Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, pursuant to the Answer of 21 January 2019 to Question 209287 on NHS: Members' Constituency Work, when the NHS started to require hon. Members to have signed authority before replying to such Members on issues raised by constituents.

As set out in the answer of 21 January 2019 to Question 209287, there has been no change in policy with regards to obtaining consent of a patient for the purposes of an inquiry or investigation.

Paragraph 24 of Schedule 1 to the Data Protection Act 2018 sets out the circumstances in which special categories of personal data, which would include health data, can be disclosed to Members of Parliament without the controller - here, the National Health Service body - having to obtain explicit consent from the data subject. This is discussed in the House of Commons Briefing Paper, Number 1,936 of 31 October 2018 ‘Data protection: constituency casework’ at the following link:

http://researchbriefings.files.parliament.uk/documents/SN01936/SN01936.pdf

However, it remains the responsibility of the National Health Service body to satisfy itself that there is a legal basis under the General Data Protection Regulation/Data Protection Act for processing patient information (i.e. disclosing and sharing it for the purposes of the investigation).

In the earlier answers to Questions 209287 and 208761, we said that a National Health Service body ‘must’ obtain the consent of the patient before disclosing patient information held by it in order to progress an inquiry from a Member of Parliament. There are circumstances in which a National Health Service body may provide patient information to a Member of Parliament without the Member evidencing the consent of the patient, so long as that information is provided in accordance with the requirements set out in paragraph 24 of Schedule 1 to the Data Protection Act 2018. We are arranging for the record to be corrected.