The need to protect the public against the spread of communicable (infectious) disease provides a good example of the need for a commonsense approach to the use of confidential data. Laboratories need to notify different professionals in order to trace the sources of outbreaks of infection and eradicate the cause. It is often not possible to obtain consent from individual patients, given the rapid time scale required. In doing so, however, laboratory staff and others would contravene the Data Protection Act in passing on information without consent. Section 60 of the Health and Social Care Act was designed to overcome barriers to research relying on data accumulated in the past and this type of public health work. But this is proving a sluggish procedure. It is an awkward solution to the problem of data use without specific consent. This problem will be overcome only when the public can have sufficient trust in safeguards that are in place to protect their safety and confidentiality so that these important activities can be pursued without specific informed consent.
Statistics from Altmetric.com
I want to talk about the very practical example of how to maintain an adequate system for detecting outbreaks of infectious disease and tracing the sources of such outbreaks without betraying patients' confidences; and specifically to discuss how section 60 of The Health and Social Care Act impinges on this problem.1 My qualifications for taking on this job are that I am chairman of the board of the Public Health Laboratory Service (PHLS), whose role is to protect the public from communicable disease, and also that I have a somewhat antipathetic attitude to the way section 60 of the act has been drawn up and is currently working. So my article will be entirely based on a practical example that is of such obvious importance to the wellbeing of society that the difficulties surrounding the apparent conflict have to be resolved. I say “apparent conflict” because I believe it is largely self inflicted.
I should perhaps first describe how the PHLS pursues its role of communicable disease surveillance and how it is so critically dependent on collaboration with—and communication between—large numbers of people, not least patients and the public.
When a patient is suspected of having an infectious disease, it is not always immediately apparent what infection it is or where it has come from. Indeed, in many cases it is not always apparent that there is an infection at all. The patient is simply ill. It is only when a specimen is taken from the patient and sent to a microbiology laboratory and the relevant tests are performed, that the nature of the infection is diagnosed. And indeed, in most instances, the laboratory does not detect anything at all of significance. Of the thousands, perhaps hundreds of thousands, of specimens which are sent in to microbiology laboratories each year, from primary care and from hospital wards, only a few will turn out to have an important infection which can be passed around—for example, meningitis, hepatitis, E coli 0157, salmonella, and so on. Although each of these organisms is found in only a fraction of the total number of specimens, they nevertheless total a considerable number across the country. Furthermore, they are particularly important from the public health point of view, because, having detected these organisms, it is then vitally important for their sources to be discovered, by tracing patients' contacts: where they have eaten or bought their food, drunk their water, and so on. That requires the mobilisation of a considerable number of professionals trained specifically for this purpose. The way the PHLS works is firstly, by being informed of a relevant infectious agent as rapidly as possible, often by telephone or electronically. Initial detection may take place in one of the PHLS's own microbiological laboratories, based in a network around the country, or in a National Health Service (NHS) trust laboratory. It is often necessary to carry out further highly specialised testing to narrow down the type of organism more fully, so that it becomes possible to say whether an organism found in one part of the country is the same or different from that which has been found in another part of the country. When they are typed or subtyped it becomes possible to say whether they have arisen from a common or disparate source. Once the organism has been identified and it is clear that there are a number of cases emerging from a number of laboratories, the epidemiological teams get to work notifying consultants in communicable disease control, environmental health officers, and general practitioners (GPs). Information is passed to various professionals, who go back to the patient and out into the field to examine food, water supply, contacts, and the like. It is a major exercise. It is heavily dependent on the rapid flow of information to the various bodies that can activate the response. Now that is all very well where the infection is a statutory notifiable disease. There is then a legal requirement to notify the disease to relevant bodies. But unfortunately, many—indeed most—infections are not notifiable and it is there that problems may arise.
Imagine the situation in which a laboratory technician, working on the hundred or so specimens that have been sent in that day from a range of patients, detects an organism E coli 0157, which is a significant cause of serious ill health and is derived from food. This is potentially serious and he and his laboratory do not know if other cases are being picked up in other laboratories in his region or elsewhere. His immediate response should be to inform the PHLS and the communicable disease control consultant and possibly the environmental health officer. The PHLS keeps a record of all similar cases being recorded and will probably seek further typing to see whether the organism detected resembles others being detected elsewhere. The laboratory, and the communicable disease control consultant, will try to contact the GP. If it is a weekend they may not be able to do so. In any event they need to contact the patient to find out what he or she had been eating and where the food was obtained. They also need to test members of the family and other close contacts, and to check whether any have eaten similar foods, either from a restaurant or from a food store. An enormous amount of detective work is then pursued.
Time is of the essence and rapid reporting is required. But here the problem arises of having to obtain informed consent from the patient before being able to pass on the essential information to these anxious professionals. General practitioners are unlikely to have asked every one of their patients for consent to their being contacted if they contract, what would be to them, a rare type of infection. They would not wish to alarm their patients when the probability is high that they would not have this infection. Furthermore, it may well not be possible for the GP to go back to the patient to seek permission for all this work to be going on. The GP may not be available or the patient may have gone away; and yet public protection is of the essence.
Where infections are not in the notifiable class, we have to face up to the problem of whether it is legitimate to pass on information about a patient in the absence of informed consent. This is already a real problem because laboratory staff are becoming reluctant to report, and feel increasingly inhibited by fears of the General Medical Council (GMC) and the Data Protection Act. They can take three different approaches. Firstly, they can ignore the Data Protection Act and the GMC in the belief that they are acting in the best interests of society and of their patients by notifying the nature of an infection to the relevant bodies. Secondly, they can simply stop reporting until consent is obtained, thereby risking the spread of infection to more people. Finally, they can appeal under section 60 for permission to report.
Section 60 could, in theory at least, be helpful and indeed I was very supportive of its principles, if not its practice, when it was passing through the Lords last year. Unfortunately it involves a process so tortuous and bureaucratic that it has yet to allow any activity of this nature to be undertaken without specific consent, despite the fact that the Data Protection Act was re-enforced from October last year.
Let me remind you of what is involved in section 60. Where it has not been possible to obtain prior informed consent to pass information on to someone not directly concerned with the care of the patient, or to undertake research using such information, it is necessary to gain permission under section 60. This involves firstly, the approval of a local research ethics committee, then application to officials in the Department of Health, who then pass it on (if it is acceptable to them) to the Patients' Information Advisory Group. If accepted at that stage, there is then a period of two or three months public consultation and if, at the end of that process, the Patients' Information Advisory Group finally accepts a proposal, they make a recommendation to the Secretary of State, who then has to gain the approval of both the House of Commons and the House of Lords. This incredibly bureaucratic and long drawn out process can clearly take many months and imposes many hurdles. The surveillance work of the PHLS is regarded as a service, is not classified as research, and does not require research ethics committee approval. Nevertheless, its application under section 60, submitted in October 2001, is still in February 2002 working its way through the system. On a more positive note, the proposition that a separate application would have to be made for each and every infection has been abandoned and it has been accepted that a single application will serve for the class of infectious diseases as a whole. This ability to submit single applications for classes of research has also been accepted. While this is to be welcomed, the requirement to resubmit applications—and to go through the whole process again—every year is not!
When section 60 was introduced, it was proposed as a temporary measure in the belief that, in future, informed consent would always be obtained. It is, however, obvious from the description of communicable disease surveillance that I have given, that there will always be many cases where prior informed consent will not be possible.
It has been suggested that, as the public become better informed about what happens to their data within the health service, they will come to accept that this sort of work can go on without specific prior consent. The Department of Health offered to embark on a very active educational programme for the public. This has not yet happened but the PHLS is embarking on its own public educational programme with notices in GP surgeries, in hospitals, in libraries, and the like. It is quite unclear, however, whether general public knowledge of the uses to which their data is put will be sufficient for it to be construed that they have given informed consent. It seems to me that this problem will remain unless members of the public move to a more accepting, trusting, and altruistic understanding of their responsibilities to society as well as of their individual rights. But, even then, the law and its interpretation would need to allow it.
I believe that the public at large is generally happy with the idea that information about them can be used for research and for the public good, providing that they can be reassured that they will not be embarrassed or harmed by this activity. This has certainly been historically true. Despite a careful search, I have failed to discover any evidence of harm or embarrassment accruing to any patient as a result of information about them being used for communicable disease control in the past. Although it seems intrinsically unlikely that future examples will be found, public distrust has grown in recent times and it will clearly be important to put in place the stringent reassurances that the public requires. At the end of the day however, the activities of the PHLS and of researchers will require a degree of altruism and responsibility in society. I believe that this exists but it is currently overlain by legal and bureaucratic systems which are supposed to serve the population, but which, in the event, may pose a threat of greater damage to individuals than it will prevent.
In short, we need more common sense. It seems to me that we desperately need more open debate and with a much wider public than those who hitherto have claimed to articulate the views of the public. I believe that if common sense does prevail it will allow us to move into a position of common, and presumed, consent. That will require the trust of the public that they are protected from harm; and that trust can only be gained if they are reassured by robust safeguards. I personally believe that the current safeguards (namely section 60) are unreasonable and that they act against the best interests of society as a whole and of the individuals within it. There is much work to do in public debate and in appreciation of the issues at stake by all parties if we are to reach a position that is acceptable, realistic, and conforms with common sense.
Dr Ron Zimmern from the public health genetics unit in Cambridge pointed out that doctors and other medical staff have to get consent to take samples from patients who are sick. It is at this point that patients could give consent for their data to be shared with the PHLS. If there are worries about confidentiality, couldn't the argument be used that sharing this information was in the public interest? It is not as if the information about individuals is going to be broadcast on the TV!
Leslie Turnberg agreed but added that the reality was that, in doctors' surgeries and in clinical laboratories, fear would prevent people from passing that information on. As a result of the Data Protection Act, and following warnings issued by the GMC, there is widespread fear of prosecution. It may be irrational, but it is real and it is having an impact.
Cyril Chantler responded to this on behalf of the GMC, saying it was important for infections to be traced, and that the GMC has said nothing out of tune with the sentiments expressed by Ron Zimmern. The GMC was just passing on the advice of their lawyers. As the law stands, it protects patients whose confidentiality may be broken, even if this is in the interests of public health. The law does not protect those who pass such information on. If the PHLS was having problems it should not seek to blame the GMC as they were not the enemy! They were just seeking to inform and protect their members.
Phil Walker from the Department of Health explained that the law was not as cumbersome and obstructive as some speakers seem to feel it is. For example, applications for data sharing for projects do not need to be made anew every year; they are simply to be reviewed each year. Section 60 may not be ideal, but it is merely a stopgap whilst the process of administering the new data protection legislation in relation to public health is sorted out.
Leslie Turnberg thanked him for his explanation, but reiterated that there was still anxiety in this whole area and particularly in relation to using data for secondary research.
If you wish to reuse any or all of this article please use the link below which will take you to the Copyright Clearance Center’s RightsLink service. You will be able to get a quick price and instant permission to reuse the content in many different ways.