PHG Foundation response to the National Data Guardian for Health and Social Care’s public consultation about the Caldicott Principles and Caldicott Guardians.
The PHG Foundation welcomes the opportunity to respond to the NDG’s public consultation on the addition of an eighth Caldicott Principle; amendments to the existing principles to ensure that they are as clear as possible, consistent with other data sharing requirements and up-to-date, and; the proposal for use, by the NDG, of her statutory power to issue guidance about organisations appointing Caldicott Guardians.
Proposed revisions to the seven existing Caldicott Principles
We support these revisions to the existing Caldicott Principles. In particular we support: the addition of preliminary guidance that novel or difficult decisions about confidential information should involve a Caldicott Guardian; the definition of ‘confidential information’ as information collected ‘where patients and service users expect that it will be kept private’ as a reflection of the approach that has been taken by the courts, and; the removal of references to personal information, personal data and ‘data’ as a helpful way of distinguishing this guidance from potentially different considerations that are relevant to processing ‘personal data’ under the GDPR and DPA 2018.
We have some specific comments in relation to some of the revisions to the existing Caldicott Principles:
- The amended wording of Principle 2 is a helpful reformulation that is potentially less discouraging of the use of confidential information but still reflects the requirement of necessity.
- In Principle 5, we suggest that the final use of ‘patient’ should be plural.
- Principle 7: We are cautious about the inclusion of ‘direct care’ in this principle because we have some reservations about the concept of ‘direct care’ and how well this concept applies in challenging contexts, for example, in the context of rare, inherited genetic diseases. This is because work to understand the nature of a genetic change (mutation) and whether it is disease causing or not: may take place in a location that is remote from the patient; may involve examining the same change (mutation) in individuals who are unrelated to the patient by looking at both their genetic changes (genotype) and clinical symptoms, and because: understanding more about the genetic basis of disease through comparing both the genotype and clinical symptoms of the patient and those other individuals – is usually beneficial to both the patient and those other individuals, particularly if the disease is uncommon. As an alternative, the phrase ‘individual care’ could be preferable because it could be read as encompassing the care of another individual as well as the patient and we think that a statement ‘the duty to share information for individual care can be as important as the duty to protect patient confidentiality’ would not diminish the importance of patient confidentiality1.
Proposed extension of the Caldicott Principles through the introduction of an additional principle which makes clear that patients’ and service users’ expectations must be considered and informed when confidential information is used
We welcome the addition of an eighth principle to emphasise the importance of patients’ expectations and which establishes that there should be ‘no surprises’ for the public in regard to how their confidential information is being used. We have some comments on the proposed wording and principle:
- We are not sure that the phrase ‘inform the expectations of patients and service users about how their confidential information is to be used’ is as clear as it could be. Removing ‘the expectations’ could clarify that the principle is first and foremost about the need to provide information about how information is to be used: ‘inform patients and service users about how their confidential information is to be used’.
- We suggest that an explanation of the relevance of patients’ expectations could be included in the text below the principle title instead, for example: A range of steps should be taken to ensure ‘no surprises’ and that uses of confidential information are in line with the reasonable expectations of patients and service users about how their confidential information is to be used - these steps will vary depending on the use.
- We also suggest inclusion of the word ‘reasonable’ (as above) with expectations as a way of reflecting the courts more objective assessment of individual expectations of privacy and confidentiality.
The proposal that the NDG uses her statutory power to issue guidance about organisations appointing Caldicott Guardians to uphold the Caldicott Principles
We fully support the NDGs proposals to exercise her statutory power to issue guidance in the manner described in the consultation background document.