Section 15: The Health and Social Care Information Centre’s powers under the Health and Social Care Act 2012

The HSCIC may establish systems to collect and analyse health and social care information where directed or requested to do so. Collection under directions from the Secretary of State (SoS) or NHS England must be complied with. Similarly, requests from Monitor, CQC and NICE (known as principal bodies) also require the information from providers. These requests are known as mandatory requests.

Other bodies and organisations, including devolved administrations, may request information from providers. These are known as non-mandatory requests.

In all cases, the body asking the HSCIC to establish the information system must consult with the HSCIC in advance. Unless otherwise directed, the HSCIC has discretion in complying with non-mandatory requests. The HSCIC may refuse a request if it interferes to an unreasonable extent with the HSCIC’s core functions, if it is not compliant with the Code of Practice for Confidential Information, or if the requestor has ignored the HSCIC’s advice on the collection as described below. The HSCIC must comply with a mandatory request unless it relates to information prescribed in regulations.

Also the SoS or NHS England may direct the HSCIC not to comply with non-mandatory requests made by any organisation and may direct the HSCIC to comply with a request from an organisation outside England. The HSCIC does not have the power to refuse a direction from the SoS or NHS England.

The HSCIC may charge a reasonable fee for complying with directions from NHS England or requests from others.

The HSCIC is required to consult with relevant organisations (requestor and users of the data) before setting up a new collection. The HSCIC will publish procedures for assessing each collection request with the requestor and those that will be required to submit the data. The process will include consideration of any appeals against decisions not to comply with a collection request.

The HSCIC will keep a register and publish details of all collection requests it is obliged to or decides to comply with. It will also maintain a list of requests that have been refused with details of the reasons for refusal.

The HSCIC may advise any organisation (not just those directing or requesting the HSCIC to collect data) on issues relating to the collection, analysis, publication or other dissemination of information and may be required to provide such advice by the SoS or NHS England. All persons must have due regard to this advice.

The SoS must request the HSCIC’s advice on how the burdens relating to the collection of information imposed on health or social care bodies and other persons may be minimised at least once every three years.

The HSCIC has the power to require health and social care bodies (and those commissioned to provide health and social care services in England) to provide it with the information it needs for the directions and requests described above. Organisations must provide information to the HSCIC in the form and frequency specified by the HSCIC. The HSCIC can request that other organisations (i.e. those not providing ‘NHS’ commissioned health and adult social care) provide the information, but these organisations do not have to comply.

The HSCA 2012 provides the power for the HSCIC to collect confidential information under a variety of circumstances. The HSCA 2012 states that in providing confidential information to the HSCIC, the provider is not breaching common law confidentiality, but this does not set aside restrictions of any other Act, e.g. DPA, Human Fertilisation and Embryology Act 1990 (HFEA), etc.

The HSCIC can require health and social care bodies to provide confidential information needed to comply with directions from the SoS/NHS England, or to comply with mandatory requests.

Additionally, the HSCIC can collect confidential information for non-mandatory requests, but only if the requestor has the legal right to ask for it, for example

• where the requestors can require the data to be disclosed to themselves or the HSCIC (for example, under other regulations); or
• where the data can otherwise lawfully be disclosed to the requestor or the HSCIC (for example, through s.251 support); or
• where there is documented evidence that the consent of the data subjects has been obtained

The HSCIC may pay providers commissioned to provide health and social care services to provide confidential information that has been requested.

The HSCIC will publish a procedure to notify organisations of the requirements and requests for information. When identifying information collection requirements, the HSCIC is required to cooperate with others that might be requesting the same information to avoid duplication of effort and to minimise the burden on information providers.

Unless directed otherwise by the SoS or NHS England, the HSCIC must publish (in the public domain) data it collects or derives through analysis unless the data identifies the individual to whom the data relates or it enables their identity to be established.

Information may be published where it identifies a relevant person (that is a health or adult social care provider or organisation) and the HSCIC considers it is in the public interest to do so. The SoS or NHS England may oblige the HSCIC to publish such information within their directions.

Data must not be published if the HSCIC believes it does not meet the required information standards or it would not be in the public interest to publish it.

Any direction or request to establish an information system may specify when and in what format the information is to be published and the HSCIC must adhere to this.

When publishing information, the HSCIC must consider the need to make it easily accessible for those likely to require access and for the purposes it may be used for. 

The HSCIC may disseminate information (i.e. share it with a specific person or body rather than publishing in the public domain) that it collects as a result of a direction or a request if it

• is in a non-identifiable form; or
• identifies a relevant person (provider of health care or adult social care or a body corporate) or enables their identity to be ascertained and consent for dissemination has been obtained or the HSCIC considers it appropriate given the public interest vs. the interest of the relevant person; or
• is identifiable or enables an individual’s identity to be ascertained and consent for dissemination has been obtained
• the information is not being published only because it does not meet the appropriate standards (i.e. is not of good quality) but it is in the public interest to disseminate it; or
• the direction from SoS or NHS England prohibits publication but requires dissemination and there is no other barrier to publication

The HSCIC may also disseminate information it collects to any organisation where the organisation submitting it to the HSCIC could have lawfully disclosed it directly.

The HSCIC may disclose information (including confidential information) where there is a lawful basis to do so, for example

• where that data has been previously lawfully disclosed to the public
• in accordance with a court order
• where it is expedient to protect the welfare of an individual (but common law still applies)
• to another organisation that requires the information to exercise their functions under the provisions of this or of any other Act (but common law still applies)
• in the investigation of a criminal offence (but common law still applies)
• for the purpose of criminal proceedings whether or not it is within the UK
• further to s.251 approval
• If otherwise lawfully allowed

The HSCIC can destroy data it has collected or derived from a collection when it is no longer needed.