Menu

Health Identifiers

Purpose of the Act

The purpose of the Health Identifiers Act is to provide for the assignment of health service identifiers for use in the public and private health service and for the related governance framework. The Act provides for the assignment of unique health identifiers to individuals to whom a health service is being, has been or may be provided and for the assignment of unique identifiers to health services providers.

Health services providers under the Act are health practitioners (for example: doctors, dentists, nurses, pharmacists and opticians) who fall within a prescribed class of health practitioners and health service organisations (for example, hospitals and general practitioner practices) who fall within a prescribed class of health service organisations and the employees and agents of these health practitioners and health service organisations.

A national register of individual health identifiers and a national register of health services providers were established containing the identifiers and other relevant information. The National Register of Individual Health Identifiers (IHIs) is accessible only to specified persons under the Act and to the Minister and section 12 persons (subject to agreement). The National Register of Health Services Providers Identifiers is to  be publicly accessible.

The Act also provides for the processing of the IHI and the other identifying particulars relating to the individual in the IHI Register including the disclosure of such information to authorised disclosees.

Providers are required to associate the individual health identifier and their own provider identifier with health records and to use these identifiers in relevant communications. An IHI in itself will be a number containing no personal data and the IHI register will contain no clinical information.

Assigning identifiers and establishing and maintaining the related registers are functions of the Minister for Health under the Act. However, the Act provides for the possible delegation of these functions to the Health Service Executive (HSE). Where this happens it will be for operational reasons.

Implementation of a unique identifier system is recognised as being an essential infrastructural initiative which will facilitate many significant improvements to the health system in areas such as patient safety and improved data access and quality leading to improved overall systems efficiency. It is also a fundamental requirement for deploying eHealth solutions and an essential building block for Money Follows the Patient and Universal Health Insurance, both cornerstones of the Government Reform Agenda.

Overview

The Act provides for—

  • the Minister to assign an Individual Health Identifier (IHI) — a unique number — to an individual to whom a health service is being, has been or may be provided,
  • the Minister to assign a Health Services Provider Identifier — a unique number — to a person (a natural person or a legal person) who provides a health service,
  • the Minister to establish and maintain National Registers in respect of the IHI and Health Services Provider Identifiers which will contain the identifiers and other identifying particulars of those to whom the numbers are assigned,
  • the association of the identifiers with medical records and related communications,
  • the basis on which the IHI Register and the Provider Identifier may be accessed,
  • the basis on which the information in the IHI Register may be processed and by whom,
  • possible Government delegation of certain Ministerial functions under the Act to the Health Service Executive (HSE),
  • the application of the Data Protection Acts 1988 and 2003, and
  • related matters including offences, complaints and the consequential amendment of other enactments.

Preliminary and General

The Minister may assign a unique number to—

  • a living individual (whether or not the individual is ordinarily resident in the State) to whom a health service is being, has been or may be provided, or
  • an individual who dies on or after the coming into operation of the Act where that individual was not assigned a number during his or her lifetime.

An IHI will, other than itself, contain no personal data. The assigning of an IHI to an individual is not to be regarded in any way as indicating, in and of itself, an entitlement to, or eligibility for, the provision of a health service to the individual. In a similar way,  a health services provider cannot refuse to provide a health service to an individual to which he or she would otherwise be entitled solely because an IHI has not been assigned to the individual or he or she refuses to provide it.

There are measures that the Minister may put in place or cause to be put in place to assist in enabling an individual to have his or her IHI made known to him or her (or, in the case of a deceased individual, to be made known to the individual’s personal representative). It also covers situations where the individual is a child or lacks capacity. There is consultation by the Minister in relation to measures being contemplated.

National Register of Individual Health Identifiers

There are provisions establishing and maintaining the National Register of Individual Health Identifiers containing, in relation to each individual who has been assigned an individual health identifier, the individual health identifier, and such of the individual’s other identifying particulars as are known. These ‘‘other identifying particulars’’, are particulars that assist in the unique identification of an individual for the purposes of the individual health identifier system. They are:

  • surname;
  • forename;
  • date of birth;
  • place of birth;
  • sex;
  • all former surnames;
  • mother’s surname and all former surnames of his or her mother (including mother’s surname at mother’s birth);
  • address;
  • nationality;
  • personal public service number (if any) within the meaning of section 262 of the Social Welfare Consolidation Act 2005;
  • date of death in the case of a deceased individual;
  • signature (not being a signature which falls within a class of signatures prescribed as a class of signatures to which this paragraph does not apply);
  • photograph (not being a photograph which falls within a class of photographs prescribed as a class of photographs to which this paragraph does not apply); and
  • subject to having consulted with the Data Protection Commissioner, any other particulars (excluding clinical information relating to the individual) prescribed for the purpose of this paragraph that, in the opinion of the Minister, are relevant to identifying the individual.

Subject to a limited exception , no other personal data relating to an individual can be contained in the Register. When data is retained in the Register beyond the death of an individual it will be subject,  to the same security arrangements as apply to the Register data of a living individual.

Use of Information

The Minister may use identifying particulars the Minister or the HSE already have to seed and populate the IHI Register. There is also a requirement on health services providers to play a role in helping maintain the accuracy of the Register. For the purposes of assigning an IHI to an individual, or for establishing and maintaining the Register, the Minister may use any of the individual’s identifying particulars obtained by him or her or by the HSE whether before or after the coming into operation of this section. This will help ensure that people will not be asked to provide information already held.

For the purposes of enabling the assigning of an IHI to an individual, a health services provider who provides, or has provided, or is proposing to provide, a health service to an individual may request the individual to provide him or her with the individual’s identifying particulars. The provision also addresses the scenario where the individual concerned is either deceased or may require the assistance of another person (whether due to the age or lack of capacity of the individual or for any other reason).

An individual, personal representative or other person who receives such a request from a health services provider must, if one or more of the individual’s relevant identifying particulars are known to him or her, comply with the request and provide the provider with the information concerned.

A health services provider who has been provided with the informatin above is to forward such information to the Minister. Where a health services provider has , provided the Minister with the information concerned and it subsequently comes to his or her attention that any of those particulars were not, or are no longer, accurate, he or she shall so inform the Minister. There is provision for updating identifying particulars that were themselves updated.

A Minister of the Government may provide the Minister with an individual’s other identifying particulars. This may be done only where such provision is made solely for the purposes of establishing and maintaining the accuracy of the Register. This ensures appropriate re-use of information already collected and verified by Government.

The Ard-Chláraitheoir — who has information on births and deaths has a role  in providing information to the Minister relevant to the Minister’s functions under the Act.

Access to Register

The Act provides for who may access the Register and the purposes for which they may do so. The only persons allowed to do so are the Minister, a specified person and a person who is covered by an agreement under the Act  (called in the Act, an ‘‘equivalent person’’). Specified persons are  defined as a health services provider, a person specified in Schedule 2, or a person prescribed as a specified person following consultation with the Data Protection Commissioner.

The Minister, a specified person and a person who is covered by an agreement under the Act  may access the IHI Register only for a relevant purpose set out in the Act with the Minister also being able to do so for the purpose of performing a function conferred on him or her by the Act or another enactment. The term ‘‘relevant purpose’’ divides into a primary purpose and a secondary purpose.

A primary purpose is the present, past or future provision of a health service to an individual and a secondary purpose is—

  • the promotion of patient safety, including clinical auditing and the investigation and reporting of patient safety incidents,
  • the management of health services, including— the planning, monitoring, delivery, improvement, auditing and evaluation of health services,       the investigation and resolution of complaints relating to health services, and      the management of national health systems,
  • the carrying out of health research that is governed by an enactment, or an European act, prescribed for the purposes of this paragraph,
  • the performance of any function conferred on a person under this Act or another enactment for which the processing of identifiers is necessary,
  • the provision of a scheme of health or health-related insurance operated by an undertaking authorised to so do under the Health Insurance Act 1994, or
  • any processing of personal data that is in accordance with the Data Protection Acts 1988 and 2003.

The Minister and specified persons may disclose an individual’s relevant information (the IHI and other identifying particulars in the Register) to an authorised disclosee for a particular secondary purpose. Authorised disclosees are set out in Schedule 1. As with specified persons, the Minister may also prescribe additional persons to be authorised disclosees but only following consultation with the Data Protection Commissioner.

The Minister is to  put in place measures, or cause to be put in place measures to

  • enable the Register to be accessed appropriately and
  • to prevent it being accessed inappropriately.

The Act deals with the processing of the IHI and the other identifying particulars in the Register by health services providers, other specified persons and the Minister and the disclosure by them of that information to authorised disclosees to enable the disclosees process it for a particular secondary purpose.

Information from Individual

A health services provider must, when providing a health service to an individual, request that the individual provide his or her individual health identifier (if any) to the provider. The health services provider where he or she is advised of the IHI by the individual  or is able to establish it from the Register from information provided by the individual to associate it with the individual’s medical record and relevant communications (which is set out  below).

An individual to whom a health service is provided by a health services provider, or who seeks to have a health service provided to him or her by a health services provider, shall give his or her IHI to the provider when requested to do so by the provider if—

  • the individual has an individual health identifier, and
  • the individual health identifier is known to the individual.

A health services provider cannot refuse to provide a health service to an individual, to which he or she would otherwise be entitled, solely because—

  • an individual health identifier has not been assigned to the individual,
  • the individual cannot or refuses to provide his or her individual health identifier,
  • the individual cannot or refuses to provide other identifying particulars in accordance with a request or
  • the provider does not have access to the National Register of Individual Health Identifiers at the time when the individual is seeking to obtain the health service.

Where the above apply, the health services provider is to make a note of that fact in the record that he or she makes, or causes to be made, of the provision of the health service concerned.

The Act deals with the processing of the IHI (and the other identifying particulars in the Register relating to an individual) by the Minister and specified persons. Such processing must be for a relevant purpose. It also addresses the disclosure of the IHI (and the particulars) by the Minister or specified person to an authorised disclosee. Such disclosure must be for a particular secondary purpose.

A  ‘‘relevant communication’’, in relation to a health services provider and an individual, means a communication relating to a relevant purpose, and      sent by the provider to—

  • the Minister,
  • another specified person,
  • an authorised disclosee, or
  • the individual.

It is recoginsed  that sometimes individuals will need to travel to another EU Member State, for certain health services under a formal service arrangement, with an external health services provider. In such circumstances, those providing the services in the other EU Member State should be able to access the Register and obtain and use the patient’s IHI for relevant purposes. In all cases, this will happen only on the basis of an agreement entered into between the Minister and the other health services provider.

The Minister cannot make such an agreement except after consultation with the Data Protection Commissioner and the Commissioner may, at any time, review the operation of an agreement and report to the Minister on his or her findings, and the Minister will take such action as the Minister considers appropriate. This s intended to provide for situations where, for example, the HSE has entered into an arrangement with a health services provider outside the jurisdiction to provide services for a significant volume of patients; it is not intended for use in the case of individuals electing to seek services outside the jurisdiction or for small volumes of patient referrals.

Health Services Provider Identifiers

This Part deals with the Health Service Provider Identifier and the related National Register of Health Service Providers. Provider Identifiers can be assigned to the following persons—

  • a health practitioner who falls within a prescribed class of health practitioners,
  • a relevant body or a relevant body which falls within a prescribed class of relevant bodies,
  • a relevant employee of: a health practitioner, or           a relevant body,
  • a relevant agent, who is an individual, of: a health practitioner, or a relevant body,or
  • a relevant agent, who is not an individual, of— a health practitioner, or           a relevant body.

Relevant body is defined as the HSE or a body corporate, or an unincorporated body of persons, through which or in connection with which (whether by reason of employment or otherwise) a health practitioner, a ‘‘health services provider’’, provides a health service. Accordingly, a hospital, for example, would fall within the definition of ‘‘relevant body’’.

Provider Identifiers may be assigned on a graduated basis to health services providers over time.

The National Register of Health Services Provider Identifiers is to be accessible by the public.

The Minister may assign a unique number to a health services provider. Where a health services provider is a relevant body and an agent of another relevant body, the Minister may assign the same health services provider identifier to the provider in both capacities. Such a situation might arise, for example, where a hospital is a relevant body in its own right but it may have a contractual arrangement to do certain work (for example, diagnostic tests) for another hospital.

As with the IHI, the provider identifier of individuals who are health services providers will, other than itself, contain no personal data. The provider identifier is to denote the class of health practitioners that the provider falls within. This will ensure that all identifiers are unique and more easily identifiable with a category of health professional.

National Register of Health Services Provider Identifiers

The Act deals with the establishment and maintenance of the National Register of Health Services Provider Identifiers and the information (provider identifier and relevant particulars) about providers to be contained therein. For ease of reference, the Register is to consist of five parts corresponding to the five categories — A, B, C, D, and E — of health services providers (as set out above).

The Minister cannot exercise his or her power to prescribe additional identifying details in relation to providers who are individuals except after consultation with the Data Protection Commissioner. The Act provides for a situation where a health services provider who has been assigned a health services provider identifier ceases to be a provider and permits the former health services provider’s identifier and other identifying information to continue to be contained in the Register with appropriate notation.

As with the IHI Register, the National Register of Health Services Provider Identifiers needs to be seeded and its accuracy maintained on an ongoing basis. There are provisions which are designed to help with this objective and he requirement is on the professional regulatory body, relevant body or health practitioner, as appropriate, to provide the information specified rather than on the Minister to seek it either initially or for updating purposes.

The Act covers the provision of information by professional regulatory bodies to seed and update that Part of the Health Services Provider Identifiers Register relating to prescribed classes of health practitioners. It deals with information to be provided to the Register by a prescribed relevant body or class of relevant bodies.  It addresses the information to be provided by health practitioners and relevant bodies concerning relevant employees and relevant agents. This is on the basis that health practitioners and health services providers are best placed to provide information to the Register in relation to their employees and agents including indicating whether they do or do not have any relevant employees or relevant agents.

For the purpose of  seeding and maintaining the Register, the Minister may use any relevant information obtained by him or her or the HSE (whether before or after the coming into operation of this section) for the purposes of assigning a health services provider identifier to a health services provider and the establishment and maintenance of the National Register of Health Services Provider Identifiers.

There are provisions governing access to the National Register of Health Services Provider Identifiers. Any person may access the Register and the Minister must put in place measures, or cause to be put in place measures, to enable the Register to be accessed.

The Act sets out the uses of the health services provider identifier and the Register. In particular, it requires health services providers (who have been assigned a health services provider identifier), to

  • associate the provider identifier with the record that he or she makes, or causes to be made, of the provision by the provider of a health service to an individual, and
  • indicate that identifier in any relevant communication.

Relevant communication in this context n has the same meaning as above. The requirement to use the provider identifier will not apply where a health services provider is a person who is required by or under another enactment to use a registration number assigned to him or her by a professional regulatory body in the provision of the health service concerned.

Offences

In order to help ensure the integrity of the Health Identifier system, the Act creates a number of offences.

There are offences relating to the assignment of an IHI. There are  offences relating to inappropriate accessing by a person of the National Register of Individual Health Identifiers and inappropriate processing of the IHI. A person shall not access that Register except pursuant to, and in accordance with, a provision of the Act or another enactment.

A person shall not process an individual’s individual health identifier (not being his or her own IHI) for a purpose other than a relevant purpose (as defined). A  person who knowingly contravenes these provisions is be guilty of an offence.

There are provision dealing with inappropriate access by a specified person to the IHI Register. A specified person shall not access the IHI Register by the use of a means which purports to identify the specified person as a different specified person. A specified person who does so will be guilty of an offence. Health practitioners, health organisations and other specified persons with employees and agents will be expected to ensure that they institute proper rules in relation to the accessing of the IHI Register by staff.

There are  offences in relation to the assignment of a Provider Identifier and corresponds to those dealing with the IHI. There are are provionss for offences by bodies corporate.

Delegation of Relevant Functions of Minister

The Government may by Order delegate to the HSE any or all of the Minister’s functions under the Act except excluded functions (which are the Minister’s power to make  regulations or ) statutory  agreements). Such orders may be revoked at any time and can contain conditions.

Any function delegated to the HSE continues to be vested (concurrently) in the Minister. The delegation does not remove or derogate from the responsibility of the Minister to Dáil Eireann or as a member of the Government for the performance of any functions that are delegated. Orders must be laid before the Houses of the Oireachtas.

Application of the Data Protection Acts 1988 and 2003

The Act deals with its relationship between and the Data Protection Acts (now GDPR),  It states that a living individual’s individual health identifier will be considered personal data when held by the Minister, a specified person or the HSE when acting in a particular capacity under the Act. It also makes clear that this is not to be construed to prevent a living individual’s IHI held by a person other than the aforementioned from being personal data in accordance with the provisions of the Data Protection Acts.

The provision in GDPR for security arrangements for personal data will apply to the information in the IHI Register relating to deceased individuals as those sections relate to a living individual’s information.

Miscellaneous

The Minister can require an investigation to be carried out in respect of the operation of any provisions of the Act and reports in writing made to him or her in respect of such investigations, as he or she considers reasonable and necessary. There is also a requirement to co-operate on a specified person, professional regulatory body, authorised disclosee and the HSE.

The  Minister has power to enter into an agreement with a person, upon such conditions as may be specified in the agreement, to provide for the performance by that person of activities that are ancillary to the performance of a function of the Minister under this Act. For example, this could be specialist IT services.

The Minister may carry out or cause to be carried out, measures that he or she considers necessary to—

  • verify any information provided to him or her under this Act, or
  • establish the efficient and effective operation of the Registers.

There is to be co-operation in relation to these measures from persons who either provided or were required to provide information under the Act.

There is provision for formal data exchange agreements. This allows for a formal framework for the exchange of information under the Act between the Minister and other persons. Specifically, for the purposes of performing his or her functions under the Act, a data exchange agreement may be entered into between the Minister and a relevant body (such as a hospital), health practitioner (such as a pharmacist), relevant agent (of a health practitioner or hospital etc), professional regulatory body, or equivalent person.

That agreement is to  specify the procedures to be followed by each party (to the agreement) with respect to the provision of personal data between them for the purposes to which the agreement relates. The Minister is equired to consult with the Data Protection Commissioner in relation to a data exchange agreement before it is entered into or varied.

As a further privacy safeguard, the Act provides that any processing of personal data by the Minister (or the HSE if delegated functions  for the performance of functions under the Act must go no further than is reasonably necessary for the performance of those functions.

For standardisation and consistency, the Minister can specify the form of any documents required for the purposes of the Act including the form in which any information (howsoever described), notice or confirmation which is required to be, or which may be, provided to him or her on foot of a provision of the Act is to be provided. The Minister may extend the time period for providing information to him or her as required under the Act.

The Minister (or the HSE if delegated the function) may ake a complaint to the appropriate professional regulatory body for dentists, health and social care professionals, pharmacists, doctors and nurses and midwives where the professional concerned has failed to comply with a provision of the Act (for example, not associating the IHI with a patient medical record after this becomes mandatory).

Schedule 1 lists Authorised Disclosees. Schedule 2 lists persons who are Specified Persons (other than those who are health services providers)

Related Posts

error: Content is protected !!