Human Tissue Authority Guidance to Establishments:
Disclosing Patient Identifiable Information to the Human Tissue
Authority
Reference
HTA-GD-001
Next review due
26 August 2015
Date last reviewed
26 August 2014
Introduction
When carrying out inspections or investigating complaints, the Human Tissue Authority
(HTA) sometimes needs to ask licensed establishments to provide patient identifiable
information. This information is ordinarily held by licensed establishments on a confidential
basis and is subject to obligations arising under the Data Protection Act 1998.
This guidance note has been prepared by the HTA, with advice from the Information
Commissioner’s Office, to address concerns in relation to the disclosure of patient
identifiable information to HTA inspectors. It is not intended to constitute legal advice;
establishments that continue to have concerns about granting the HTA access to patient
data should always obtain their own legal advice.
The Data Protection Act 1998
Patient information is sensitive personal data for the purposes of the Data Protection Act
1998 (DPA), and patients have a legitimate expectation that their information will be
managed accordingly. Establishments will naturally wish to comply with the DPA when
disclosing, or otherwise making available, patient information to HTA inspectors.
Licensed establishments have a legal obligation to make available to HTA inspectors any
information they are required to keep by virtue of the HT Act1 or by virtue of the Human
Tissue (Quality and Safety for Human Application) Regulations 20072 (“the 2007
Regulations”). Where this legal obligation arises, section 35(1) DPA, which allows the
disclosure of personal data which is required by law, will operate to permit the disclosure of
patient data to HTA inspectors.
In order to comply fully with the DPA, licensed establishments must, even where section
35(1) applies, ensure that at least one condition from Schedule 2 DPA and at least one
condition from Schedule 3 DPA is satisfied whenever patient information is disclosed. Both
1
2
Human Tissue Act 2004, Schedule 5, paragraph 1(1)
Human Tissue (Quality and Safety for Human Application) Regulations 2007, Regulation 21,
1
schedules include conditions dealing with consent; disclosures made in accordance with the
express consent of patients will therefore meet DPA requirements.
It is not strictly necessary, however, to obtain patient consent in order to share information
with HTA inspectors. This is because both Schedules 2 & 3 DPA provide for ‘disclosures that
are necessary for the exercise of any functions conferred on any person by or under an
enactment”3
The HTA’s functions in relation to the conduct of inspections and investigations are
conferred under Section 15(c) of the HT Act. Disclosures that are necessary so that the HTA
can exercise these functions will therefore not contravene the DPA, even if express patient
consent has not been obtained. This view has been endorsed by the office of the
Information Commissioner.
Confidentiality
The HTA recognises that patient information is held by licensed establishments in
confidence and that this duty of confidence is legally binding unless patients consent to the
disclosure of their information or disclosure is in the public interest.
There is a strong public interest in ensuring that the HTA should be able to access
information in order to investigate complaints or assess compliance with licence conditions,
licensing standards or the HTA’s Codes of Practice. Establishments that have concerns
about the confidentiality of patient data should be reassured to know that HTA



is itself subject to the requirements of the DPA
will treat patient information confidentially
will use patient information only in connection with its regulatory functions.
In considering the scope of the duty of confidentiality owed to patients, establishments
should also bear in mind that HTA has statutory powers to compel the production of records
that licensed establishments are required to keep by virtue of the HT Act4 and the 2007
Regulations5 and that it is an offence to fail to produce such records for inspection without
good reason6 7.
Against this background, the HTA’s view is that disclosure of such records to HTA inspectors
is unlikely to give rise to any actionable breach of confidence
The HTA appreciates that registered health professionals have a professional obligation to
maintain patient confidentiality. However, the HTA takes the view that disclosure of patient
identifiable data for licensing and inspection purposes does not conflict with the professional
duties of confidentiality. This is because, in addition to the duty of confidentiality, health
professionals have a professional duty to co-operate with regulatory processes. If in doubt,
3
Data Protection Act 1998 Schedule 2 para 5(b) ; Schedule 3 para 7(b)
HT Act 2004 Schedule 5, paragraph 1
5
Tissue (Quality and Safety for Human Application) Regulations 2007, Regulation 21(1)
6
HT Act 2004 Schedule 5, paragraph 8
7
Tissue (Quality and Safety for Human Application) Regulations 2007, Regulation 28(1)
4
2
however, registered health professionals should seek appropriate guidance from their
professional bodies.
Human Tissue (Quality and Safety for Human Application) Regulations 2007 (the 2007
Regulations)
The HTA issues licences under the 2007 Regulations in connection with the storage,
procurement, testing, distribution, import and export of tissue and cells intended for human
application. The general principles set out above in relation to data protection and
confidentiality apply to the disclosure of information held by licensed establishments for the
purpose of licenses issued both under the HT Act and under the 2007 Regulations.
However, special rules apply to patient identifiable information collected in pursuance of a
licence issued under Schedule 1 of the 2007 Regulations; by virtue of Regulation 14 of these
Regulations it is a criminal offence to disclose patient identifiable information unless
disclosure is of a kind expressly permitted by the Regulations.
Regulation 13 of the 2007 Regulations sets out circumstances in which identifiable patient
information may be disclosed. Accordingly, no offence is committed under Regulation 14
where such information is disclosed to a member or employee of the HTA or to someone
carrying out an inspection on the Authority’s behalf8.
The Quality and Safety of Organs Intended for Transplantation Regulations 2012 (“the
2012 Regulations”)
As set out above, the HTA has powers to compel the production of information that licensed
establishments are required to hold in connection with licences issued under the HT Act and
the 2007 Regulations. The position under the 2012 Regulations is slightly different in that
licensed establishments have no express obligation under the 2012 Regulations to make
information available to HTA inspectors and HTA has no express powers to compel the
production of information under these Regulations. However, certain information held by
licensed establishments for the purpose of a licence issued under the 2012 Regulations will
be caught by the general provisions of the HT Act insofar as disclosure to HTA inspectors is
concerned. This follows from the fact that by virtue of Regulation 6(1) of the 2012
Regulations paragraphs 2(4)(c) –(e) and paragraph 5 of Schedule 3 of the HT Act (which
deal with the imposition of licence conditions regarding the recording, retention and
disclosure of information) apply to information held for the purpose of a licence issued under
the 2012 Regulations.
To the extent that an establishment is required by licence conditions to record and retain
information for the purpose of a licence issued under the 2012 Regulations, a legal duty of
disclosure to HTA inspectors will arise under paragraph 1 of Schedule 5 HT Act.
The position outlined above in relation to DPA compliance generally will accordingly apply to
information that establishments are required by licence conditions to record, retain, and
provide in connection with a licence issued under the 2012 Regulations.
Further information
Any queries arising from this guidance should be addressed to:
8
See Regulation 13(2)(d) and 13(2) (e)
3
The Human Tissue Authority
151 Buckingham Palace Road
London SW1W 9SZ
enquiries@hta.gov.uk
Legal review
This guidance was developed by the HTA’s Legal Advisors. They submitted it to the
Information Commissioner’s Office (ICO) and received the following comment:
‘In general we found this guidance to be clear and succinct, well organised and easily
assimilated. The value of any guidance can only really be determined in use, but it is our
view that this guidance is likely to contribute to compliance with the HT Act in the
circumstances in which it is intended to be applied.’
4