Citation and commencement

1. These Regulations may be cited as the Human Fertilisation and Embryology (Disclosure of Information for Research Purposes) Regulations 2010 and shall come into force on 6th April 2010.

Interpretation

2.–(1) In these Regulations–

"the Act" means the Human Fertilisation and Embryology Act 1990;

"additional conditions" mean conditions imposed under regulation 8(2);

"application" except in regulation 9, means an application made under regulation 4 and "applicant" shall be construed accordingly;

"authorisation" means authorisation by the Authority under regulation 3;

"the Authority" means the Human Fertilisation and Embryology Authority;

"the Data Protection Act" means the Data Protection Act 1998(2);

"the NHS Act" means the National Health Service Act 2006(3);

"the NIGB" means the National Information Governance Board for Health and Social Care established by section 250A of the NHS Act(4);

"parental responsibility" has the same meaning as in section 33B(6) of the Act(5) (consent required to authorise certain disclosures);

"processing" except in regulation 14, means using the disclosable protected information authorised under regulation 3 and "process" and "processed" shall be construed accordingly;

"relevant individual" has the same meaning as in section 31(4) of the Act(6) (register of information);

"research establishment" means a university or other body or institution that carries out medical or other research within the United Kingdom;

"research ethics committee" means–

"research project" has the meaning given in regulation 4(4)(c).

(2) In these Regulations, "disclosable protected information" means information falling within section 31(2) of the Act(8) (register of information) which–

(a) is entered by the Authority on its register during the period from 1st August 1991 to 30th September 2009 (both dates inclusive) but does not fall within an exclusion in paragraph (3) of this regulation; or

(b) is entered by the Authority on its register on or after 1st October 2009 and is about a relevant individual but does not fall within an exclusion in paragraph (4) of this regulation.

(3) For the purposes of paragraph (2)(a), information is excluded where it–

(a) identifies or relates to an individual who has donated gametes other than for research purposes only;

(b) identifies or relates to an individual (or a person treated with that individual) who has received treatment services with donated gametes;

(c) identifies or relates to an individual who has donated (whether alone or with another) an embryo other than for research purposes only;

(d) identifies or relates to an individual (or a person treated with that individual) who has received treatment services with a donated embryo;

(e) identifies or relates to an individual who was conceived as a result of assisted conception using donated gametes or a donated embryo; or

(f) is in respect of–

(i) an individual who has refused to give consent for disclosure for the purposes of research;

(ii) an individual who has not attained the age of 16 years, where the parents of, or other persons with parental responsibility for, that child indicated in writing that information relating to that child could not be disclosed for the purposes of research; or

(iii) an individual who has not attained the age of 16 years, where at the time that treatment services or non-medical fertility services were being provided to the persons who became the parents of that child, those persons indicated in writing that information relating to any child born as a result of those treatment services could not be disclosed for the purposes of research.

(4) For the purposes of paragraph(2)(b), information is excluded where it–

(a) is in respect of a relevant individual who has attained the age of 16 years unless the relevant individual has consented to the disclosure of the information by the Authority for research purposes in accordance with regulations made under section 33D of the Act (disclosure for the purposes of medical or other research);

(b) is in respect of a relevant individual who has given written notice to the Authority that they do not consent to the disclosure for research purposes by the Authority of information about them provided at the time of giving that notice the relevant individual was competent to give it;

(c) is in respect of a relevant individual where a person having parental responsibility for the relevant individual has given written notice to the Authority that they do not consent to the disclosure for research purposes by the Authority of information about the relevant individual;

(d) is in respect of a relevant individual where, at the time treatment services or non-medical fertility services were being provided to the persons who became the parents of the relevant individual, those persons indicated in writing that information relating to any child born as a result of those treatment services could not be disclosed by the Authority for research purposes in accordance with regulations made under section 33D of the Act (disclosure for the purposes of medical or other research);

(e) identifies or relates to an individual who has donated (whether alone or with an individual) an embryo other than for research purposes only; or

(f) identifies or relates to an individual who has donated gametes other than for research purposes only.

(5) Any notice given under these Regulations shall be–

(a) in writing; or

(b) transmitted by electronic means in a legible form which is capable of being used for subsequent reference.

Authorisation for disclosure of information

3. The Authority may grant an authorisation to a research establishment for the processing of disclosable protected information in accordance with these Regulations.

Applications

4.–(1) An application for authorisation must be made to the Authority.

(2) An application may be submitted by an appropriate person nominated by the research establishment.

(3) An application must–

(a) be in writing; and

(b) include the information referred to in paragraph (4).

(4) The information referred to in paragraph (3) is–

(a) the name, qualifications, address, telephone number and email address of the applicant;

(b) the name of the research establishment which is to carry out research processing the disclosable protected information;

(c) a description of the medical or other research to be undertaken by the research establishment within the United Kingdom ("the research project");

(d) what disclosable protected information the applicant wants the Authority to disclose to the applicant for the purposes of the research project;

(e) the address of the premises at which the research project is to be undertaken;

(f) either–

(i) the favourable opinion of a research ethics committee for the research project; or

(ii) where at the time of the application, an application to a research ethics committee for the research project is outstanding, an undertaking to provide the Authority with information regarding the outcome of that application within the period of 14 days beginning with the date of notification by the committee;

(g) the reasons why the processing of the disclosable protected information is necessary for the purposes of the research project;

(h) a description of the security arrangements in place at the premises in respect of which the application is made relating to the processing of disclosable protected information; and

(i) the reasons why the disclosable protected information cannot be obtained otherwise than pursuant to these Regulations.

(5) Where–

(a) an authorisation has expired; and

(b) a further application is submitted within the period of 90 days beginning with the date of expiry of the previous authorisation in relation to the same research project,

the application need not include any of the information mentioned in sub-paragraphs (b) to (h) of paragraph (4), if that information remains the same as that supplied in relation to the previous application.

(6) Where paragraph (5) applies, the applicant shall state what information has remained the same as that supplied by the applicant in relation to the previous application.

(7) The Authority may request further information, where–

(a) the Authority is of the opinion that the information given by the applicant in accordance with paragraph (4) or (6) is incomplete in any material respect; or

(b) the Authority considers that supplementary information is required in order for it to determine the application.

(8) The applicant shall provide the information requested within the period of 56 days beginning with the date of the request.

(9) The Authority need not further consider or determine the application until the applicant has provided it with such further information as requested by it under paragraph (7) and may at the end of the period specified in paragraph (8), refuse to grant the authorisation on the ground that the requested information has not been provided.

Advice and assistance from NIGB

5. Where requested by the Authority, the NIGB may provide advice and assistance to the Authority in relation to the exercise by the Authority of its functions under these Regulations or such other matters as may arise in relation to the processing of information under these Regulations (as specified in the request).

Authorisation where approval has been given under section 251 of the NHS Act

6. Where–

(a) an approval has been given under regulations made under section 251 of the NHS Act (control of patient information) in respect of the research project included in the application;

(b) the research project is to take place in England or Wales; and

(c) the Authority, having considered the application, is of the opinion that that there are no exceptional reasons why the disclosable protected information should not be processed under these Regulations for the purpose of the research project,

the Authority shall grant an authorisation.

Grounds for refusal of grant

7.–(1) Subject to paragraph (2), the Authority must not grant an authorisation where it is satisfied that–

(a) a research ethics committee has not given a favourable opinion in relation to the research project;

(b) the processing of the disclosable protected information is not necessary for the purposes of the research project;

(c) the security arrangements in place at the premises at which the disclosable protected information is to be processed are inadequate for the security of the disclosable protected information; or

(d) the information to which the application relates is information from which an individual may be identified and it would be reasonably practicable for the purposes of the research project to be achieved otherwise than pursuant to the grant of an authorisation, having regard to the cost of and technology available for achieving that purpose.

(2) Where regulation 4(4)(f)(ii) applies (outstanding request for an opinion of a research ethics committee in relation to the research project), the Authority shall not refuse an application until it has been notified by the applicant of the outcome of the application to the research ethics committee.

(3) In addition to the circumstances set out in regulation 4(9), the Authority may refuse to grant an authorisation where–

(a) it reasonably estimates that the fee payable under regulation 13 would, if calculated without regard to paragraph (4) of that regulation, be likely to be in excess of £5000; or

(b) it is satisfied that the disclosure or processing of the information for the purposes of the research project is not necessary or expedient in the public interest or in the interests of improving patient care.

Authorisation subject to conditions

8.–(1) Where the Authority grants an authorisation, it must impose the conditions that–

(a) the disclosable protected information must be used only in accordance with the purposes set out in the authorisation;

(b) the disclosable protected information must not be disclosed to a third party, unless that party is specified in the authorisation;

(c) the research establishment must not contact or request any other person to contact on the research establishment´s behalf any individual who is identified by the disclosable protected information except in the manner and circumstances specified in the authorisation;

(d) an annual report must be submitted by the research establishment in accordance with regulation 19(1);

(e) the research establishment must comply with the Authority´s request for the provision of information under regulation 19(4); and

(f) the research establishment must consent to any reasonable request for an inspection of premises under regulation 20(b).

(2) Where the Authority is of the opinion that additional conditions are required in respect of the grant of the authorisation, it may impose such additional conditions as it considers appropriate.

Variation of additional conditions

9.–(1) A research establishment in respect of which an additional condition is imposed by virtue of paragraph (2) of regulation 8 may apply to the Authority for it to vary that condition.

(2) An application under paragraph (1) shall include–

(a) the applicant´s reasons for asking the Authority to vary the condition concerned; and

(b) the information contained in paragraph (4) of regulation 4 unless it remains the same as that supplied in the application made under regulation 4.

(3) "Vary" in this regulation and regulations 11 and 12 includes revoke, substitute or add.

Duration of authorisation

10.–(1) Where the Authority grants an authorisation, it shall specify the period for which the authorisation is valid.

(2) Except where regulation 4(5) applies, the period for which the authorisation is valid shall not exceed a period of five years beginning with the date on which the applicant is notified under regulation 11 or where regulation 12 applies under that regulation.

(3) Where regulation 4(5) applies, the period for which the authorisation is valid shall not exceed a period of five years beginning with the date of expiry of the previous authorisation in relation to the same research project.

Notice of decision

11.–(1) Where the Authority grants an authorisation or an application to vary additional conditions under regulation 9, it shall give notice to the applicant informing the applicant–

(a) that the authorisation or application has been granted;

(b) of the conditions which apply to the authorisation;

(c) in the case of an application under regulation 4, where the decision is to grant an authorisation subject to additional conditions–

(i) of its reasons for imposing those conditions; and

(ii) of the applicant´s right to ask for a review of the decision under regulation 12; and

(d) of the period for which the authorisation is given.

(2) Where the Authority refuses to grant an authorisation or an application to vary a condition under regulation 9, it shall give notice to the applicant informing the applicant–

(a) that the authorisation or application has been refused;

(b) of the reasons for its decision; and

(c) of the applicant´s right to ask for a review of the decision under regulation 12.

Review of refusals

12.–(1) The Authority may, and if requested in writing to do so by the applicant must, review its decision to–

(a) refuse to grant an authorisation;

(b) grant an authorisation subject to additional conditions; or

(c) refuse an application to vary additional conditions under regulation 9.

(2) After a review has taken place there shall be no further review.

(3) Where the Authority reviews its refusal to grant an authorisation, it may decide to–

(a) grant the authorisation;

(b) grant the authorisation and impose additional conditions; or

(c) confirm its original decision.

(4) Where the Authority reviews its decision to grant an authorisation subject to additional conditions, it may decide to–

(a) vary the additional conditions; or

(b) confirm its original decision.

(5) Where the Authority reviews its decision to refuse an application to vary conditions under regulation 9, it may decide to–

(a) vary the additional conditions; or

(b) confirm its original decision.

(6) Where the Authority reviews its decision under this regulation, it shall give notice to the applicant informing the applicant–

(a) of its decision; and

(b) of the reasons for its decision.

Fee in relation to the disclosure of information

13.–(1) The Authority shall charge the applicant under these Regulations a fee in respect of the disclosure to the applicant of disclosable protected information.

(2) The fee shall be in respect of the time taken by the Authority to–

(a) locate the information;

(b) assemble the information; and

(c) prepare the information for disclosure.

(3) Subject to paragraph (4), the fee shall be–

(a) £250, if the time taken by the Authority is not more than half a day;

(b) £500, if the time taken by the Authority is more than half a day but not more than one day; or

(c) where the time taken by the Authority is more than one day–

(i) £500; and

(ii) £250 for every additional half a day or less.

(4) Where the fee calculated in accordance with paragraph (3)(c) is greater than £5000, the fee shall be £5000.

(5) In paragraph (3), a reference to "one day" is to a period of 7 hours and 30 minutes; and "half a day" shall be construed accordingly.

(6) In calculating the time taken by the Authority, the time of any individual involved in the disclosure shall be recorded separately and then the time of all the individuals involved shall be added together to reach the total number of hours taken by the Authority.

(7) The time taken by the Authority may include the time of a person providing services to the Authority (or an individual employed by such a person).

(8) The applicant must pay the fee to the Authority specified in the Authority´s notice to the applicant requiring payment.

(9) The Authority may refuse to disclose the disclosable protected information until it has received the fee.

Provision of information by the Authority

14.–(1) Subject to regulation 13, where the Authority grants an authorisation, it shall disclose the disclosable protected information requested by the applicant to the research establishment within a period of 90 days beginning with the date on which payment of the fee under regulation 13 is received.

(2) Where disclosable protected information is disclosed in accordance with these Regulations, anything done by the Authority in so disclosing or processing that information shall be taken to be lawfully done despite any obligation of confidence owed by the Authority in respect of it.

Processing by the research establishment

15.–(1) Where the Authority grants an authorisation, the research establishment may process the disclosable protected information disclosed to it under these Regulations provided that the research establishment complies with–

(a) the general conditions under regulation 8(1);

(b) any additional conditions imposed by the Authority; and

(c) the Data Protection Act.

(2) Where disclosable protected information is processed in accordance with these Regulations, anything done by the research establishment in so processing that information shall be taken to be lawfully done despite any obligation of confidence owed by the research establishment in respect of it.

Suspension of authorisation

16.–(1) The Authority may suspend an authorisation if–

(a) the research establishment has failed to comply with the conditions imposed on it by the Authority or the Data Protection Act; or

(b) the information given pursuant to regulation 4(4) or (6) or 9(2) was inaccurate or misleading.

(2) Subject to paragraph (3), before suspending an authorisation of a research establishment, the Authority shall serve a notice on the research establishment–

(a) stating the Authority´s intention to suspend its authorisation on the date specified in the notice;

(b) stating on what grounds it proposes to suspend the authorisation; and

(c) giving the research establishment the opportunity to make written representations by a specified day, provided that at least 24 hours notice of that day is given.

(3) Where the Authority considers that it is necessary to do so in the public interest, it shall suspend an authorisation without prior notice under paragraph (2).

(4) Where the Authority decides to suspend an authorisation under paragraph (1) or (3), it shall give notice to the research establishment informing the research establishment–

(a) that the authorisation has been suspended and the period of suspension; and

(b) of the reasons for its decision.

(5) Any suspension pursuant to paragraph (1) or (3) shall be for such period but not exceeding 6 months as the Authority shall consider necessary having regard to the reasons for the suspension.

(6) The Authority may review a suspension at any time and shall review a suspension after a period of three months beginning with the date of the decision to suspend the authorisation if so requested by the relevant research establishment.

(7) Where the Authority reviews a suspension, it may–

(a) revoke the suspension, in which case the suspension shall cease to have effect; or

(b) suspend the authorisation for a further period not exceeding 6 months beginning with the date of the expiry of the current period of suspension.

(8) Where the Authority reviews a suspension it shall give notice to the research establishment informing the research establishment–

(a) of its decision including where applicable the period of suspension; and

(b) of the reasons for its decision.

(9) Where the Authority suspends an authorisation, any processing of the disclosable protected information by the research establishment shall not be in accordance with these Regulations (and accordingly the provision in paragraph (2) of regulation 15 shall not apply).

Revocation of authorisation

17.–(1) The Authority may revoke an authorisation where–

(a) the research establishment has failed to comply with the conditions imposed on it by the Authority or the Data Protection Act; or

(b) the information given pursuant to regulation 4(4) or (6) or 9(2) was inaccurate or misleading.

(2) Subject to paragraph (3), before revoking an authorisation the Authority shall serve notice on the research establishment–

(a) stating the Authority´s intention to revoke the authorisation;

(b) stating on what grounds it proposes to revoke the authorisation; and

(c) giving the research establishment the opportunity to make written representations by a specified day, provided that at least 28 days notice of that day is given.

(3) Where the Authority considers that it is necessary to do so in the public interest, it shall revoke an authorisation without prior notice under paragraph (2).

(4) Where the Authority decides to revoke an authorisation, it shall give notice to the research establishment informing the research establishment–

(a) that the authorisation has been revoked and from what date; and

(b) of the reasons for its decision.

(5) Where the Authority decides not to revoke the authorisation, it shall give notice to the research establishment informing the research establishment that the authorisation remains valid.

(6) Where the Authority revokes an authorisation any processing of the disclosable protected information by the research establishment shall not be in accordance with these Regulations (and accordingly the provision in paragraph (2) of regulation 15 shall not apply).

Destruction of information

18. The research establishment shall make appropriate arrangements for the destruction or disposal of the disclosable protected information where–

(a) the authorisation has expired;

(b) the purposes for which it was needed have been satisfied; or

(c) the authorisation has been revoked.

Annual reports and provision of information

19.–(1) A research establishment which is granted an authorisation shall submit an annual report to the Authority for each relevant year, which shall include–

(a) a declaration that the research establishment has in place appropriate systems to ensure compliance with these Regulations or reasons why it cannot give such a declaration;

(b) details of the system it has in place to ensure compliance; and

(c) an account of how it has used the information provided under these Regulations.

(2) The report shall be published as soon as possible after the end of each relevant year.

(3) For the purposes of this regulation, "relevant year" means–

(a) the period beginning with the date on which notice of the decision is given under regulation 11 or where applicable regulation 12 and ending 12 months thereafter; and

(b) for the duration of the authorisation, each successive period of 12 months ending with the anniversary of the date on which the decision is notified notwithstanding the expiry of the authorisation before that date in that relevant year.

(4) Where a research establishment processes disclosable protected information under these Regulations, it shall make available to the Authority within the period specified by the Authority such information as the Authority may reasonably require to assist the Authority in any investigation and audit of that processing within the period specified by the Authority.

Inspections

20. The Authority may with the consent of the research establishment, conduct an inspection of the premises of the research establishment at which the research project is being undertaken for the purposes of–

(a) considering whether or not to grant an application; or

(b) ensuring that a research establishment complies with these Regulations or an authorisation granted to it under these Regulations.

Oversight Committee

21. The Authority shall establish a Committee to–

(a) monitor the grant of authorisations under these Regulations;

(b) monitor the processing of disclosable protected information by research establishments under an authorisation;

(c) consider annual reports submitted by research establishments under regulation 19; and

(d) consider such other matters relating to these Regulations as the Authority or the Committee may determine.

Guidance

22. The Authority may issue information for the purpose of giving practical guidance to research establishments in relation to–

(a) making an application under these Regulations; and

(b) processing the disclosable protected information under an authorisation.

EXPLANATORY NOTE

(This note is not part of the Regulations)

These Regulations are made under section 33D of the Human Fertilisation and Embryology Act 1990 ("the Act")(9) and govern the procedure for applications for authorisations for the disclosure and use of disclosable protected information for medical or other research purposes.

Disclosable protected information is defined in regulation 2(2) for the purposes of the Regulations. Subject to exceptions set out in the Regulations, it is information kept by the Human Fertilisation and Embryology Authority ("the Authority") on its register, which relates to or identifies individuals during the period on or after the 1st August 1991 and on or before the 30th September 2009; or information entered by the Authority on its register after the 1st October 2009 in relation to a relevant individual. Relevant individual is defined in the Act as meaning a person who was or may have been born as a result of either treatment services (other than basic partner treatment services) or the procurement or distribution of sperm (other than partner donated sperm) in the course of providing non-medical fertility services.

Regulation 3 provides that the Authority is to be the authorising body under the Regulations, to which applications are made by research establishments under regulation 4.

Regulation 4 sets out the procedures to be followed in respect of an application for an authorisation.

Regulation 5 allows the National Information Governance Board for Health and Social Care to provide advice and assistance to the Authority in relation to the Authority´s functions under these Regulations.

Regulation 6 provides for an authorisation to be granted where there is an approval for disclosure of information given under Regulations made under section 251 of the National Health Service Act 2006(10) in England and Wales in respect of the research project provided that the Authority is satisfied that there are no exceptional reasons why the information should not be used for the purpose of the research project.

Regulation 7 sets out the grounds on which the Authority must refuse to grant an authorisation.

Regulation 8(1) sets out the mandatory conditions which apply where the authorisation is granted; and regulation 8(2) allows the Authority to impose additional conditions, which may be varied on application by the research establishment under regulation 9.

Regulation 10 provides for the duration of an authorisation granted under regulation 3, which cannot exceed 5 years in the case of an initial authorisation and 5 years in the case of an extension.

Regulation 11 requires the Authority to give notice and reasons for its decision to grant or refuse an authorisation or an application to vary conditions under regulation 9.

Regulation 12 provides that the Authority may review its decision and must review its decision if requested in writing to do so by the research establishment.

Regulation 13 sets out the basis for calculating the fee to be paid to the Authority in respect of the disclosure of information to the research establishment.

Regulation 14 provides that the Authority must disclose the disclosable protected information to the research establishment within 90 days beginning with the date on which payment of the fee is received by the Authority. It also provides that the Authority will not be in any breach of any duty of confidence in doing so.

Regulation 15 sets out further legal requirements with which the research establishment must comply in order to use the disclosable protected information disclosed under the Regulations. It also provides that the research establishment will not be in breach of any duty of confidence in using the disclosable protected information disclosed to it for the purposes of its research project.

Regulations 16 and 17 set out the circumstances in which the Authority may suspend or revoke an authorisation granted under regulation 3.

Regulation 18 sets out the circumstances in which the disclosable protected information must be destroyed.

Regulation 19 imposes an obligation on the research establishment to submit an annual report and provide information including information about the security systems in place to safeguard the disclosable protected information to the Authority.

Regulation 20 allows the Authority to conduct inspections of premises with the consent of the research establishment.

Regulation 21 specifies that the Authority is to set up a committee, in particular, to monitor the operation of the Regulations and the use of the information disclosed to the research establishments.

Under regulation 22, the Authority can issue guidance on making an application and using the disclosable protected information authorised by the Regulations.