Mr. Peter Lennon:

This issue concerning insurance companies and their getting access to information has been raised over the years. The drill is that they can only get access to information with the consent of the individual concerned. In other words, if I want to allow an insurance company to get access to my information, it would be necessary for that company to obtain my consent. That will not change because consent is the best basis on which to provide protection to the individual. More generally, however, in the context of health information planning and management, Part 3 of the general scheme, which is concerned with allowing information to be collected for management purposes, policymaking, research and innovation, etc., provides that people can make access requests for access to information in anonymised or pseudonymised form. This could be useful for the health insurance industry, for example, to allow companies in that sector to get access to information for better planning and management for health insurance purposes. They will be able to ask for access.

There is a very detailed application process, set out in head 25, to get access to any information from the national health information authority. Let us take a situation where this requirement can be satisfied. If there was a legitimate reason to access information, the company would only get anonymised or, if a very strong case could be made, pseudonymised information. We are seeking to protect the rights of the individual and empower individuals, while also recognising that the health service needs management and planning information. Some of this activity take placed in the commercial sector, as the heads and explanatory notes make clear. What we are saying is that in situations where consent is not given by the individual to that person's individually identifiable information, companies will just not get it.