To ask the Scottish Executive whether it will list the parties who have access to a patient’s medical records without (a) explicit authorisation and (b) the information being anonymised and whether changes have been made to these lists in each year since 1999, identifying these changes.
Personal health information isprotected by the Data Protection Act and the common law duty of confidentiality.
NHS staff and contractors areauthorised to use personal health information for a range of activities necessaryto the provision of care and treatment, including medical diagnosis, patient care,planning, statistics, payment, clinical governance, clinical and financial audits.Unauthorised individuals are not given access to personal health information.
NHS organisations take stepsto protect personal health information from unauthorised access, such as controllingphysical access to medical records libraries and putting password protection onelectronically stored personal health information. As records are increasingly movedto an electronic storage medium, there are opportunities to not only make accesscontrols clearer, but also to audit access to the information. These issues arebeing considered within the Scottish Government’s eHealth programme.
Personal health information,once anonymised so that a patient is no longer identifiable, is not protected bythe common law duty of confidentiality or the Data Protection Act. Patients havea right to know when it is intended that their information will be anonymised forappropriate purposes, such as medical research, and NHS organisations have mechanismsin place to approve the use of anonymised data for research purposes.