Health Identifiers Bill 2013: Second Stage

I move: "That the Bill be now read a Second Time."

I am pleased to address the House on the Health Identifiers Bill. The Bill was received very positively by Members of Seanad Éireann and I look forward to further constructive debate in this House. The Health Identifiers Bill provides the legislative framework for a national unique identifier for patients and for health service providers for use across the health service, both public and private. Unique identifiers for patients have general support and a unique identifier system for patients was recommended by the Commission on Patient Safety and Quality Assurance and also by HIQA in the 2009 paper "Recommendations for Unique Health Identifiers for Patients". More recently, HIQA advocated identifiers for providers in their paper "Recommendations for Health Identifiers for Health Care Practitioners and Organisations". As I set out in the Seanad, the fundamental purpose for individual health identifiers, IHIs, for patients is to improve patient safety. IHIs are designed to make sure that the right information is associated with the right patient at the point of care. However, identifiers also have a part to play in advancing the e-health agenda. Moreover, the identifiers will help in better managing our health system and will support health reform initiatives including the money-follows-the-patient model. A system of unique identifiers is a critical feature of modern health care delivery systems.

Under the Bill, an individual health identifier for patients is to be used by health service providers on their patient records and in relevant communications. A national individual health identifier register will be established containing the IHI and other identifying particulars relating to the individual. These identifying details are set out in the Bill. There are two key privacy points here. The first is that an IHI will be a number which, in itself, will contain no personal data whatsoever. The second is that no clinical information whatsoever may be contained in the IHI register.

A national register of health service provider identifiers will also be established. The Bill sets out how the registers may be seeded and maintained. In the case of the IHI, this will involve using information already in the system or asking the patient to provide the information. One matter to stress is that a health service cannot be refused just because an individual does not have an IHI or does not provide information to help assign an IHI.

The Bill sets out who may access the national IHI register and also the processing of identifying details contained in the register. Access to the national IHI register is mainly for health service providers and other specified persons set out in the Bill. The Bill says that the Minister must put measures in place to help ensure that the national IHI register is accessed only for relevant purposes and by people who are permitted to access it. There are offences in the Bill on inappropriate accessing.

Some health service providers in other EU countries may be allowed to use the IHI and access the register. This will be tightly controlled and will be subject in each case to a detailed agreement between the Minister and the provider, and that agreement would be only after the Minister has consulted with the Data Protection Commissioner. As I indicated earlier, health service providers - health professionals, organisations and some employees - will also have a unique identifier. Again, providers will have to use their identifiers on their patient records and in relevant communications.

This will clearly identify the person and organisation involved at each stage of care. We all know how sometimes writing may not be completely legible and lead to confusion about who owns a particular signature. The individual health identifier, IHI, will certainly cover this. The national register of health services provider identifiers will contain the provider identifier, name, business address and other relevant details. The register will be publicly accessible. Assigning identifiers and establishing and maintaining the related registers are functions of the Minister for Health under the Bill. For operational reasons, the Bill allows for the possible delegation of these functions to the HSE.

To sum up before getting into the detailed provisions, the principle underpinning the Bill is to facilitate the delivery of safer, more efficient services through the use of unique identifiers and with the right checks and balances. Deputies will wish to note that the issue of governance generally was discussed with the Office of the Data Protection Commissioner with a view to addressing privacy considerations and I am grateful for the input of that office.

I will now turn to the details of the Bill. The Bill divides into seven Parts and there are two Schedules. Sections 1 to 4, inclusive, are in Part 1 and the standard provisions dealing with the Short Title, commencement, interpretation, regulation making powers and provisions for expenses incurred by the Minister for Health or any other Minister of the Government.

Definitions are included in section 2. Some important definitions are "specified person", "authorised disclosee" and "relevant purpose". Specified persons are health service providers and the bodies listed in Schedule 2. Specified persons may access the IHI register and process the IHI and other identifying data on it for a relevant purpose. Authorised disclosees do not have access to the IHI register, but they are persons to whom a specified person or the Minister may disclose an individual health identifier and other identifying particulars for a particular secondary purpose. Authorised disclosees are listed in Schedule 1. The Minister can add to the list of authorised disclosees and specified persons by regulations where doing so is in the public interest and after consultation with the Data Protection Commissioner. The IHI can only be used for a relevant purpose. A relevant purpose is a primary purpose and a secondary purpose. "Primary purpose" is defined as the present, past or future provision of a health service to an individual. A secondary purpose is the promotion of patient safety, including clinical auditing and the investigation and reporting of patient safety incidents; the management of health services, including the planning, monitoring, delivery, improvement, auditing and evaluation of health services; the investigation and resolution of complaints relating to health services; the management of national health systems; the carrying out of certain health research; the provision of health or health-related insurance schemes; or processing of personal data in accordance with the Data Protection Acts 1988 and 2003. The Seanad amended the definition of "secondary purpose" to also include the identification or prevention of a threat to public health. Subject to legal advice, I may be bringing a further amendment to the definition of "secondary purpose" on Committee Stage.

Part 2 comprises sections 5 to 12, inclusive, which sections deal with individual health identifiers and the national register of individual health identifiers, the IHI register. Section 5 is about the assignment of individual health identifiers. The Minister may assign an IHI to a living individual, whether he or she is ordinarily resident in the State, to whom a health service is being, has been or may be provided. An IHI may also be assigned to a deceased individual where that person has died on or after the coming into operation of this section without having been assigned an IHI when alive. I have mentioned that an IHI will be a number which will not contain any personal data and this provision is included in section 5(2). Section 5 also states the assigning of an IHI to an individual is not to be regarded in any way as indicating, in and of itself, an entitlement to, or eligibility for, the provision of a health service for the individual. Another provision of section 5 is that the Minister may put in place measures to assist in enabling an individual to have his or her IHI made known to him or her. The IHI may be, of course, where appropriate, made known to another person acting on behalf of the individual, for example, for reasons of the individual's age, capacity or if the individual has died. It is intended that members of the public will be made aware of their IHI on contact with the health service.

Section 6 provides for the Minister to establish and maintain a national register of individual health identifiers. This register will contain identifying particulars of each individual who has been assigned an IHI in so far as the identifying details are known. The identifying details are the fundamental details that allow an individual to be uniquely identified for the purposes of the individual health identifier. The only information that can be contained in the IHI register for an individual is his or her IHI and these identifying particulars. The identifying details include the individual's name, address, date of birth and personal public service number. There is also provision for a signature and a photograph. Any addition to the list of identifying particulars can only be made by the Minister following consultation with the Data Protection Commissioner. As Deputies will have heard, identifying particulars cannot include clinical information on the individual.

Sections 7 to 9, inclusive, set out provisions on seeding and maintaining the accuracy of the national IHI register. Section 7 allows the Minister to use identifying particulars he or she has, or the HSE has, to seed and populate the IHI register in order that people are not asked for information they have already given. Under section 7, a health services provider can also ask a person for identifying particulars where the provider is, has or is proposing to provide a health service for the person. The health services provider must forward the information and any update to the Minister. Most of this interaction will be catered for by the ICT systems.

Section 8 allows another Minister of the Government to provide the Minister for Health with an individual's other identifying particulars but only where such provision is made solely for the purposes of establishing and maintaining the accuracy of the register. Section 9 provides for an tArd-Chláraitheoir to provide information for the Minister for Health relevant to the Minister's functions under the Bill.

Section 10 provides for access to the IHI register. Only the Minister, specified persons and persons covered by a section 12 agreement can access the national IHI register. This access can only be for a relevant purpose, with the Minister also being able to access the national IHI register for the purpose of performing a function conferred on him or her by the Bill or another enactment. The Minister must put in place measures to enable the register to be accessed by specified persons for relevant purposes. For added security, the Minister must make the register otherwise inaccessible. Subject to legal advice, I may bring a Committee Stage amendment to section 10 on further limiting information access.

Section 11 provides for the use of the IHI and information on the IHl register by health service providers, other specified persons and the Minister. A health service provider must ask an individual for his or her IHI when the provider is providing a health service for him or her. The Seanad amended this section to take account of patients who because of age or capacity may need the assistance of others in this regard. Where the health service provider is given the IHI or is able to establish it from the register from information provided by the individual, the provider must associate it with the patient's medical record and use it in relevant communications, with his or her own provider identifier as set out in section 20. This would be, for example, when a GP writes a patient referral letter to a hospital consultant. An important point under section 11(4) is that no one will be denied a health service solely because he or she does not have an IHI or refuses to provide it.

Section 11 also makes provision for disclosing an IHI and identifying particulars to an authorised disclosee for a particular secondary purpose. Section 12 is about the use of the IHI and access to the national IHI register in another EU member state where people are receiving health services in that other member state. I have referred to this issue. Section 12 is intended to deal with cases where the HSE has made an arrangement with a service provider outside the jurisdiction to provide services for a significant volume of patients. Under the section, the Minister may enter into an agreement with health service providers in another member state for the purposes of allowing that provider to obtain and use the IHI and access the national IHI register. That provider is referred to as an "equivalent person" in the Bill. The Minister must consult the Data Protection Commissioner before entering into any such agreement.

Part 3 of the Bill covers sections 13 to 20, inclusive, and is concerned with health services provider identifiers and the national register of health services providers. Section 13 provides for the assignment of health services provider identifiers. Under the Bill, health service providers are health practitioners, for example, doctors, dentists and nurses and also relevant bodies. Relevant bodies are the HSE and other bodies such as hospitals that provide health services through health practitioners. Relevant employees and agents of health practitioners and relevant bodies are also included in the definition of "health service provider". Amendments were made by the Seanad designed to facilitate a phased approach in assigning identifiers to these employees and agents, allowing the Minister to prescribe classes of employees and agents in this regard.

Section 14 provides for the establishment and maintenance of a national register of health services provider identifiers. This register also needs to be seeded and accurately maintained and this is the purpose of sections 15 to 17, inclusive. Under these sections, professional regulatory bodies, relevant bodies and health practitioners are required to provide specified information for the Minister.

Section 18 allows the Minister to use relevant information he, she or the HSE already has for the purpose of assigning a health services provider identifier and establishing and maintaining the register.

Section 19 provides for access to the national register of health services provider identifiers. The provider register will be accessible to the public. This is because the register will be a register of organisations and persons involved in providing health services and the only information on the register identifying individuals relates to them solely in their capacity as health services providers.

Section 20 provides for the use of the health services provider identifier and the register of health services provider identifiers. I mentioned that providers must use their identifier on patient records and in relevant communications. However, health practitioners who are already required under other legislation to use the registration number given to them by their professional regulatory body can instead continue to use that number in the provision of the health service concerned.

Part 4 - sections 21 to 25 - provides for offences under the legislation. Section 21 sets out the offences relating to assignment of individual health identifiers. Sections 22 and 23 provide for offences relating to accessing the national register of individual health identifiers and for an offence relating to processing an individual health identifier. Section 24 provides for offences relating to the assignment of health services provider identifiers. Section 25 provides for offences by bodies corporate.

As it is 4.42 p.m., I ask the Minister to adjourn the debate. He will have 14 minutes remaining on its resumption, but he will not need that amount.

I could be finished in four or five minutes if Members want me to continue.

Since there is no objection, I ask the Minister to continue.

I thank Deputy Caoimhghín Ó Caoláin and also Deputy Michael Moynihan who has nodded in assent. I also thank Deputy Dan Neville, the Leas-Cheann Comhairle agus gach duine atá anseo.

Part 5, section 26, provides for the delegation of certain functions of the Minister. This is in recognition of the day-to-day operational realities associated with assigning the identifiers and maintaining the registers. Section 26 provides that the Government may, by order, delegate to the HSE any or all of the Minister's functions under the Bill, except excluded functions. Excluded functions are the Minister's power to make regulations and entering into section 12 agreements. Section 26 makes it clear that any function delegated to the HSE continues to be vested concurrently in the Minister, and the delegation does not remove or derogate from the responsibility of the Minister to Dáil Éireann or as a member of the Government for the performance of any functions that are delegated.

Part 6 of the Bill includes section 27 which deals with the relationship between the Bill and the Data Protection Acts 1988 and 2003. Under subsection (1), a living individual's IHI will be considered personal data under the Data Protection Acts when held by the Minister, a specified person or the HSE when acting in a section 26 capacity under the Bill. Subsection (2) makes it clear that this shall not be construed to prevent a living individual's IHI held by any other person from being personal data in accordance with the Data Protection Acts. As Deputies are aware, the Data Protection Acts are concerned with the protection of the personal data of living identifiable people. Subsection (3) is, therefore, an additional safeguard under the Bill for information on the register relating to a deceased individual. It provides that sections 2(1)(d) and section 2C of the Data Protection Acts, which deal with security arrangements for personal data, will apply to the information in the IHI register in respect of a deceased individual as those sections apply to a living individual.

Part 7 deals with various matters. Under section 28, the Minister may arrange for investigations to be carried out in respect of the operation of any provision of the Bill. Section 29 allows the Minister to enter into an agreement with another person to carry out certain activities. These would include specialist IT support services, for example. Section 30 allows the Minister to carry out measures to verify any information provided to him or her under the Bill, or to establish the efficient and effective operation of the registers. An amendment was made by the Seanad to clarify this.

Section 31 provides for data exchange agreements between the Minister and other relevant persons specifying the procedures to be followed by each party with respect to the provision of personal data between them. The Minister must consult the Data Protection Commissioner in regard to a data exchange agreement. Again, a clarifying amendment was made by the Seanad to section 31.

As an additional privacy protection, section 32 states any processing of personal data by the Minister or the HSE, if designated under section 26, shall go no further than is reasonably necessary for the performance of those functions.

Section 33 provides for the Minister's power to specify the form of documents required for the purposes of the Bill. Section 34 allows the Minister to extend the period for providing information to him or her as required under the Bill.

Sections 35 to 39, inclusive, provide for the amendment of the legislation in regard to health professionals regulatory bodies to provide for the Minister, or the HSE, if delegated this function, to make complaints to the appropriate professional regulatory body where the professional concerned has failed to comply with a provision of the Bill. For example, this would be where the practitioner fails to comply with obligations under the Bill by failing to attach the patient's IHI and his or her provider identifier to a patient record. I do not expect this to happen, but the legislation must have some way of addressing such an unusual situation.

Schedule 1 lists the authorised disclosees and Schedule 2 has specified persons. As the Child and Family Agency Act is now in force, the Seanad made an amendment on Committee Stage to include the new Child and Family Agency as a specified person in Schedule 2.

The provision of health identifiers will, of course, require investment in ICT-related infrastructure to develop and maintain the national IHI registers and the providers register, and there will be costs associated with rolling out the new system of identifiers in the health system, including the change management processes. Using the HSE to operate the identifier system will allow us to maximise the technical and other expertise and the operational infrastructure of the primary care reimbursement service, PCRS. Appropriate leveraging of the public service card technology provides further possibilities for a cost-effective solution. On this point, I thank the Minister for Social Protection and her Department for assisting in developing the proposals for an IHI.

It will be critical to have sound costings when decisions need to be made on particular elements of the implementation model. Some work that has already been done by the HSE on costs and the publication of the Bill and its passage through the Oireachtas gives the scope for engagement with the market to get accurate cost estimates. Crucially, of course, the individual project components will be subject to peer review, including costs review, prior to any sanction being issued.

Health identifiers will play an important role in enhancing patient care and safety. They will help in progressing initiatives for a modern, effective and safe health service. These are the objectives of everyone present. I commend the Bill to the House and thank the Leas-Cheann Comhairle and Members for their indulgence and patience.

Debate adjourned.