(1) Section 265 of the Public Health Act 1875 (which relates to the protection of members and officers of certain authorities from personal liability) has effect as if there were included in the authorities referred to in that section a reference to NICE.
(2) In its application to NICE as provided for by subsection (1), section 265 of that Act has effect as if any reference in that section to the Public Health Act 1875 were a reference to this Act.
In this Part—
...
“health care” has the meaning given by section 240(4);
“the health service” has the same meaning as in the National Health Service Act 2006 (see section 275(1) of that Act);
“health services” has the meaning given by section 233(3);
“NHS services” has the meaning given by section 234(11);
“public health services” has the meaning given by section 234(11);
“quality standard” has the meaning given by section 234(2);
“social care” has the meaning given by section 233(3).
(1) Schedule 17 (which contains consequential provision) has effect.
(2) A statement of standards prepared and published by the Institute before commencement is to be treated on and after commencement as if it were a quality standard—
(a) prepared and published by NICE in accordance with section 234,
(b) endorsed under subsection (5) of that section, and
(c) in respect of which the transitional commissioner is the relevant commissioner for the purposes of that section.
(3) Subsections (4) to (6) apply to a case where before commencement—
(a) the Secretary of State has referred a matter to the Institute for the purpose of preparing and publishing a statement of standards, but
(b) the Institute has not published the statement.
(4) The referral by the Secretary of State to the Institute of the matter is to be treated on and after commencement as if it were a direction given to NICE by the transitional commissioner for the preparation of a quality standard in relation to that matter under section 234(1); and the transitional commissioner is to be treated as the relevant commissioner for the purposes of that section.
(5) Anything done by the Institute before commencement in relation to the matter is to be treated on and after commencement as having been done by NICE in pursuance of the direction.
(6) Consultation with any person undertaken by the Institute before commencement in relation to the matter is to be treated on and after commencement as if it were consultation by NICE under section 234(3) in relation to the preparation of the quality standard.
(7) A procedure established by the Institute before commencement for the preparation of statements of standards is to be treated on and after commencement as if it were a procedure established by NICE in accordance with section 234(7) for the preparation of quality standards.
(8) For the purposes of this section “the transitional commissioner” is the Secretary of State; but the Secretary of State, after consulting NHS England, may direct that in relation to a particular statement of standards or matter the transitional commissioner is—
(a) NHS England, or
(b) both the Secretary of State and NHS England.
(9) In this section—
“commencement” means the commencement of section 234;
“the Institute” means the Special Health Authority known as the National Institute for Health and Clinical Excellence;
“statement of standards” means a document containing advice to the Secretary of State in relation to the quality of the provision of health care prepared and published by the Institute pursuant to the directions given to the Institute by the Secretary of State on 27 July 2009.
(1) The Secretary of State or NHS England may prepare and publish an information standard.
(2) For the purposes of this Part “an information standard” is a standard in relation to the processing of information and includes, among other things, a standard relating to information technology or IT services used, or intended to be used, in connection with the processing of information (see section 250A).
(2A) An information standard must specify to whom it applies.
(2B) An information standard may apply to one or more persons falling within the following paragraphs—
(a) the Secretary of State;
(b) NHS England;
(c) a public body which exercises functions in connection with the provision in, or in relation to, England of health care or of adult social care ...;
(d) any person, other than a public body, who is required to be registered under Chapter 2 of Part 1 of the Health and Social Care Act 2008 in respect of the carrying on of a regulated activity (within the meaning of Part 1 of that Act).
(e) a relevant IT provider.
(3) The Secretary of State may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision in, or in relation to, England of health care or of adult social care ....
(4) NHS England may exercise the power under subsection (1) only in relation to information concerning, or connected with, the provision of NHS services.
(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(6) The Secretary of State must—
(a) have regard to any information standard published by NHS England that applies to the Secretary of State, and
(b) comply with any information standard published by the Secretary of State that applies to the Secretary of State.
(6A) Any other person to whom an information standard published under this section applies must comply with the information standard, except in so far as the requirement to comply is waived (see subsection (6B)).
(6B) Regulations may confer on a person who publishes an information standard the power to waive a person’s requirement to comply with the information standard (in whole or in part and generally or for a specific period).
(6C) The regulations may include provision—
(a) limiting the circumstances in which waivers may be granted;
(b) setting out the procedure to be followed in connection with waivers;
(c) requiring an information standard to include specified information about waivers.
(6D) For enforcement of information standards against persons other than public bodies, see section 277E.
(d) any person (other than a public body) who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care.
(7) In this Chapter—
“adult social care”—
includes all forms of personal care and other practical assistance provided for individuals who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or other assistance, but
does not include anything provided by an establishment or agency for which Her Majesty's Chief Inspector of Education, Children's Services and Skills is the registration authority under section 5 of the Care Standards Act 2000;
“health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition;
“information technology” includes—
computers,
other devices whose uses include the processing of information by electronic means (“IT devices”),
parts, accessories and other equipment made or adapted for use in connection with computers or IT devices,
software and code made or adapted for use in connection with computers or IT devices, and
networks and other infrastructure (whether physical or virtual) used in connection with other information technology;
“IT service” means an information technology service, including any service (whether physical or virtual) which consists of, or is provided in connection with, the development, making available, operation or maintenance of information technology;
...
“NHS services” means services the provision of which is arranged by NHS England or an integrated care board (including services the provision of which is arranged by it in the exercise of functions of another person by virtue of any provision of the National Health Service Act 2006);
“processing” has the same meaning as in Parts 5 to 7 of the Data Protection Act 2018 (see section 3(4) ... of that Act);
“public body” means a body or other person whose functions—
are of a public nature, or
include functions of that nature,
but in the latter case, the body or person is a public body to the extent only of those functions.
“relevant IT provider” means a person involved in marketing, supplying, providing or otherwise making available—
information technology,
an IT service, or
a service which consists of processing information using information technology,
whether for payment or free of charge, but only so far as the technology or service is used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.
(1) An information standard relating to information technology or IT services may, among other things, make provision about—
(a) the design, quality, capabilities or other characteristics of such technology or services;
(b) contracts or other arrangements under which such technology or services are marketed, supplied, provided or otherwise made available.
(2) An information standard may include technical provision about information technology or IT services, including provision about—
(a) functionality;
(b) connectivity;
(c) interoperability;
(d) portability;
(e) storage of, and access to, information;
(f) security of information.
(3) An information standard may make provision by reference to open standards or proprietary standards.
(1) Regulations—
(a) must make provision about the procedure to be followed in connection with the preparation and publication of information standards under section 250;
(b) may require an information standard published under section 250 to be reviewed periodically in accordance with the regulations.
(2) Before laying a draft of regulations under subsection (1) before either House of Parliament, the Secretary of State must consult such persons as the Secretary of State considers appropriate.
(3) The power under section 250(1) may be exercised by—
(a) adopting an information standard prepared or published by another person, including as it has effect from time to time, or
(b) making provision by reference to an international agreement or another document, including as it has effect from time to time.
(1) The Secretary of State may require a person to provide the Secretary of State with documents, records or other information for the purposes of monitoring the person’s compliance with information standards published under section 250.
(2) A requirement under subsection (1) may specify—
(a) the form and manner in which information is to be provided, and
(b) when information is to be provided.
(3) A requirement under subsection (1) must be in writing.
(4) For enforcement of requirements under subsection (1) against persons other than public bodies, see section 277E.
251ZB Notice requesting compliance by relevant IT providers
(1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may give the provider a written notice which—
(a) identifies the standard in question,
(b) sets out the Secretary of State’s grounds for suspecting that the provider is not complying with the standard,
(c) asks the provider to comply with the standard within a period specified in the notice,
(d) asks the provider, within a period specified in the notice, to provide evidence to the Secretary of State’s satisfaction that the provider is complying with the standard, and
(e) if the Secretary of State considers it appropriate, sets out the steps that the Secretary of State considers the provider must take, within a period specified in the notice, in order to comply with the standard.
(2) A period specified for the purposes of subsection (1)(c), (d) or (e) must be a period of at least 28 days beginning with the day on which the notice is given.
(3) The Secretary of State may, by giving the relevant IT provider a further written notice, vary or revoke a notice given under subsection (1).
(1) If the Secretary of State has reasonable grounds to suspect that a relevant IT provider is not complying with an information standard which applies to the provider, the Secretary of State may publish a statement to that effect.
(2) The statement may include the text of a notice given to the provider under section 251ZB.
(3) Before publishing a statement under this section, the Secretary of State must give the relevant IT provider—
(a) a copy of the terms of the proposed statement, and
(b) an opportunity to make representations about the decision to publish a statement and the terms of the statement.
(4) If, after considering any representations, the Secretary of State decides to publish the statement, the Secretary of State must inform the relevant IT provider before publishing it.
(5) This section does not authorise the processing of information if the processing would contravene the data protection legislation (but in determining whether it would do so, take into account the power conferred by this section).
(6) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
251ZD Exercise of functions of Secretary of State by other persons
(1) The Secretary of State may—
(a) direct a public body to exercise some or all of the functions listed in subsection (3), and
(b) give the public body directions about the exercise of those functions, including directions about the processing of information that the body obtains in exercising those functions.
(2) The Secretary of State may make arrangements for a person prescribed by regulations under this subsection to exercise some or all of the functions listed in subsection (3).
(3) Those functions are—
(a) the Secretary of State’s functions under section 251ZA, so far as they relate to relevant IT providers, and
(b) the Secretary of State’s functions under section 251ZB.
(4) Arrangements under subsection (2) may—
(a) provide for the Secretary of State to make payments to the person, and
(b) make provision as to the circumstances in which such payments are to be repaid to the Secretary of State.
(5) Section 304(9) applies in relation to the power to make arrangements under subsection (2) as it applies to a power of the Secretary of State to give directions under this Act.
(1) Regulations may make provision for the establishment and operation of a scheme for the accreditation of information technology and IT services so far as used, or intended to be used, in connection with the provision in, or in relation to, England of health care or of adult social care.
(2) The regulations may provide for the scheme to be established and operated by a person specified in the regulations (“the operator”).
(3) The regulations may, among other things, confer power on the operator—
(a) to establish the procedure for accreditation under the scheme,
(b) to set the criteria for accreditation under the scheme (“the accreditation criteria”),
(c) to keep an accreditation under the scheme under review, and
(d) to charge a reasonable fee in respect of an application for accreditation.
(4) The regulations may, among other things, make provision requiring the operator—
(a) to set some or all of the accreditation criteria by reference to information standards,
(b) to publish details of the scheme, including the accreditation criteria,
(c) to provide for the review of a decision to refuse an application for accreditation, and
(d) to provide advice to applicants for accreditation with a view to ensuring that the accreditation criteria are met.
(1) The Secretary of State must by regulations specify a description of consistent identifier for the purposes of this section.
(2) “Consistent identifier” means any identifier (such as, for example, a number or code used for identification purposes) that—
(a) relates to an individual, and
(b) forms part of a set of similar identifiers that is of general application.
(3) Subsection (4) applies if—
(a) a relevant health or adult social care commissioner or provider (“the relevant person”) processes information about an individual, and
(b) the individual is one to whom a consistent identifier of the description specified under subsection (1) relates.
(4) If this subsection applies the relevant person must include the consistent identifier in the information processed (but this is subject to subsections (5) to (8)).
(5) Subsection (4) applies only so far as the relevant person considers that the inclusion is—
(a) likely to facilitate the provision to the individual of health services or adult social care in England, and
(b) in the individual's best interests.
(6) The relevant person need not comply with subsection (4) if the relevant person reasonably considers that one or more of the following criteria apply—
(a) the relevant person does not know the consistent identifier and is not reasonably able to learn it;
(b) the individual objects, or would be likely to object, to the inclusion of the consistent identifier in the information;
(c) the information concerns, or is connected with, the provision of health services or adult social care by an anonymous access provider;
(d) for any other reason the relevant person is not reasonably able, or should not be required, to comply with subsection (4).
(7) This section does not permit the relevant person to do anything which, but for this section, would be inconsistent with—
(a) any provision of the data protection legislation, or
(b) a common law duty of care or confidence.
(8) This section does not require the relevant person to do anything which the relevant person is required to do by or under provision included in a contract by virtue of any provision of the National Health Service Act 2006 (and, accordingly, any such requirement is to be treated as arising under the contract, and not under this section).
(9) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
(1) This section applies in relation to information about an individual that is held by a relevant health or adult social care commissioner or provider (“the relevant person”).
(2) The relevant person must ensure that the information is disclosed to—
(a) persons working for the relevant person, and
(b) any other relevant health or adult social care commissioner or provider with whom the relevant person communicates about the individual,
but this is subject to subsections (3) to (6).
(3) Subsection (2) applies only so far as the relevant person considers that the disclosure is—
(a) likely to facilitate the provision to the individual of health services or adult social care in England, and
(b) in the individual's best interests.
(4) The relevant person need not comply with subsection (2) if the relevant person reasonably considers that one or more of the following apply—
(a) the individual objects, or would be likely to object, to the disclosure of the information;
(b) the information concerns, or is connected with, the provision of health services or adult social care by an anonymous access provider;
(c) for any other reason the relevant person is not reasonably able, or should not be required, to comply with subsection (2).
(5) This section does not permit the relevant person to do anything which, but for this section, would be inconsistent with—
(a) any provision of the data protection legislation, or
(b) a common law duty of care or confidence.
(6) This section does not require the relevant person to do anything which the relevant person is required to do under a common law duty of care (and, accordingly, any such requirement is to be treated as arising under that common law duty and not under this section).
(7) In this section, “the data protection legislation” has the same meaning as in the Data Protection Act 2018 (see section 3 of that Act).
(1) This section applies for the purposes of sections 251A and 251B and this section.
(2) “Relevant health or adult social care commissioner or provider” means—
(a) any public body so far as it exercises functions in connection with the provision of health services, or of adult social care in England, and
(b) any person (other than a public body) so far as the person provides such services or care—
(i) pursuant to arrangements made with a public body exercising functions in connection with the provision of the services or care, and
(ii) otherwise than as a member or officer of a body or an employee of a person,
but this is subject to subsection (3).
(3) The Secretary of State may by regulations provide for a person to be excluded from the definition of “relevant health or adult social care commissioner or provider”, whether generally or in particular cases.
(4) Regulations under subsection (3) may, in particular, provide for a person to be excluded in relation to the exercise of particular functions or the exercise of functions in relation to particular descriptions of person, premises or institution.
(5) A reference to an inclusion or a disclosure being likely to facilitate the provision to an individual of health services or adult social care in England is to its being likely to facilitate that provision directly (rather than by means of a clinical trial, a study, an audit, or any other indirect means).
(6) “Anonymous access provider” means a relevant health or adult social care commissioner or provider (whether “the relevant person” under section 251A(3)(a) or 251B(1) or another person) whose services or care are, or may be, received by individuals anonymously due to the nature of the services or care.
(6A) “Health services” means services which must or may be provided as part of the health service in England; and for that purpose “the health service” has the same meaning as in the National Health Service Act 2006 (see section 275(1) of that Act).
(7) “Adult social care” and “public body” have the same meaning as in section 250; and “processes” and “processed” are to be read in accordance with the meaning of “processing” in that section.
(1) NHS England must have regard to the following when exercising its relevant data functions other than those under the Medicines and Medical Devices Act 2021—
(a) the information standards published by the Secretary of State or NHS England under section 250,
(b) such guidance issued by the Secretary of State as the Secretary of State may require,
(c) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(ca) the need to respect and promote the privacy of recipients of health services and of adult social care in England, ...
(cb) the need to promote the effective and efficient planning, development and provision of health services and of adult social care in England,
(d) the need to promote the effective, efficient and economic use of resources in the provision of health services and of adult social care in England , and
(e) the need to balance the needs mentioned in this subsection against one another, so far as they compete.
(2) NHS England must seek to minimise the burdens it imposes on others when exercising its relevant data functions other than those under the Medicines and Medical Devices Act 2021.
(2A) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(3) In this Chapter—
“adult social care”—
includes all forms of personal care and other practical assistance provided for individuals who, by reason of age, illness, disability, pregnancy, childbirth, dependence on alcohol or drugs, or any other similar circumstances, are in need of such care or other assistance, but
does not include anything provided by an establishment or agency for which Her Majesty's Chief Inspector of Education, Children's Services and Skills is the registration authority under section 5 of the Care Standards Act 2000;
“health services” means services which must or may be provided as part of the health service in England.
“relevant data functions”, in relation to NHS England, means functions conferred on NHS England by or under—
this Chapter and Chapter 3;
regulations 15 and 16 of the Local Authority (Public Health, Health and Wellbeing Boards and Health Scrutiny) Regulations 2013;
section 2 of the Access to Medical Treatments (Innovation) Act 2016;
sections 7A and 19 of the Medicines and Medical Devices Act 2021.
254 Powers to direct NHS England to establish information systems
(1) The Secretary of State ... may direct NHS England to establish and operate a system for the collection or analysis of information of a description specified in the direction.
(2) A direction may be given under subsection (1) by the Secretary of State only if—
(a) the Secretary of State considers that the information which could be obtained by complying with the direction is information which it is necessary or expedient for the Secretary of State to have in relation to the exercise by the Secretary of State of the Secretary of State's functions in connection with the provision of health services or of adult social care in England, or
(b) the Secretary of State otherwise considers it to be in the interests of the health service in England or of the recipients or providers of adult social care in England for the direction to be given.
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) Before giving a direction under subsection (1) the Secretary of State ... must consult NHS England.
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
255 Powers to request NHS England to establish information systems
(1) Any person (including a devolved authority) may request NHS England to establish and operate a system for the collection or analysis of information of a description specified in the request.
(2) A request may be made under subsection (1) by a person only if the person considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the person to have in relation to the person's exercise of functions, or carrying out of activities, in connection with the provision of health care or adult social care.
(3) NHS England must comply with a mandatory request unless NHS England considers that the request relates to information of a description prescribed in regulations.
(4) For the purposes of this Chapter a request under subsection (1) is a mandatory request if—
(a) it is made by a principal body, and
(b) the body considers that the information which could be obtained by complying with the request is information which it is necessary or expedient for the body to have in relation to its discharge of a duty in connection with the provision of health services or of adult social care in England.
(5) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(6) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(7) Subsection (8) applies where NHS England has discretion under this section as to whether to comply with—
(a) a mandatory request, or
(b) other request under subsection (1).
(8) In deciding whether to comply with the request, NHS England—
(a) must, in particular, consider whether doing so would interfere to an unreasonable extent with the exercise by NHS England of any of its functions, and
(b) may take into account the extent to which the principal body or other person making the request has had regard to—
(i) the code of practice prepared and published by NHS England under section 263, and
(ii) advice or guidance given by NHS England under section 265.
(9) In this section “principal body” means—
(a) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(b) the Care Quality Commission,
(c) the National Institute for Health and Care Excellence, and
(d) such other persons as may be prescribed in regulations.
(10) In this Chapter “health care” includes all forms of health care whether relating to physical or mental health and also includes procedures that are similar to forms of medical or surgical care but are not provided in connection with a medical condition.
256 Requests for collection under section 255: confidential information
(1) A request under section 255 is a confidential collection request if it is a request for NHS England to establish and operate a system for the collection of information which is in a form which—
(a) identifies any individual to whom the information relates who is not an individual who provides health care or adult social care, or
(b) enables the identity of such an individual to be ascertained.
(2) A person may make a confidential collection request under section 255 only if the request—
(a) is a mandatory request,
(b) relates to information which the person making the request (“R”) may require to be disclosed to R or to NHS England by the person holding it, or
(c) relates to information which may otherwise be lawfully disclosed to NHS England or to R by the person holding it.
(1) NHS England must publish procedures for—
(a) the making and consideration of requests under section 255, and
(b) the reconsideration by NHS England of a decision not to comply with such a request.
(2) The procedure mentioned in subsection (1)(b) must provide for the person who made the request to have an opportunity to make representations to NHS England within a reasonable period for the purposes of the reconsideration.
(3) NHS England may charge a person a reasonable fee in respect of the cost of complying with a request made by that person under section 255.
(4) Before making a request under section 255 a person must consult NHS England.
(5) NHS England must publish details of—
(a) any mandatory request, and
(b) any other request under section 255 with which NHS England is obliged, or decides, to comply.
(1) Before establishing an information system pursuant to a direction under section 254 or a request under section 255 NHS England must consult—
(a) the person who gave the direction or made the request,
(b) representatives of other persons who NHS England considers are likely to use the information to which the direction or request relates,
(c) representatives of persons from whom any information will be collected, and
(d) such other persons as NHS England considers appropriate.
(2) If NHS England reasonably believes that there is no longer a need to retain information which it has obtained by complying with a direction under section 254 or a request under section 255, NHS England may destroy the information.
259 Powers to require and request provision of information
(1) NHS England may—
(a) require any person mentioned in subsection (2) to provide it with any information which NHS England considers it necessary or expedient for NHS England to have for the purposes of any function it exercises by virtue of this Chapter, and
(b) request any other person to provide it with such information.
(2) Those persons are—
(a) a health or social care body;
(b) any person (other than a public body) who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care.
(3) But NHS England may not impose a requirement under subsection (1)(a) for the purpose of complying with a confidential collection request falling within section 256(2)(c).
(4) In such a case, NHS England may, however, request any person mentioned in subsection (2) to provide it with any information which NHS England considers it necessary or expedient for NHS England to have for the purpose of complying with the request.
(5) A requirement under subsection (1)(a) must be complied with by providing the information to NHS England in such form and manner, and within such period, as NHS England may specify.
(6) If NHS England considers it appropriate to do so, NHS England may make a payment to any person who has provided information to NHS England pursuant to a request made under subsection (1)(b) in respect of the costs to that person of doing so.
(7) If NHS England considers it appropriate to do so, NHS England may make a payment to any person mentioned in subsection (2)(b) who has provided information to NHS England pursuant to a request made under subsection (4) in respect of the costs to that person of doing so.
(8) NHS England must publish a procedure for notifying persons of requirements imposed, and requests made, under this section.
(9) In imposing requirements under this section NHS England must co-operate with any other person who is authorised to require the provision of information by a person mentioned in subsection (2).
(10) The provision of information under this section—
(a) does not breach any obligation of confidence owed by the person providing it, but
(b) is subject to any express restriction on disclosure imposed by or under another Act (other than any restriction which allows disclosure if authorised by or under an Act).
(11) In this Chapter “health or social care body” means a public body which exercises functions in connection with the provision of health services or of adult social care in England.
(1) NHS England must publish all information which it obtains by complying with a direction under section 254 or a request under section 255 unless the information falls within subsection (2); and, subject to subsection (3), if the information falls within that subsection, NHS England must not publish it.
(2) Information falls within this subsection if—
(a) the information is in a form which identifies any relevant person to whom the information relates or enables the identity of such a relevant person to be ascertained and NHS England, after taking into account the public interest as well as the interests of the relevant person, considers that it is not appropriate for the information to be published,
(b) the information is in a form which identifies any individual to whom the information relates who is not a relevant person or enables the identity of such an individual to be ascertained,
(c) NHS England considers that—
(i) the information fails to meet the information standards published under section 250 (so far as they are applicable), and
(ii) it would not be in the public interest to publish the information, or
(d) the information is of a description specified in a direction given to NHS England by the Secretary of State ....
(3) A direction under section 254 may provide that the obligation to publish imposed by subsection (1) applies to information falling within subsection (2)(a) which is obtained by complying with the direction.
(4) Where NHS England publishes information which it obtains by complying with ... a mandatory request under section 255, NHS England—
(a) must comply with the requirements (if any) specified in the ... mandatory request as to the form, manner and timing of publication of the information, and
(b) may publish the information in such other form and such other manner, and at such other times, as it considers appropriate.
(5) Where NHS England publishes information which it obtains by complying with a request under section 255 other than a mandatory request, NHS England—
(a) may act in accordance with such provision (if any) as may be included in the request as to the form, manner and timing of publication of the information, and
(b) may publish the information in such other form and such other manner, and at such other times, as it considers appropriate.
(6) In considering the appropriate form, manner and timing of publication of information under this section, NHS England must have regard to—
(a) the need for the information to be easily accessible,
(b) the persons who NHS England considers likely to use the information, and
(c) the uses to which NHS England considers the information is likely to be put.
(7) In this Chapter “relevant person” means—
(a) any person who provides health care or adult social care, or
(b) any body corporate not falling within paragraph (a).
(1) NHS England may disseminate (other than by way of publication), to any such persons and in such form and manner and at such times, as it considers appropriate, any information—
(a) which it obtains by complying with a direction under section 254 or a request under section 255, and
(b) which falls within subsection (2).
(1A) But NHS England may do so only if it considers that disseminating the information would be for purposes connected with—
(a) the provision of health care or adult social care, or
(b) the promotion of health.
(2) Information falls within this subsection if—
(a) the information is required to be published under section 260;
(b) the information is in a form which identifies any relevant person to whom the information relates or enables the identity of such a relevant person to be ascertained and—
(i) the relevant person has consented to the dissemination, or
(ii) NHS England, after taking into account the public interest as well as the interests of the relevant person, considers that it is appropriate for the information to be disseminated;
(c) the information is in a form which identifies any individual to whom the information relates who is not a relevant person or enables the identity of such an individual to be ascertained and the individual has consented to the dissemination;
(d) NHS England is prohibited from publishing the information only by virtue of it falling within section 260(2)(c) and NHS England considers it would be in the public interest for the information to be disseminated;
(e) NHS England is prohibited from publishing the information only by virtue of a direction given under section 260(2)(d) and that direction provides that the power in subsection (1) applies to the information.
(3) A direction under section 260(2)(d) may require NHS England to disseminate information which NHS England is prohibited from publishing only by virtue of the direction.
(4) NHS England may also disseminate, in such form and manner and at such times as it considers appropriate, any information which it collects pursuant to a direction under section 254 or a request under section 255 (whether or not it falls within subsection (2)) to any person to whom the information could have been lawfully disclosed by the person from whom NHS England collected the information.
(5) NHS England may also disclose information which it obtains by complying with a direction under section 254 or a request under section 255 (whether or not it falls within subsection (2)) if—
(a) the information has previously been lawfully disclosed to the public,
(b) the disclosure is made in accordance with any court order,
(c) the disclosure is necessary or expedient for the purposes of protecting the welfare of any individual,
(d) the disclosure is made to any person in circumstances where it is necessary or expedient for the person to have the information for the purpose of exercising functions of that person conferred under or by virtue of any provision of this or any other Act,
(da) the disclosure is made for the purpose of facilitating the carrying out of relevant clinical trials (whether or not in the United Kingdom) by enabling potential participants in those trials to be identified and contacted,
(e) the disclosure is made in connection with the investigation of a criminal offence (whether or not in the United Kingdom), or
(f) the disclosure is made for the purpose of criminal proceedings (whether or not in the United Kingdom).
(5A) In subsection (5)(da) “relevant clinical trials” means clinical trials in connection with the research and development of orphan medicinal products for the diagnosis, prevention or treatment of cancers that in the opinion of NHS England are rare cancers; and for this purpose—
“orphan medicinal product” means a medicinal product in relation to which the orphan criteria set out in regulation 50G(2) of the Human Medicines Regulations 2012 (S.I. 2012/1916) are met;
“rare cancer” means a cancer that affects not more than 1 in 2000 people in the United Kingdom.
(6) Paragraphs (a), (b) and (f) of subsection (5) have effect notwithstanding any rule of common law which would otherwise prohibit or restrict the disclosure.
(6A) A power conferred by this section to process information does not authorise the processing of information which would contravene the data protection legislation (but the power is to be taken into account in determining whether the processing would contravene that legislation).
(6B) In subsection (6A) “the data protection legislation” and “processing” have the same meanings as in the Data Protection Act 2018 (see section 3 of that Act).
(7) Nothing in this section or section 262 prevents NHS England from disseminating information (otherwise than by publishing it) under or by virtue of any other provision of this or any other Act.
(8) For the purposes of this section, the provision by NHS England of information which it has obtained by complying with a direction under section 254 to the Secretary of State is to be treated as dissemination by NHS England of that information to the Secretary of State.
(9) For the purposes of this section and section 262, the provision by NHS England of information which it has obtained by complying with a request under section 255 to the person who made the request is to be treated as dissemination by NHS England of that information to that person.
262 Other dissemination: directions and requests under sections 254 and 255
(1) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(2) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(3) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(4) A request under section 255 may request NHS England to exercise—
(a) the power conferred by section 261(1) or (4) in relation to information which it obtains by complying with the request, or
(b) any other power it has to disseminate such information under or by virtue of any other provision of this or any other Act.
(5) A ... request under section 255 may request, NHS England not to exercise the power conferred by section 261(1) or (4) in relation to information which it obtains by complying with the ... request.
(6) Section 255(3) does not apply in relation to anything included in a mandatory request by virtue of subsection (4) or (5).
(7) A request made to NHS England in accordance with this section to disseminate information may include a request about the persons to whom the information is to be disseminated and the form, manner and timing of dissemination.
262A Publication and other dissemination: supplementary
In exercising any function ... of publishing or otherwise disseminating information obtained in connection with the exercise of its relevant data functions, NHS England must have regard to any advice given to it by the committee appointed by the Health Research Authority under paragraph 8(1) of Schedule 7 to the Care Act 2014 (committee to advise in connection with information dissemination etc).
(1) NHS England must prepare and publish a code in respect of the practice to be followed in relation to the collection, analysis, publication and other dissemination of confidential information concerning, or connected with, the provision of health services or of adult social care in England.
(2) For the purposes of this section “confidential information” is—
(a) information which is in a form which identifies any individual to whom the information relates or enables the identity of such an individual to be ascertained, or
(b) any other information in respect of which the person who holds it owes an obligation of confidence.
(3) Before publishing the code, NHS England must consult—
(a) the Secretary of State, and
(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(c) such other persons as NHS England considers appropriate.
(4) NHS England must not publish the code without the approval of the Secretary of State.
(5) NHS England must keep the code under review and may revise it as it considers appropriate (and a reference in this section to the code includes a reference to any revised code).
(6) A health or social care body must have regard to the code in exercising functions in connection with the provision of health services or of adult social care in England.
(7) A person, other than a public body, who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care must, in providing those services or that care, have regard to the code.
(8) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(1) NHS England—
(a) may give advice or guidance to any person mentioned in subsection (2) on any matter relating to the collection, analysis, publication or other dissemination of information, and
(b) must, if requested to do so by the Secretary of State ..., give advice or guidance on any such matter as may be specified in the request to—
(i) the Secretary of State ...;
(ii) such other persons as may be specified in the request.
(2) Those persons are—
(a) the Secretary of State,
(b) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(c) any person who makes, or is proposing to make, a request under section 255,
(d) any health or social care body, and
(e) any person (including a devolved authority) who collects, or is proposing to collect, information which relates to the provision of health care or adult social care.
(3) The Secretary of State must, at least once in any review period, exercise the power under subsection (1)(b) by requesting NHS England to give the Secretary of State advice about ways in which the burdens relating to the collection of information imposed on health or social care bodies and other persons may be minimised.
(4) For the purposes of subsection (3) a review period is—
(a) the period of 3 years beginning with the day on which this section comes into force, and
(b) each subsequent period of 3 years.
(5) A health or social care body to whom advice or guidance is given under this section must have regard to the advice or guidance in exercising functions in connection with the provision of health services or of adult social care in England.
(6) A person, other than a public body, who provides health services, or adult social care in England, pursuant to arrangements made with a public body exercising functions in connection with the provision of such services or care must, in providing those services or that care, have regard to any advice or guidance given to the person under this section.
NHS England must from time to time—
(a) assess the extent to which information it collects pursuant to a direction under section 254 or a request under 255 meets the information standards published under section 250 (so far as they are applicable), and
(b) publish a record of the results of the assessment.
(1) Regulations may make provision for the establishment and operation of a scheme for the accreditation of information service providers (“the accreditation scheme”).
(2) The regulations may provide that the accreditation scheme is to be established and operated by NHS England or such other person as the Secretary of State may specify in the regulations (the “operator”).
(3) The regulations may, in particular, confer power on the operator—
(a) to establish the procedure for accrediting information service providers under the scheme,
(b) to set the criteria to be met by a provider in order to be accredited (“the accreditation criteria”),
(c) to keep an accreditation under the scheme under review, and
(d) to charge a reasonable fee in respect of an application for accreditation.
(4) The regulations may make provision requiring the operator—
(a) to publish details of the scheme, including, in particular, the accreditation criteria,
(b) to provide for the review of a decision to refuse an application for accreditation, and
(c) to provide advice to applicants for accreditation with a view to ensuring that they meet the accreditation criteria.
(5) In this section “information service provider” means any person other than a public body who provides services involving the collection, analysis, publication or other dissemination of information in connection with the provision of health services or of adult social care in England.
(1) Regulations may make provision conferring functions on NHS England in connection with the establishment, maintenance and publication of a database of quality indicators in relation to the provision of health services and of adult social care in England.
(2) The regulations may, in particular, make provision about—
(a) the persons who may propose a quality indicator for inclusion in the database,
(b) the giving of advice and guidance by NHS England to such persons in relation to such a proposal,
(c) the assessment and approval of quality indicators proposed for inclusion in the database by such person as the Secretary of State or NHS England may direct, and
(d) the inclusion in the database of guidance about how providers may demonstrate performance measured against the quality indicators.
(3) In this section a “quality indicator” means a factor by reference to which performance in the provision of services or care can be measured.
269 Power to confer functions in relation to identification of GPs
(1) Regulations may make provision conferring functions on NHS England in connection with the verification of the identity of general medical practitioners for purposes connected with the health service in England.
(2) In subsection (1) “general medical practitioners” means persons registered in the General Practitioner Register kept by the General Medical Council.
(1) NHS England may do any of the following—
(a) acquire, produce, manufacture and supply goods,
(b) acquire land by agreement and manage and deal with land,
(c) supply accommodation to any person,
(d) supply services to any person and provide new services,
(e) provide instruction for any person, and
(f) develop and exploit ideas and exploit intellectual property.
(2) But NHS England may exercise a power under subsection (1) only—
(a) if doing so involves, or is connected with, the collection, analysis, publication or other dissemination of information, and
(b) to the extent that its exercise does not to any significant extent interfere with the performance by NHS England of any function under or by virtue of any other provision of this or any other Act.
(3) NHS England may—
(a) charge for anything it does in the exercise of a power under subsection (1), and
(b) calculate any such charge on the basis that it considers to be the appropriate commercial basis.
(4) Nothing in this section is to be read as limiting any power that NHS England has apart from this section to do the things listed in subsection (1).
274 Powers of Secretary of State or NHS England to give directions
(1) Regulations may make provision conferring powers on the Secretary of State to give directions—
(a) requiring a health or social care body to exercise such of NHS England’s relevant data functions as may be specified;
(b) requiring NHS England or another health or social care body to exercise such information functions of the Secretary of State as may be specified;
(c) requiring NHS England to exercise such of the information functions of any health or social care body as may be specified;
(d) requiring NHS England to exercise such systems delivery functions of the Secretary of State as may be specified.
(1A) Regulations may make provision conferring powers on NHS England to give directions requiring a health or social care body to exercise such information functions of NHS England as may be specified.
(2) A function required to be exercised by a direction given by the Secretary of State ... by virtue of subsection (1) is subject to directions given by the Secretary of State ... about the exercise of the function.
(2A) A function required to be exercised by a direction given by NHS England by virtue of subsection (1A) is subject to directions given by NHS England about the exercise of the function.
(3) A power conferred on the Secretary of State under subsection (1)(a) must provide that a direction may be given in respect of a function of NHS England only if the function relates to information which is of a description prescribed in the regulations and—
(a) in respect of which the Secretary of State may give a direction under section 254, or
(b) which the Secretary of State considers is information in respect of which a mandatory request may be made under section 255.
(4) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(5) A power conferred under subsection (1)(a) or (1A) must provide that a direction must include provision requiring the body in question to provide NHS England with the information it needs to comply with the duty under section 264 (duty to publish information register).
(6) A power conferred on the Secretary of State under subsection (1)(d) must provide that a direction may include provision about payments by the Secretary of State to NHS England for things done in the exercise of the function in respect of which the direction is given.
(7) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
(8) A power conferred under subsection (1)(d) must provide that the giving of a direction does not prevent the Secretary of State ... from exercising the function in respect of which the direction is given.
(9) In this section—
“information function” means a function in relation to the collection, analysis, publication or other dissemination of information;
“NHS services” means services the provision of which is arranged by NHS England or an integrated care board (including services the provision of which is arranged by it in the exercise of functions of another person by virtue of any provision of the National Health Service Act 2006);
“specified” means specified in a direction given under regulations made under subsection (1) or (1A);
systems delivery function” means a function which is exercisable in relation to the development or operation of information or communications systems in connection with the provision of health services or of adult social care in England.
274A Secretary of State’s guidance about NHS England data functions
(1) The Secretary of State must publish guidance for NHS England about the exercise of—
(a) its relevant data functions, and
(b) its other functions in connection with its relevant data functions.
(2) Before publishing guidance under this section the Secretary of State must consult NHS England and any other persons that the Secretary of State considers appropriate in relation to the guidance.
(3) NHS England must have regard to guidance published under this section.
In this Chapter—
“adult social care” has the meaning given by section 253(3);
...
“devolved authority” means—
the Scottish Ministers;
the Welsh Ministers; and
a Northern Ireland Minister;
“health care” has the meaning given by section 255(10);
“health or social care body” has the meaning given by section 259(11);
“the health service” has the same meaning as in the National Health Service Act 2006 (see section 275(1) of that Act);
“health services” has the meaning given by section 253(3);
“mandatory request” has the meaning given by section 255(4);
“Northern Ireland Minister” includes the First Minister, the deputy First Minister and a Northern Ireland Department;
“public body” means a body or other person whose functions—
are of a public nature, or
include functions of that nature,
but in the latter case, the body or person is a public body to the extent only of those functions;
“relevant data functions” has the meaning given by section 253(3);
“relevant person” has the meaning given by section 260(7).