Health and Social Care Information Standards (Procedure) Regulations 2025

Considered in Grand Committee

17:02:00

Moved by

That the Grand Committee do consider the Health and Social Care Information Standards (Procedure) Regulations 2025. Relevant document: 23rd Report from the Secondary Legislation Scrutiny Committee

My Lords, these regulations were laid before the House on 25 March 2025. If approved, they will make provision about the new procedure that must be followed by the Secretary of State for Health and Social Care and/or NHS England when preparing and publishing information standards. Information standards relate to the processing of health and adult social care information. They can facilitate information to be shared easily, in real time, between health and adult social care organisations, providing a common set of requirements that must be followed. They are fundamental to ensuring interoperability and delivering a more integrated system in health and social care. Currently, the health and adult social care system lacks a joined-up approach to technology and data solutions. This is in part due to low compliance with information standards, which are not yet mandatory. This makes it hard to achieve change or deliver improvements that are consistent across health and adult social care. For the health and adult social care system to work effectively, data needs to be processed in a transparent and standardised way, using common specifications, so that it can be understood and used by health and care professionals across different settings. To be effective, standards should be mandatory, as they will be in the near future, following commencement of the relevant provisions in the Health and Care Act 2022. Noble Lords will appreciate that this was legislation made under the previous Government. I would hope that the current Government, in taking this forward, indicate a degree of unanimity on the need for a good system of standards, which support interoperability. Existing standards have not undergone a standardised approach to their preparation or review. This inconsistency has contributed to low compliance with information standards, which has made it harder for health and adult social care providers to understand what they are being asked to do and for data to be easily shared between different services. Building on the provision in the Health and Social Care Act 2012, the Health and Social Care Act 2022 makes compliance with information standards mandatory. These procedural regulations that we are considering today set out a specific process that must be followed in developing and publishing all information standards going forward. Parliament permitting, once the Data (Use and Access) Bill becomes law, they will be mandatory for not just providers of health and adult social care services but the IT providers with which they contract. I draw noble Lords’ attention to the element of consultation that the regulations would require. This has also been part of the process of developing these regulations, as there has been a public consultation and extensive engagement with stakeholders to ensure that we get this right; an impact assessment has also been published. The procedures outlined in this instrument have therefore been carefully considered and developed, taking into account views from stakeholders across the health and care sector. They will ensure that information standards are fit for purpose, kept up to date and reviewed regularly as needed; and that they keep pace with technical developments and evolving priorities. I beg to move.

My Lords, although we recognise the ambition behind these regulations to foster better integration and data sharing across health and social care, we harbour some reservations regarding their scope. We are deeply concerned about their implementation, including the costs there, and the potential impact on individual liberties. We understand that the need for seamless information flow to improve patient care and service delivery is undeniable. We as Liberal Democrats have long championed a more joined-up approach—one that empowers professionals with the right information at the right time. However, as always, the devil lies in the detail. This statutory instrument, while aiming for laudable goals, raises several critical questions that demand thorough scrutiny. First, we are concerned about the breadth of the data being mandated for collection and sharing. Although the consultation response attempts to address concerns about proportionality, the regulations still appear to cast the net very wide. We must ensure that the data collected is strictly necessary and proportionate to the intended purposes; and that robust safeguards are in place to prevent mission creep and unwanted intrusion into individuals’ lives. The potential for sensitive personal information to be accessed and shared across numerous entities requires the highest level of scrutiny and ironclad guarantees against misuse. Secondly, the consultation response highlights ongoing concerns regarding interoperability. It is worth noting at this point that there were only 132 responses to the public consultation. That is rather worrying considering that we are talking about nearly 2,000 private sector entities involved in providing the type of health and care about which we are talking. There are real issues around the technical capability of various organisations, particularly in the social care sector, to implement these standards effectively. Many providers, especially smaller ones, lack the digital infrastructure and resources to integrate the new data systems seamlessly. Without adequate financial and practical support, these regulations risk exacerbating existing inequalities and placing undue burdens on already-stretched services. We need assurances that the implementation will be phased and adequately resourced, ensuring that no part of the health and social care system is left behind. At this point, it is worth pointing out that, if the impact assessment were in a kitchen, it would be a colander: it has so many holes and assumptions that it is not worth the paper it is written on. I have read many impact assessments but never have I read one that says, basically, that, because we do not know the standards, we have not spoken to the IT suppliers and we do not really understand what it is we are asking to be implemented, we cannot make a real, positive determination of costs. In paragraph 24, it says: “In brief, as future information standards remain an unknown, the costing has had to be based largely on a set of informed assumptions”. However, when you read the informed assumptions, you see that they are not informed—they are just assumptions. The impact assessment goes on to say that it has not really been appropriate to speak to IT suppliers as it is too early to have an indicator of the compliance costs. It also makes it very clear that the way in which small social care providers will potentially have the ability to implement this cannot be guaranteed; and that there could be market fragmentation. I have some questions for the Minister about the impact assessment and the robustness of the assumptions made. When the Minister read the impact assessment, what concerns were raised to her? What assurances have been given to her, particularly regarding small social care providers’ ability to implement what is being asked of them? On costs, what assurance has the Minister been given with regards to the quantum of costs? The impact assessment makes it clear that these costs cannot in any way, shape or form be guaranteed to be the total cost, particularly for small to medium-sized enterprises. What assurances can the Minister give the Committee that, if certain costs go beyond a certain ceiling, the implementation period will be either extended or paused? This is an important point, particularly when many social care providers are already on the brink of financial instability; many talk about not being able to absorb further costs. If the Minister cannot give me assurances, I will probably raise this matter on the Floor of the House; it may be that, because of the details that I require, the Minister offers me a meeting to give me reassurance before this is discussed in the House. We also note the continued ambiguity surrounding the explicit consent mechanisms and the rights of individuals to control how their data is used. Although the consultation touches on these matters, the regulations themselves lack the clarity and strength needed both to guarantee genuine informed consent and to provide individuals with meaningful choices regarding their data. We believe that individuals must have a clear understanding of what data is being shared, with whom and for what purpose; and that they must possess the right to object in appropriate circumstances.

17:14:00

Sitting suspended for a Division in the House.

17:37:00

I therefore wish to pose the following extra questions to the Minister. My first is on the timescale of and reasons for bringing this statutory instrument forward. Based on the fact that the impact assessment says that, “despite best endeavours to collect and draw upon strong evidence, cost and benefit assumptions remain uncertain and based on limited evidence availability in places”, why has this statutory instrument been brought forward? Why could it not have been brought forward when there was more certainty and understanding of the implications of its implementation? Secondly, given the breadth of data mandated for collection, what specific purposes will the Government put in place to ensure strict proportionality and to prevent the collection and sharing of information that is not absolutely necessary for the stated purposes of these regulations? Also, how will the Government guarantee that these measures will be actively monitored and enforced? Thirdly, acknowledging the significant disparities in digital infrastructure across the health and social care landscape—particularly in the social care sector—what concrete financial and practical support will the Government provide to ensure the equitable implementation of these standards? What is the projected timeline for achieving full interoperability across all relevant organisations? How will the cost implications of this implementation mean that that timescale could be flexible? Considering the fundamental importance of individual autonomy and data privacy, what further steps will the Government take to strengthen the explicit consent mechanisms in these regulations, ensuring that individuals have clear, accessible information and meaningful control over their own health and social care data when it is shared and used? We believe in the transformative potential of data to improve health and social care. However, this transformation must be built on a foundation of trust, transparency and respect for individual rights. I therefore urge the Minister to carefully consider the concerns and ensure that these regulations truly serve the best interests of the individuals they are intended to benefit. I remind the Minister that it might be useful to meet before this goes to the Floor of the House, in particular with regard to some of the issues in the impact assessment.

My Lords, this has been a rather disrupted session, to say the least; I will do my very best to keep some continuity. I start by offering the noble Lord, Lord Scriven, reassurance that we are happy to meet, and we recognise the detail of issues that he has asked for. I will not be able to give a response now, but if he will bear with me, we will write to him to take the issues forward. In summing up, I emphasise that the procedures set out in the instrument are a crucial pillar in the design of a robust information standards framework to cover health and adult social care. I believe they give a clear process for consulting to ensure that mandatory standards are appropriate, while avoiding cumbersome procedures. They will ensure that the appropriate procedural rigour is consistently applied—a major concern of the noble Lord—particularly while the information standard is being developed, and will make sure that the standards are all fit for purpose. The noble Lord raised concerns about potential creep resulting from the regulations. I assure him that, where data is used for purposes beyond direct care, only data necessary to meet the specific purpose will be made available. Where data is used for purposes beyond direct care, it is normally anonymised, and patients are entitled to expect an obligation of confidence for the health and care services they receive. A number of safeguards ensure that data is used for the purposes for which it was shared. These include provisions of the Data Protection Act 2018 and the UK general data protection regulation regarding limitation of purpose, the Caldicott principles, security standards and toolkits, independent advisory bodies and a national data opt-out. These ensure that health and care data is used in a safe, secure and legal way. The noble Lord also raised concerns about the burden of these procedures, particularly on social care, and specifically referenced small providers. I know that he is very active in this space and will be talking to people out there. We need to make sure that mandatory information standards introduced as part of the staged process beginning later this year focus initially on those that are critical or most beneficial to improving integration of care. We need to remember throughout the ultimate purpose of this: to bring a better service to patients or users of services.

17:45:00

The instrument requires us to specify the date when a new standard takes effect. NHS England is currently assessing which information standard will be the first to be mandated under the new legislative powers, including reviewing candidate information standards from the existing pipeline to determine which best align with priority use cases, and to ensure that they meet the requirements of the legislation and that there is appropriate capacity to manage the required changes, ensuring a frictionless transition from the existing information standard system to the new process for introducing mandatory information standards. The regulations which will commence Section 95 of the Health and Care Act 2022 allow for information standards made under the existing system to continue to have effect until these have been revoked, expired or gone through the procedures in these regulations to become mandatory.

Finally, I assure the noble Lord that engagement with health and care stakeholders, including the providers we mentioned, and IT suppliers has been taking place since July 2022. I am sure that, if he could speak, the noble Lord opposite would agree that intensive work has been going on for some time around these measures. The queries, concerns and recommendations gathered as part of the consultation have been used to inform and develop operational processes designed to ensure that sufficient consideration is given to the potential impact on business. The impact assessment for Section 95 of the Health and Care Act 2022 did not suggest that the system of mandatory information standards will be a burden on businesses. Standards are likely to be reflective of international good practice, and England-specific standards used where required by local need. The procedures in this instrument ensure that advice is sought on each standard, which is a proportionate way to allow potential constraints to be identified. I commit to write to the noble Lord, particularly on our cost projections so far.

As for the reason we are bringing this forward, we know that information standards are not new. Legal powers to publish information standards were set out in Section 250 of the Health and Social Care Act 2012. However, these standards were not mandatory; providers have had to have regard to them. Under the 2012 Act, there was no regulatory requirement that set the procedure to be followed when preparing and publishing an information standard. As such, existing standards have not undergone a standardised approach in their preparation or review. This inconsistency has contributed to low compliance with information standards by making it sometimes unclear for health and adult social care providers to understand what they are being asked to do. Making regulations on procedures for preparing and publishing information standards is an integral part of a wider set of measures that are intended to improve the entire information standards framework. I hope the noble Lord will agree that advance information and preparation for the work that needs to be done is entirely appropriate.

I fully understand and respect that answer, but it does not answer the question that I asked. I did not at any point in my intervention undermine why this was needed, and I actually said that we on these Benches are supportive. I asked why it is coming now and why it could not be delayed until we have further information. The Government’s own impact assessment says that, “despite best endeavours to collect and draw upon strong evidence, cost and benefit assumptions remain uncertain”. It is not just the cost and benefits; the assumptions remain uncertain and based on limited evidence. My question was why this needs to come forward now. What is the key issue that means this has to be debated and go through Parliament now? Why can it not come forward when some of those assumptions, and the uncertainty about the assumptions, are stronger?

I must admit that I had hoped that I had answered the question on the sequence of the processes. All I can say, again, is that it is about the whole process going forward, and obviously the costs and benefits will depend on the information that is gathered as we move forward with these principles. If the noble Lord is still not satisfied, this can of course be part of the information that I share with him going forward. Moving on, the regulations set the process that will be followed in preparing and publishing information standards. Following on from that, it is absolutely appropriate for the Government or the body that they designate—such as NHS England—to set information standards for the health and care system to ensure that we have interoperability. As I have said before, we have run a public consultation and published its findings. NHSE has undertaken extensive stakeholder engagement, which will be ongoing. The last thing anyone wants to do is make the changes opaque and difficult to understand. Of course, we have to keep all of this in proportion, given the amount of information we are talking about, and make sure that it is completely relevant and fit for purpose. The overriding conclusion is that we need to create a modern health and adult social care service where systems are integrated and staff have quicker access to patient data, freeing up time that could be spent with patients. Ensuring that information flows between services in the NHS and social care is a prerequisite of a responsive and effective service that meets people’s needs. Mandated information standards will set the technical means to ensure that this happens. I hope the Committee as a whole will recognise that setting these standards to ensure that IT systems and services can share data easily is fundamental to delivering the most effective health and care systems, and will agree that these regulations are practical and proportionate.

Motion agreed.