'Scandalous' Health Bill will trash privacy

Healthcare professionals and privacy activists say the legislation would ride roughshod over existing data protection, and could even contravene human rights legislation.

The provisions are contained within the government's Health and Social Care Bill, due back in the House of Commons in three weeks, and have prompted an angry response from the industry.

Dr Fleur Fisher, director of consultancy Healthcare-ethics and chair of the British Medical Association (BMA) Foundation for Aids, said: "This gives the most extraordinary powers to the secretary of state to re-write laws on patient confidentiality. Are we saying that we should change one of the basic tenets of healthcare - the privacy of the doctor-patient relationship - to satisfy the government's short-term policy objectives?"

Dr Ross Anderson, professor of computing at Cambridge University and author of much of the security policy around NHS Net, said: "This gives the secretary of state the power to rubber-stamp misuses of patient data - it's scandalous."

The British Medical Association, the Data Protection Commission and the Foundation for Information Policy Research have all expressed reservations about the bill. Grant Kelly, deputy chair of the BMA's IT Committee, said: "This bill paves the way for a massive trawl of citizens' information."

However, a spokeswoman for the Department of Health claimed the Bill is consistent with the Data Protection Act and would help to safeguard against the misuse of patient data. She said the Bill defines how patient data could be used, and said it does not mean the government will share or disclose patient data.

Currently, any use of confidential patient data requires the express permission of the individual patient.

At issue is Clause 59 of the bill, which states: "[The Bill may make provision for] authorising the disclosure... of prescribed patient information to... persons of any prescribed description."

Legal experts say the Bill is so poorly worded that even if it isn't the government's intention to breach the Data Protection Act, it creates a loophole which makes breaches defensible.

Nick Lockett, partner at law firm Sidley and Austin, said: "This creates one hell of a loophole, which presents a real risk to data protection. There is no excuse for drafting this poor."

Last week the government announced a £500m investment in NHS IT to get all patient records online by 2005. The use of this information will be regulated by the current bill.