Confidentiality, clinical governance and research in the community.

Abstract

If the police and data protection registrars can be unclear and contradictory about laws regarding information about individuals, as they seem to be in the United Kingdom (UK), how does this affect those who want to access data in primary care computer systems for non-clinical purposes?1 The UK Data Protection Act of 1998 has presented challenges for those engaged in epidemiological research using patient data.2,3 But the precise meaning of this Act, and others that flow from European human rights legislation, is still very much open to interpretation. In this climate of uncertainty, custodians of health information might feel that the only way to protect themselves from future allegations of impropriety with data is to take the most conservative option when considering requests from researchers. Perhaps unsurprisingly, Caldicott Guardians and other controllers of individually identifiable patient data have often been reluctant to give permission to access data for fear of acting unlawfully.4