Mr. Muiris O'Connor:

I thank the Cathaoirleach, and I wish a good morning to members. I thank the committee for inviting us here today to talk about the health information Bill 2023. We very much welcome and appreciate this early engagement on the Bill. I am the assistant secretary in charge of the research and development and health analytics division at the Department of Health. I am joined by Mr. Peter Lennon and Ms Roisin O'Neill, who lead on the health information Bill and the EU regulation on the European health data space in the health information policy unit. Ms Amy Brennan is also a key member of the team.

Given the range and size of the health information Bill, I do not intend to go into details on all its provisions in my opening statement but, instead, I will set out the key principles and objectives of the Bill, as well as its main features. I hope this approach is agreeable to the committee. My colleagues and I are very happy to answer any questions the members of the committee have on the Bill.

The main purpose of the Bill is to underpin a modern, fit-for-purpose national health information system in Ireland. It will do so by providing a robust legislative framework for the collection, use and sharing of health information both for care and treatment and wider health service goals, which are called "relevant purposes" in the Bill. At its core, the Bill is about delivering patient-centred, integrated care; improving performance and innovation in the health service; supporting digital and data initiatives in healthcare; and building public confidence and trust in how health information is handled.

To get a full appreciation of what is in the Bill and the approach adopted, some contextual background might be helpful. A modern health information system, coupled with more effective information management, is essential to the development of a high-performing and integrated healthcare service as envisaged in Sláintecare. Health information initiatives taken to date have generally lacked a legislative framework which is tailored to the particular challenges of the health services. Consequently, some have not succeeded as envisaged. That is not to say that legislation on its own will solve all the problems, many of which are embedded organisational and cultural ones. However, without the right holistic legislative framework to underpin the required change process, the same suboptimal outcomes as before will simply be repeated.

The reality is that, at present, the health information system does not exist at a coherent and co-ordinated national level. Instead, it operates at organisational level with considerable reluctance to share information. When it comes to the private side of the health system, there is an information black hole which wholly undermines any serious attempt at population planning. In addition, healthcare lags other areas of society regarding digital innovation. All of that directly impacts adversely on the treatment of patients, on those who provide that care, and on the policymaking and planning processes. I am not going to say those challenges are new. They are not, and that is what makes the Bill overdue and urgent.

Our own internal analysis of what needs to be done in the Bill lines up very closely with national and international studies. I want to reference two studies from 2021. One, by the Economic and Social Research Institute, ESRI, is called Developments in Healthcare Information Systems in Ireland and Internationally. The other, by the Health Information and Quality Authority, HIQA, is called The Need to Reform Ireland’s National Health Information System. Both argued that significant action, including legislation, was necessary. The HIQA report also featured examples of countries which assign governance and management of national health information systems and data collections to key organisations. For example, Australia, New Zealand, England and Finland have established dedicated organisations with significant responsibilities in the health information area. HIQA concluded that a national, single-purpose health information body was the required way forward for Ireland.

Internationally, a 2019 OECD study found that, comparatively, Ireland lags other countries regarding the maturity of health information infrastructure and governance of health information. Other international reports similarly identified the policy actions needed to transform the health information system in Ireland, including the implementation of a health information governance framework; unique identification of health records for data linkages linked to a wider public service ecosystem; a quality-based approach to health information; integrated systems and structures; and the development of a central data body. Those areas form the key provisions of the Bill, which I would now like to turn to.

The provisions in the Bill are designed to deliver on the Bill’s objectives, and I will go through each of the parts at high level to give a sense of their purpose. Part 1 contains the commencement and definitions provisions. It is envisaged that the Bill will be commenced on a phased basis in line with a well-thought-out implementation plan.

Part 2 focuses on care and treatment and the development of digital records. To ensure patient information follows the patient throughout his or her care and treatment, the Bill introduces a duty on health service providers to share relevant patient-level health information. It is intended that, after a suitable transition period, the sharing will be done digitally so that information updates are made in real time. That will help deliver on the Sláintecare objective of the right information, in the right place at the right time, which will benefit not only the patient but also, importantly, the health professionals providing the care and treatment. Supporting the digital transformation of healthcare are the provisions in the Bill that provide the legislative structure for the implementation of summary care records, shared care records and electronic health records by the HSE. The logical progression, based on the experience in other countries, is that summary care records containing high-level patient information come first as an early deliverable from a broader project to implement shared care records and electronic care records.

Part 3 responds to the challenges posed by ongoing and significant health information deficits and the reluctance to share health information for a range of essential population health service activities. It provides for a structured, public interest framework which will mandate the provision of health information. It also provides that the health information provided can be made available to legitimate third parties, but only on an anonymised or pseudonymised basis, and it creates a new offence where an attempt is made to identify individuals from that data.

While individual provisions in the Bill contain specific data protection safeguards, Part 4 has a dedicated provision, based closely on section 36 of the Data Protection Act 2018, empowering the Minister for Health to prescribe a range of tailored safeguards to ensure the highest degree of protection for data subjects in the processing of their personal health data. This is an important measure that will ensure the flexibility necessary to respond with legislative force to any issues or concerns affecting public confidence which may emerge.

The new health information framework needs dedicated strategic leadership if it is to succeed. Part 5 provides for that leadership with the proposed establishment of a single-purpose national health information authority. That will be the body which will mandate the provision of health information under Part 3 and put in place the strict governance rules for accessing it. The Department has considered the extent to which repurposing of existing bodies to fill that role might be feasible and will further examine such possibilities in the business case it is preparing for the new authority. Part 5 also provides for the wider use of the personal public service number, PPSN, in the health services as the primary health identifier to organise, link and match health information, and to help ensure the health services are part of the wider public service ecosystem rather than stand-alone. It also makes provision for the use of eircodes to help ensure unique, accurate and safe identification for health-related purposes.

A core objective of the Bill is building and maintaining public confidence and ensuring stakeholders have an ongoing voice in the development and operation of our health information system. That is why Part 6 provides for a consultative forum to be established by the national health information authority. Membership of this will be based on public expressions of interest and on the need for a diversity and inclusiveness of views.

Supporting public confidence is the reason for the proposed national health information guardian provided for in Part 7. The concept is based on the UK model where the guardian provides guidance to the Government and the health and adult social care system on data confidentiality, security and patient data choice. The role is primarily to advise and challenge the health and social care system to help ensure individuals' health information is safeguarded securely and used properly to support direct care, and to achieve better outcomes from health and social care services. The Data Protection Commission has particularly welcomed this initiative.

Part 7A provides the opportunity to explicitly address the information requirements of the HSE. It strengthens necessary and legitimate health information flows to the HSE. The provisions are tightly drawn and directly aimed at improving the operational and management performance of the HSE. Separately, the provisions also deal with the flow of health information within the HSE and with the provision of health information by the executive to the Minister.

Part 8 contains several specific measures to strengthen the existing rights of individuals in relation to their personal health information, including putting a legal obligation on a health service provider to provide an individual’s health records to another health professional at the request of the individual, and making the buying and selling of personal health information by anyone other than the individual concerned an offence.

Part 9 deals with how the Bill interacts with certain other health information legislation already in place and Part 10 deals with proceedings for offences under the Bill.

The Bill has also been prepared with a close eye on EU developments in the digital and data spheres, particularly the proposed EU regulation on the European Health Data Space, EHDS. It is noted that there is considerable alignment between the aims and objectives of the Bill and the EHDS project.

There has been formal engagement with major stakeholders across the spectrum of interested parties and there is widespread agreement on the need for, and support of, the aims and policy intent of the Bill. The Department fully accepts that the implementation agenda must be realistic and include initiatives to enhance capability and capacity to share health information. Consultations with members of the public were carried out by Ipsos consultants on behalf of the Department. That consultation exercise revealed that the public is strongly in favour of greater sharing of health information for better care and treatment and fully appreciates the importance of information sharing in delivering a high-performing health service. Concern was voiced by the public regarding the slow pace in implementing digital solutions to support information sharing and the ongoing need for patients, or their carers, to have to repeat the same information each time they engaged with different health service providers involved in their care. The development of an electronic summary care record was flagged by the public as something that would be a real benefit to patients and those caring for them. No concerns were expressed by any stakeholders regarding the personal public service number, PPSN, as the primary health identifier, subject to governance arrangements being in place.

The Data Protection Commission. DPC, has expressed support for the legislative intent of the Bill to bring clarity, certainty and consistency to the processing of personal health data for care and treatment and for wider health service activities. The commission also welcomed the early and ongoing engagement by the Department on the Bill. On specific points raised by the commission as flagged in the general scheme, we have had very careful regard to them and look forward to continuing our engagement with the DPC.

Information and e-health initiatives are never more than a means to an end. That end is to improve the care and treatment people receive and the ability of health professionals, and the health system generally, to deliver that care to individuals and to society as a whole. We believe the Bill has an important role to play in making that happen.