title: UK National Data Guardian for Health and Care's Review of Data Security: Trust, better security and opt-outs.
abstract: Sharing health and social care data is essential to the delivery of high quality health care as well as disease surveillance, public health, and for conducting research. However, these societal benefits may be constrained by privacy and data protection principles. Hence, societies are striving to find a balance between the two competing public interests. Whilst the spread of IT advancements in recent decades has increased the demand for an increased privacy and data protection in many ways health is a special case. UK are adopting guidelines, codes of conduct and regulatory instruments aimed to implement privacy principles into practical settings and enhance public trust. Accordingly, in 2015, the UK National Data Guardian (NDG) requested to conduct a further review of data protection, referred to as Caldicott 3.  The scope of this review is to strengthen data security standards and confidentiality. It also proposes a consent system based on an "opt-out" model rather than on "opt-in.Across Europe as well as internationally the privacy-health data sharing balance is not fixed.  In Europe enactment of the new EU Data Protection Regulation in 2016 constitute a major breakthrough, which is likely to have a profound effect on European countries and beyond.  In Australia and across North America different ways are being sought to balance out these twin requirements of a modern society - to preserve privacy alongside affording high quality health care for an ageing population.  Whilst in the UK privacy legal framework remains complex and fragmented into different layers of legislation, which may negatively impact on both the rights to privacy and health the UK is at the forefront in the uptake of international and EU privacy and data protection principles. And, if the privacy regime were reorganised in a more comprehensive manner, it could be used as a sound implementation model for other countries.
authors.affiliation: University of Surrey. t.chan@surrey.ac.uk.
authors.forename: Tom
authors.initials: T
authors.lastname: Chan
authors.affiliation: Serectrix s.n.c. ct.diiorio@serectrix.eu.
authors.forename: Concetta Tania
authors.initials: CT
authors.lastname: Di Iorio
authors.affiliation: University of Surrey. s.lusignan@surrey.ac.uk.
authors.forename: Simon
authors.initials: S
authors.lastname: De Lusignan
authors.affiliation: Guildford and Waverley CCG. daniel.lorusso@nhs.net.
authors.forename: Daniel
authors.initials: D
authors.lastname: Lo Russo
authors.affiliation: University Research Chair in Healthcare Innovation, Associate Professor Telfer School of Management University of Ottawa. kuziemsky@telfer.uottawa.ca.
authors.forename: Craig
authors.initials: C
authors.lastname: Kuziemsky
authors.affiliation: UNSW Medicine Australia Ingham Institute of Applied Medical Research Sydney, NSW, Australia. siaw@unsw.edu.au.
authors.forename: Siaw-Teng
authors.initials: ST
authors.lastname: Liaw
mesh_terms: D016494:Computer Security; D003219:Confidentiality; D057286:Electronic Health Records; D006801:Humans; D016347:Medical Records Systems, Computerized / Q000941:ethics*; D018907:Privacy; D006113:United Kingdom
keywords: Informatics, data security, data protection, data sharing