duty to protect public health, under section 2A of the NHS Act 2006 as amended:

‘(1) The Secretary of State must take such steps as the Secretary of State considers appropriate for the purpose of protecting the public in England from disease or other dangers to health’.

The Health Secretary can do this by providing ‘information and advice’ under section 2A (1)(f) of the 2006 Act, and in essence, the Board can do this on behalf of the Health Secretary, through its ‘mandate’ under section 13A of the Act.

Since 27 March 2013, the Board has had broad powers to disclose information in pursuit of the notion of public protection, as section 13Z3 of the NHS Act 2006 states that:

‘(1) The Board may disclose information obtained by it in the exercise of its functions if –

1. the information has previously been lawfully disclosed to the public,

2. the disclosure is made under or pursuant to regulations under section 113 or 114 of the Health and Social Care (Community Health and Standards) Act 2003 (complaints about health care or social services),

3. the disclosure is made in accordance with any enactment or court order,

4. the disclosure is necessary or expedient for the purposes of protecting the welfare of any individual,

5. the disclosure is made to any person in circumstances where it is necessary or expedient for the person to have the information for the purpose of exercising functions of that person under any enactment,

6. the disclosure is made for the purpose of facilitating the exercise of any of the Board's functions,

7. the disclosure is made in connection with the investigation of a criminal offence (whether or not in the United Kingdom), or

8. the disclosure is made for the purpose of criminal proceedings (whether or not in the United Kingdom)’.

However, subsection (2) of section 13Z3 of the 2006 Act goes on to state that:

‘(2) Paragraphs (a) to (c) and (h) of subsection (1) have effect notwithstanding any rule of common law which would otherwise prohibit or restrict the disclosure’.

This commentary focuses on the idea that the ‘disclosure is necessary or expedient for the purposes of protecting the welfare of any individual’ under section 13Z3(1)(d), where it is thus disclosure of some public protection-related information from the Board (which will have gathered or requested if from the Information Centre) to the police, a local authority or some other public protection agency.

In this context ‘public protection risk information’ (PPRI) is taken to be ‘patient information’ as defined under the Health and Social Care Act 2012. This cross-refers to section 20A of the Health and Social Care Act 2008, which provides that:

‘“patient information” means –

1. information (however recorded) which relates to the physical or mental health or condition of an individual (P), to the diagnosis of P's condition or to P's care or treatment, and

2. information (however recorded) which is to any extent derived, directly or indirectly, from that information, whether or not the identity of the individual in question is ascertainable from the information’.

However, this broadly conceived extent of ‘patient information’ then becomes PPRI when it is shared with a public protection agency for a particular purpose – that is to say, public protection – in protecting children or vulnerable adults, or victims of abuse or sexual harm, domestic violence, and so on.

The wider legal framework for information sharing in contexts of public protection

Information sharing by public bodies undertaken for public protection purposes must occur on some lawful basis, such as through the use of (implied or explicit) statutory powers, or through the use of some common law powers. For example, as underpinned by statute, the police and local authorities regularly share information related to alleged antisocial behaviour under section 115 of the Crime and Disorder Act 1998.

Much PPRI that is patient information will be confidential. As a result, where the Board shares patient information – perhaps the nature of injuries sustained during a domestic violence incident – with the police, this will mean sharing confidential information, which is protected under the common law by the doctrine of confidentiality. Since such information would have been passed from the patient to the medical practitioner, it is not trivial information and if shared inappropriately would lead to an actionable harm (say the resulting loss of trust family and peers would have in the alleged perpetrator of the domestic violence). There is also the possibility that a tortious claim might be brought for the ‘misuse of private information’, following Campbellv. MGN Ltd [2004] UKHL 22, on the basis of a ‘reasonable expectation of privacy’.

However, public policy grounds might limit the scope of the tort of misuse of private information. Claims for breach of confidence can be defended using the public interest argument, which is essentially that the public interest in the PPRI remaining confidential, and thus not being shared, outweighs the public interest in it remaining private.

These qualifications in the common law of tort and of confidentiality suggest that, as the court found in W v. Egdell [1990] Chapter 359, there is enough substance in the common law to support the sharing of PPRI from the medical or healthcare context to another context, i.e. the remit or work of a public protection agency.

In terms of statutory powers, if the sharing of PPRI is viewed as a means to prevent or detect crime, then the provisions of section 29 of the Data Protection Act 1998 might be said to provide an implied statutory power to share (or in the language of data protection to ‘process’) information that is an example of such ‘sensitive personal data’ for these two important reasons.

However, it must be impracticable to obtain the permission of the ‘data subject’ described by the information, and sharing the PPRI must protect the vital interests of either the ‘data subject’ or a third party (possibly a child of the injured victim of domestic violence, with regard to the example given above).

At this point the provisions empowering the sharing of PPRI by the Board or on its behalf may seem superfluous. However, the impact of a particular interpretation of Article 8 of the European Convention on Human Rights (ECHR) has made them essential.

A recent line of case law relevant to information sharing in contexts of public protection

The Human Rights Act 1998 transposed certain rights from the ECHR into UK law, among them Article 8 ECHR. This states:

1. ‘Everyone has the right to respect for his private and family life, his home and his correspondence.

2. There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others’.

Sharing PPRI from NHS contexts for use by public protection networks or agencies would engage the Article 8 ECHR rights of an individual or a group of people connected to that information or because of the inferences and implications that could be drawn from it.See the broad discussion of the nature of ECHR Art. 8 in R (on the application of H) v. A City Council [2011] EWCA Civ 403.

What is more, influenced by judicial discussion in the European Court of Human Rights of potential risks of stigmatisation by state information sharing practices,S and Marper v. the UK (4 December 2008). the UK courts have begun to develop a right to consultation,Munby LJ in R (on the application of H) v. A City Council (n 2) [50-52]. limited to where this would be practicableR (B) v. The Chief Constable of Derbyshire Constabulary [2011] EWHC 2362 (Admin). upon which potential claimants could draw on if they thought that PPRI connected to them was being shared across public protection networks and among agencies without their knowledge or involvement.

There is also a difficult line to tread between sharing PPRI that speaks of (alleged) criminality on the part of a ‘risky’ individual, and sharing PPRI that speaks of immoral behaviour, or behaviour that is outside commonly accepted social norms.

While the former might well be lawfully justified on public protection grounds of preventing or detecting crime, particularly when procedural rights have been upheld in satisfaction of the engagement of Article 8 ECHR, as noted above, with regard to the latter, the High Court at least has determined that sharing information about immoral but non-criminal behaviour with an individual’s employer would be unlawful, as a disproportionate interference with Article 8 ECHR.R (A) v. B [2010] EWHC 2361 (Admin).

When we look at the statutory power of the Board in relation to sharing PPRI, found in section 13Z3(1)(d) of the NHS Act 2006, we can see that there is no emphasis on the procedural rights of an alleged offender, ‘risky’ individual, etc., only that the sharing of the patient information as PPRI is a disclosure that is ‘necessary or expedient for the purposes of protecting the welfare of any individual’. This is a statutory vulnerability to the lawful use of the Board’s powers to share PPRI, given the body of case law that is now developing.

Conclusion

Public protection-motivated sharing of information needs to be slicker and more efficient, not more cumbersome, if joined-up government styles are going to be one potential route out of the mire faced by underfunded public protection agencies and networks.See M. Nash, ‘Cut Price Public Protection?’, The Howard Journal 51, no. 3 (July 2012) 261-273.

Both the NHS and the Board need to be conscious of the enhanced procedural rights from which alleged offenders and ‘risky’ individuals benefit under the common law, infused as it is today with newly-interpreted values from Article 8 ECHR. As Jane Fenton notes: ‘it may be that, in reality, we are still a long way from the necessary and explicit acknowledgement that the human rights of the offender are as essential a consideration as risk assessment and public protection’.J. Fenton, ‘Risk Aversion and Anxiety in Scottish Criminal Justice Social Work: Can Desistance and Human Rights Agendas Have an Impact?’, The Howard Journal 52, no. 1 (February 2013): 77-90, 87.