Human Tissue Authority

The regulator for human tissue and organs

Disclosing patient identifiable information to the HTA

This advice is no longer current. For information on the legal basis underlying the disclosure of patient identifiable information to the HTA since 25 May 2018, please refer to our privacy notice.

When carrying out inspections or investigating complaints, the Human Tissue Authority (HTA) sometimes needs to ask licensed establishments to provide patient identifiable information. This information is ordinarily held by licensed establishments on a confidential basis and is subject to obligations arising under the Data Protection Act 1998.

This guidance note has been prepared by the HTA, with advice from the Information Commissioner’s Office, to address concerns in relation to the disclosure of patient identifiable information to HTA inspectors. It is not intended to constitute legal advice; establishments that continue to have concerns about granting the HTA access to patient data should always obtain their own legal advice.

The Data Protection Act 1998

Patient information is sensitive personal data for the purposes of the Data Protection Act 1998 (DPA), and patients have a legitimate expectation that their information will be managed accordingly. Establishments will naturally wish to comply with the DPA when disclosing, or otherwise making available, patient information to HTA inspectors.

Licensed establishments have a legal obligation to make available to HTA inspectors any information they are required to keep by virtue of the HT Act or by virtue of the Human Tissue (Quality and Safety for Human Application) Regulations 2007 (“the 2007 Regulations”). Where this legal obligation arises, section 35(1) DPA, which allows the disclosure of personal data which is required by law, will operate to permit the disclosure of patient data to HTA inspectors.

In order to comply fully with the DPA, licensed establishments must, even where section 35(1) applies, ensure that at least one condition from Schedule 2 DPA and at least one condition from Schedule 3 DPA is satisfied whenever patient information is disclosed. Both schedules include conditions dealing with consent; disclosures made in accordance with the express consent of patients will therefore meet DPA requirements.
It is not strictly necessary, however, to obtain patient consent in order to share information with HTA inspectors. This is because both Schedules 2 & 3 DPA provide for ‘disclosures that are necessary for the exercise of any functions conferred on any person by or under an enactment'.

The HTA’s functions in relation to the conduct of inspections and investigations are conferred under Section 15(c) of the HT Act. Disclosures that are necessary so that the HTA can exercise these functions will therefore not contravene the DPA, even if express patient consent has not been obtained. This view has been endorsed by the office of the Information Commissioner.


The HTA recognises that patient information is held by licensed establishments in confidence and that this duty of confidence is legally binding unless patients consent to the disclosure of their information or disclosure is in the public interest.

There is a strong public interest in ensuring that the HTA should be able to access information in order to investigate complaints or assess compliance with licence conditions, licensing standards or the HTA’s Codes of Practice. Establishments that have concerns about the confidentiality of patient data should be reassured to know that HTA

  1. is itself subject to the requirements of the DPA
  2. will treat patient information confidentially
  3. will use patient information only in connection with its regulatory functions.

In considering the scope of the duty of confidentiality owed to patients, establishments should also bear in mind that HTA has statutory powers to compel the production of records that licensed establishments are required to keep by virtue of the HT Act and the 2007 Regulations and that it is an offence to fail to produce such records for inspection without good reason.

Against this background, the HTA’s view is that disclosure of such records to HTA inspectors is unlikely to give rise to any actionable breach of confidence

The HTA appreciates that registered health professionals have a professional obligation to maintain patient confidentiality. However, the HTA takes the view that disclosure of patient identifiable data for licensing and inspection purposes does not conflict with the professional duties of confidentiality. This is because, in addition to the duty of confidentiality, health professionals have a professional duty to co-operate with regulatory processes. If in doubt, however, registered health professionals should seek appropriate guidance from their professional bodies.

Human Tissue (Quality and Safety for Human Application) Regulations 2007 (the 2007 Regulations)

The HTA issues licences under the 2007 Regulations in connection with the storage, procurement, testing, distribution, import and export of tissue and cells intended for human application. The general principles set out above in relation to data protection and confidentiality apply to the disclosure of information held by licensed establishments for the purpose of licenses issued both under the HT Act and under the 2007 Regulations. However, special rules apply to patient identifiable information collected in pursuance of a licence issued under Schedule 1 of the 2007 Regulations; by virtue of Regulation 14 of these Regulations it is a criminal offence to disclose patient identifiable information unless disclosure is of a kind expressly permitted by the Regulations.

Regulation 13 of the 2007 Regulations sets out circumstances in which identifiable patient information may be disclosed. Accordingly, no offence is committed under Regulation 14 where such information is disclosed to a member or employee of the HTA or to someone carrying out an inspection on the Authority’s behalf.

The Quality and Safety of Organs Intended for Transplantation Regulations 2012 (“the 2012 Regulations”)

As set out above, the HTA has powers to compel the production of information that licensed establishments are required to hold in connection with licences issued under the HT Act and the 2007 Regulations. The position under the 2012 Regulations is slightly different in that licensed establishments have no express obligation under the 2012 Regulations to make information available to HTA inspectors and HTA has no express powers to compel the production of information under these Regulations. However, certain information held by licensed establishments for the purpose of a licence issued under the 2012 Regulations will be caught by the general provisions of the HT Act insofar as disclosure to HTA inspectors is concerned. This follows from the fact that by virtue of Regulation 6(1) of the 2012 Regulations paragraphs 2(4)(c) –(e) and paragraph 5 of Schedule 3 of the HT Act (which deal with the imposition of licence conditions regarding the recording, retention and disclosure of information) apply to information held for the purpose of a licence issued under the 2012 Regulations.

To the extent that an establishment is required by licence conditions to record and retain information for the purpose of a licence issued under the 2012 Regulations, a legal duty of disclosure to HTA inspectors will arise under paragraph 1 of Schedule 5 HT Act.

The position outlined above in relation to DPA compliance generally will accordingly apply to information that establishments are required by licence conditions to record, retain, and provide in connection with a licence issued under the 2012 Regulations.

You can download this information here 

Last reviewed: 26 August 2014

Last updated on: 28 Jun 2018