The extension by the UK Government of measures for lawful processing of confidential patient information for COVID-19 purposes is likely to have been welcomed by researchers.
Introduced early in the pandemic, and aimed at enabling faster access to high quality data for crucial COVID-19 research this is the third extension of the four COPI notices.
What are the COPI notices?
The ‘Control of Patient Information (COPI) notices’ set aside the common law duty of confidentiality for a wide range of data sharing for public health, planning and research purposes where they support the response to COVID-19 (referred to as a ‘COVID-19 purpose’). They apply to confidential patient information (CPI) which is defined in legislation and encompasses health records—or information derived from them—which enables the identification of an individual.
Four COPI notices were issued early in the COVID-19 pandemic.
One requires general practices, local authorities, combined authorities and arm’s-length bodies of the Department of Health and Social Care to process confidential patient information to support a COVID-19 purpose.
A second requires NHS England & Improvement to process confidential patient information for a COVID-19 purpose, where ‘requested to do so by an authorised officer of the Department of Health and Social Care’ or by ‘another organisation permitted to process confidential information’ under the COPI Regulations.
A third is specific to research conducted by UK Biobank. This requires all ‘GP practices, whose IT systems are supplied by TPP or EMIS’ (the two major suppliers of primary care IT systems in the UK) to ‘release the relevant primary care data to UK Biobank for purposes related to the outbreak of COVID-19’. By mandating the disclosure of confidential information this notice requires GPs to take action rather using their discretion.
The fourth notice requires NHS Digital to process confidential patient information to support a COVID-19 purpose, where it is requested by an authorised officer of the Department of Health and Social Care or by a person who is employed by the health service or engaged for the purposes of the health service or employed or engaged by a Government Department or other public authority.
What do the COPI notices mean for research?
Pre-pandemic, individual consent or approval from the Health Research Authority would have been required before making confidential patient information available to researchers.
For research with a COVID-19 purpose, the COPI notice means this is no longer the case, while the notice is in force. By removing these requirements, the aim is that data can be released quickly to researchers working to understand the disease, how it spreads, its impact on individual and population health and to develop treatments.
Enabling fast access to high quality data has been critical for the speed of the research response to COVID-19. But if, as many scientists predict, the pandemic transitions to become an endemic, seasonal virus, is this approach still justified? And should some or all of the changes brought about by the COPI notices be incorporated into the legal framework on a more permanent basis? Or, should the COPI notices come to an end and the framework revert to normal?
COPI, genomics and public attitudes to data sharing
With funding from the National Institute for Health Research Policy Research Programme we examined the impact of allowing researchers access to confidential patient information on genomic research, and its implications for the legal framework going forwards.
We will be publishing a report later this year reporting our findings and examining a range of issues in depth, including: the impact of the COPI notices on the legal framework; how the COPI notices have influenced the landscape of data sharing for research; and public attitudes to research use of their confidential information during and post the pandemic.
For legislators and policymakers, the aim must be to learn from the successes of the pandemic response, whilst building trustworthy systems for managing and sharing confidential patient data. This is crucial in order to gain patient and public support going forward.