Plans to centralise the storage of health data in France are being considered by the French parliament.
Draft legislation, which would see a new single national health database created, was backed by the National Assembly earlier this month and is now being considered by the Senate.
Under the proposals, five sets of data would be aggregated. Hospital data would be combined with health insurance information, data on the causes of death and medical-social information regarding disabled people under the scheme.
Anonymised files will be made available for anyone to access under the plans. The data protection authority in France, the Commission Nationale de l’information et des Liberties (CNIL), will be involved in defining data anonymisation procedures.
Datasets containing some personal data, but not French citizens' names or national identity numbers, will also be aggregated. Access to those datasets will be restricted and authorisation will only be provided to public authorities for the purposes of studies, research or evaluation that are either of public interest or necessary to the completion of their mission.
Data protection law expert Annabelle Richard of Pinsent Masons, the law firm behind Out-Law.com, said that the proposals would be welcomed by medical researchers, but that a number of legal issues have still to be addressed.
"Combining health datasets should, in theory, help medical researchers and health care providers analyse existing information and develop new treatments and services to tackle problems they identify from that data," Richard said. "However, in practice it raises several issues around privacy and security that need to be addressed before the new law is passed."
"French citizens need to be given clear information describing how their health data could be processed under the scheme, including examples of organisations that would be able to access their data and for what purposes," Richard said. "A mechanism also needs to be put in place to ensure citizens that do not want their data to be aggregated under the scheme have the chance to opt out."
"Further questions such as which body would be responsible for controlling access to data and for providing oversight of the use of data under the scheme also need to be addressed, as does the issue of data security. A central database of sensitive health information creates the risk that all of this data could be leaked in one single security incident," she added.
Richard also said that the draft legislation does not currently specify which public authorities would have access to personal data under the new rules. It would be up to the French government to set out this detail in an order implementing the new law after the law has been finalised, she said.
Richard said there were parallels to be drawn between the French government's plans and the Care.data scheme intended for the NHS in England.
The Care.data programme was due to begin in April 2014, but its implementation was postponed following concerns about patient awareness of the scheme and their consent to the use of their health data.
The new Care.data database will combine some patient data gathered from GP surgeries in England with that already collected by hospitals unless individuals opt out of the scheme. The Health and Social Care Information Centre (HSCIC), established under the 2012 Health and Social Care Act, will manage the data and it will also be responsible for authorising third parties' access to the data.
Whether the data gathered by the HSCIC would be made accessible to third parties in personally identifying, pseudonymised or anonymised form would depend on the type of third parties seeking access to the data and the purpose they are pursuing.
NHS England has said that the programme will be used for the benefit of patients; including by allowing it to monitor standards of care and clinical safety in different areas, and in cases where people with long-term conditions are being treated away from hospital. The database will also be used to support research into new medicines and the treatment of disease, it has said.
Copyright © 2015, Out-Law.com
Out-Law.com is part of international law firm Pinsent Masons.