The Foundation of a Modern NHS
The future of healthcare demands seamless data integration – a cornerstone for a responsive, proactive health service. This transformation, however, hinges on a critical element: trust. Building and maintaining public confidence in how health data is collected, stored, and shared is paramount, ensuring it serves the collective good without compromise.
While the NHS is one of the most trusted institutions in the UK, this confidence doesn’t always extend to its data sharing and governance arrangements. Yet, these arrangements are vital for driving research, innovation, and transforming the NHS to deliver optimal care. The promise of integrated records and shared insights to improve patient care and manage population health is widely recognised. Wearable health technology, despite its immense potential to support proactive care and preventative approaches, remains underutilised without integration. Imagine a system where data from various wearables seamlessly converges into one user-friendly dashboard, offering comprehensive insights for both patients and clinicians alike. The challenge now is to foster public understanding and engagement, unlocking the full potential of smart technology for patient-centred care.
Navigating the Challenges of Data Sharing
Navigating the ethical, security, and legislative frameworks for data sharing is complex. However, with collaborative mindsets, mutual trust, and a clear focus on the far-reaching benefits, these challenges can be overcome to build a safeguarded integrated system. Patients rightly expect stringent measures to protect their sensitive health information, including medical history, diagnoses, treatments, and genetic data, ensuring privacy, confidentiality, and relevant sharing only to those who need it. This requires appropriate information governance arrangements, sharing protocols and procedures, and potentially advanced encryption. While current NHS data infrastructure still grapples with paper records and siloed systems in large parts, particularly the lack of information sharing between primary and secondary care in places like Wales, this highlights an urgent need for modernisation and interoperability.
The Wider Health Ecosystem: Collaboration for National Benefit
The NHS operates within a broader health ecosystem, where private sector organisations play a significant and often integral role – from many GP practices, pharmacies, and optometry services to innovators developing new treatments and diagnostic tools. While strict controls govern their use of patient data, public concern about private access remains. However, patient records hold immense value for understanding disease, developing new treatments, monitoring safety, planning services, and evaluating health and social care policy. Often, private sector expertise in data storage, processing, and analysis is crucial for delivering these insights, for instance, a pharmaceutical company using routinely collected data for clinical research or software companies processing data to improve the health service. To provide a more efficient, innovative, and evidence-based healthcare system, a secure, multi-directional flow of data across this trusted network is essential. More needs to be done to recognise and normalise the private sector as a trusted member of the wider health ecosystem.
Health Data: A National Asset for Proactive Care
The NHS holds an unparalleled wealth of health data, the single biggest holder worldwide, but its use is minimal and its legitimacy questionable. This data is far more than just a patient’s footprint; it’s the key to transforming healthcare from reactive to proactive, fostering a truly integrated data-driven health and wellbeing service. As Lord Darzi noted in his 2020 report on NHS Data,
“In a world where big data has increasing value, the UK has an opportunity to leverage its health data assets to benefit people in the UK and across the world”.
Our focus here is on this profound health and social value. By improving data literacy among both NHS staff and the public, and communicating the immense benefits effectively, a truly integrated data system for national benefit is within reach.
Collective Responsibility in a Changing Landscape
Throughout our “MPM Health Insights” series this year, we have consistently highlighted the evolving demands on our beloved NHS and the transformative potential of innovative health technology, including wearable health technologies which are increasingly used across households in the UK. We’ve explored how wearable health tech data can integrate with health and service data for a comprehensive, integrated health data system. This evolution prompts a crucial question: how do we balance the collective responsibility to support the NHS, as reflected in its constitution and prudent use of finite resources, with concerns about the ‘datafication’ – the potential perception of service users being reduced primarily to data providers, rather than individuals receiving care – of citizens? We contend that the judicious use of data, and participation in research, development, and innovation, are not merely options but integral components of delivering the very latest and best care, free at the point of need. This perspective underpins our call for greater data utility to develop superior services, foster patient-centred approaches, and enable data-informed, evidence-based, proactive preventative care, striving for earliest interventions possible versus the status quo, reactive care.
Legal Frameworks: Enabling Data Sharing for Public Health
While legal frameworks governing personal data have strengthened over the years and remain complex, they also provide robust avenues for legitimate data processing in healthcare. Though caution is necessary and safeguards should absolutely be at the vanguard of thinking around data, particularly personal and health data, the default position need not be ‘no’. To break through existing impasses, we need the strength of minds and creativity to realise data’s full potential. This article examines how the NHS Act (2006), the General Data Protection Regulations (GDPR), and the Data Protection Act (2018) actively support a collective effort for health prevention, aligning with integration and a population health management approach for proactive, preventative healthcare by safely and securely collecting and analysing data to support the delivery of the very best care, at the right time, in the right place, and by the right team; improving health and reducing the burden of disease.
Under these frameworks, there must be a clear lawful basis for the use of personal data. If data is effectively anonymised, it will not need a lawful basis under the 2018 Data Protection Act (DPA) or need to meet the common law duty of confidentiality (CLDC). For personal data to be processed, it must meet a lawful basis under Article 6 of the UK General Data Protection Regulation (GDPR). Furthermore, health data, being classed as more sensitive ‘special categories data’, requires an additional lawful basis under Article 9 of the UK GDPR. The CLDC permits sharing of patient data: if there is consent (explicit or implied); if it is required by law; in response to a court order; or if it can be justified in the public interest. Legal support for the use of confidential patient information without consent also exists under the Health Services (Control of Patient Information) Regulations 2002, under section 251 of the NHS Act 2006.
Considering these provisions, the potential benefits to patients, clinicians, and the public purse present a compelling case for data sharing. The remainder of this article will explore instances where sharing is justified, both with consent and under the public interest for the greater public good.
Sharing by Design: The NHS as a Public Health Entity
Article 9(2)(i) of the General Data Protection Regulation (GDPR) provides a crucial exception for processing sensitive health data when it is “necessary for reasons of public interest in the area of public health”. This includes situations like protecting against serious cross-border threats to health (e.g. managing pandemics) and ensuring high standards of quality and safety of healthcare and medical products. Population health management, a core strategic aim for Integrated Care Systems (ICSs) aimed at improving the health of an entire population through proactive and preventative healthcare measures, perfectly aligns with this provision. By transforming the NHS into a proactive, preventative service that anticipates and plans for health needs, data becomes a powerful tool to improve wellbeing and reduce the physical, social, and economic burden of disease on individuals and the public purse.
We assert that the ‘necessity’ condition for using personal data in this context is met, as population health management and transforming the NHS to a more proactive preventative service are designed to reduce the threat posed by long-term chronic conditions and lifestyle choices, actively seeking to help prevent diseases and improve healthcare quality across a population. Furthermore, to rely on this exception, the processing must be authorised by “Union or Member State law”. Under national law in the UK, Section 251 of the NHS Act 2006 provides the powers to allow for such processing, where it would be impractical and not feasible to gain the consent of all NHS patients, particularly relevant for public health surveillance, research, and population health management initiatives.
Crucially, appropriate safeguards are essential when sensitive health data is processed. MPM Health advocates for ‘privacy by design’ to achieve the necessary safeguards, establishing robust protective measures under an Information Governance (IG) framework, including clear access controls, thorough audits, encryption protocols, and rigorous security testing. These measures are already well-maintained under the DPA and GDPR compliance, as well as standards from the National Data Guardian for Health and Social Care. A recent review for the National Data Guardian public benefit assessment of health and care data: “found a profound shift is underway and as we move to more digitised and joined up services, data gathered as part of providing our health and care can be stored in formats that make it more useable and useful for purposes beyond individual care. Ensuring health and care data are used in ways that benefit the public, the health system or society more broadly. Previous research has emphasised that people expect public benefit to be driving decisions about health data use. The public dialogue found that participants were supportive of health and social care data being used for public benefit.”
This understanding empowers us to communicate the benefits of seamless data access – such as improved care coordination and personalised treatment plans – fostering greater public confidence and encouraging proactive engagement in their own health, which we are already seeing with increased wearable health tech. In addition to Article 9(2)(i), Article 9(2)(h) allows processing of health data for purposes like preventive or occupational medicine, medical diagnosis, and the provision of health or social care. This provides the legal basis for processing data such as wearable health data and wider individual data for individualised care based on prevention and proactive preventative measures to ensure optimised health.
Conclusion: A Path Forward for Data-Driven Healthcare
The GDPR and UK DPA 2018 set the overarching framework for the lawful processing of personal data, including sensitive health data. Specific legal mechanisms exist, such as Section 251 of the NHS Act 2006, that allow for processing of confidential patient information, particularly for public health purposes, population health management, and research. This article has demonstrated that these legal frameworks support a more integrated and interoperable approach to data sharing between patients, health organisations, and the wider health ecosystem, provided considerable safeguarding and cybersecurity measures are in place.
The key legislative considerations revolve around individual level data for individual care (supported by Article 9(2)(h)) and collective individual data for public benefit (supported by Article 9(2)(i) and Section 251). These frameworks can operate together, ensuring sensitive health data is used appropriately while maintaining legal compliance – going forward as a nation, lets be bold: use the data, use it safely and use it wisely to improve the health of all our people.
Final thoughts
This series has explored the transformative power of digital health and data integration, from empowering individuals with ‘at-home’ health tech to revolutionising clinical decision-making. We’ve seen that while ethical, security, and legislative challenges exist, the legal frameworks are in place, and the public is increasingly receptive to the idea of data being used for collective good. The vast amount of underutilised NHS health data represents a national asset, capable of shifting healthcare from reactive to proactive, improving health outcomes. The benefits of data sharing, particularly in areas like wearable technology integration, significantly outweigh the risks of not sharing, provided clear safeguards are implemented and data literacy is improved among both staff and patients.
The path forward requires continued collaboration, transparent communication, and a shared commitment to leveraging health data as a national asset. By doing so, we can move beyond reactive care, foster proactive health, and build an NHS truly fit for the future, benefiting every citizen.
We invite healthcare professionals and the public alike to join this vital conversation. What steps can we take, as a nation, to fully realise this potential? What further innovations or collaborations do you envision?
Let’s chat
If you work in healthcare please share your thoughts, or if you know someone who does please share this article with them so they can. How do we, as a nation, go about solving these challenges? What other challenges do you foresee that aren't listed here?💡Additional insights
Data and clinical record sharing
Public trust, data governance and the NHS
NHS Data: Maximising its impact on the health and wealth of the UK
Data sharing in healthcare the benefits and challenges
There is no integrated care without cross-sector data sharing