{"id":38,"date":"2026-02-19T15:11:45","date_gmt":"2026-02-19T15:11:45","guid":{"rendered":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/?p=38"},"modified":"2026-09-14T12:50:35","modified_gmt":"2026-09-14T11:50:35","slug":"what-is-a-section-251-approval","status":"publish","type":"post","link":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/what-is-a-section-251-approval\/","title":{"rendered":"What is a section 251 exemption?"},"content":{"rendered":"<p style=\"font-weight: 400\">Oh, wait, I\u2019m confusing interests again. The Section 251 discussed herein has nothing to do with Star Wars<sup>TM<\/sup>, nor is it to be confused with a similarly imaginatively named US Air Force base in the Nevada desert known for its alleged extraterrestrial activities. More\u2019s the shame\u2026<\/p>\n<h2 style=\"font-weight: 400\"><strong>Section 251; and the patient information consenting paradox<\/strong><\/h2>\n<p style=\"font-weight: 400\">James Ellaway \u2013 Data Lead, Cardiff Experimental Cancer Medicine Centre (ECMC)<\/p>\n<p style=\"font-weight: 400\">Section 251 as we are concerned relates to the very much Earth-bound <a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information\">Section 251 of the NHS Act 2006<\/a><sup>1<\/sup>. A shorthand for a specific section of this act which allows a temporary lifting of the common law duty of confidentiality to enable the disclosure of confidential patient information for medical purposes.<\/p>\n<h2 style=\"font-weight: 400\"><strong>So, what does that mean in practice?<\/strong><\/h2>\n<p style=\"font-weight: 400\">First, let\u2019s talk about confidentiality. As regards patient information specifically, confidentiality \u2013 rather <em>confidential patient information<\/em> \u2013 is a term legally defined in Section 251 as patient information where:<\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026the identity of the individual in question is ascertainable\u2014<\/em><\/p>\n<ul>\n<li><em>from that information, or<\/em><\/li>\n<li><em>from that information and other information which is in the possession of, or is likely to come into the possession of, the person processing that information, and<\/em><\/li>\n<\/ul>\n<p style=\"font-weight: 400\"><em>(b) that information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual.\u201d<sup>2<\/sup><\/em><\/p>\n<p style=\"font-weight: 400\">Importantly, this <strong>applies to both living persons<\/strong>, that is \u2018natural persons,\u2019 <strong>and the deceased. <\/strong>More on that in my riveting read on DPIAs, here (insert link).<\/p>\n<p style=\"font-weight: 400\">Keeping up? Confidential patient information is any information which may lead to the <strong>identification<\/strong> of a patient. These could include NHS numbers, patient name, home address, a date of birth, a patient&#8217;s diagnosis \u2013 particularly if a rare disease type or may denote information as to a patient\u2019s physical or mental condition, and\/or their specific care and\/or treatment.<\/p>\n<p style=\"font-weight: 400\">This information is usually given where an expected duty of confidence applies. Think patient-doctor confidentiality as our rule of thumb. This information, under the <a href=\"https:\/\/www.ukcgc.uk\/duty-of-confidentiality\">common law duty of confidentiality<\/a><sup>3<\/sup> cannot be disclosed without a patient\u2019s consent. That is, unless a Section 251 support is invoked.<\/p>\n<h2 style=\"font-weight: 400\"><strong>Why?<\/strong><\/h2>\n<p style=\"font-weight: 400\">Well, it has been determined that there are several vital activities within the NHS, including certain medical research, whereby access to his kind of confidential information is necessary. Moreover, that de-identified (anonymised) versions of said information might make certain activities impossible \u2013 <em>the identifiable information is required<\/em>, or whereby individual patient consent for this information is determined unobtainable.<\/p>\n<h2 style=\"font-weight: 400\"><strong>What constitutes \u2018Medical Purposes?\u2019 <\/strong><\/h2>\n<p style=\"font-weight: 400\"><strong>\u00a0<\/strong><\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026 \u201cmedical purposes\u201d means the purposes of any of\u2014<\/em><\/p>\n<p style=\"font-weight: 400\"><em>(a) preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and social care services, and<\/em><\/p>\n<p style=\"font-weight: 400\"><em>(b) informing individuals about their physical or mental health or condition, the diagnosis of their condition or their care and treatment.\u201d<sup>4<\/sup><\/em><\/p>\n<h2 style=\"font-weight: 400\"><strong>Who determines what is eligible for Section 251 support?<\/strong><\/h2>\n<p style=\"font-weight: 400\"><strong><em>\u00a0<\/em><\/strong><\/p>\n<p style=\"font-weight: 400\">That would be the independent body of the Confidentiality Advisory Group (CAG)<sup>5<\/sup>. This group reviews non-research and research-based, and data dissemination requests for Section 251 support on a case-by-case basis, against the framework outlined in the <a href=\"https:\/\/www.legislation.gov.uk\/uksi\/2002\/1438\/contents\">Health Service (Control of Patient Information) Regulations 2002<\/a><sup>6<\/sup>.<\/p>\n<p style=\"font-weight: 400\">Once the CAG has determined whether the temporary disclosure of requested confidential information is in the public interest, it is up to one of three bodies to ultimately decide whether Section 251 support will be granted. These bodies are:<\/p>\n<ul>\n<li>The Health Research Authority<sup>7<\/sup> (for, you guessed it, research activities).<\/li>\n<li>The Secretary of State for Health and Social Care<sup>8<\/sup> (for non-research purposes).<\/li>\n<li>And NHS England<sup>9<\/sup> (for data dissemination\/sharing purposes only). *<\/li>\n<\/ul>\n<p style=\"font-weight: 400\">*In Wales, these duties are transferred to Welsh Ministers under The Welsh Ministers (Transfer of Functions) Order 2018<sup>10<\/sup>.<\/p>\n<p style=\"font-weight: 400\">If you have some time to kill, and quite literally nothing else at all to do, you can view all past and present CAG approvals for regulations 2 and 5 (more on that to follow) using the <a href=\"https:\/\/www.hra.nhs.uk\/planning-and-improving-research\/application-summaries\/confidentiality-advisory-group-registers\/\">CAG Registers<\/a><sup>11<\/sup>.<\/p>\n<h2 style=\"font-weight: 400\"><strong>What might that look like in real terms?<\/strong><\/h2>\n<p style=\"font-weight: 400\"><strong><em>\u00a0<\/em><\/strong><\/p>\n<p style=\"font-weight: 400\">If Section 251 support is granted, the designated person (i.e. You, the researcher, clinician, etc\u2026) \u2013 the <strong>person responsible<\/strong> for the information can disclose confidential patient information without their consent without being in breach of the common law duty of confidentiality \u2013 providing strict adherence to the requirements of the given regulation, and compliance with the Data Protection Act 2018, and the Human Rights Act 1998<sup>12<\/sup>.<\/p>\n<h2 style=\"font-weight: 400\"><strong>Right\u2026 and that means?<\/strong><\/h2>\n<p style=\"font-weight: 400\"><strong>\u00a0<\/strong><\/p>\n<p style=\"font-weight: 400\">For example, Regulation 2:<\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026permits confidential patient information relating to patients referred for the diagnosis or treatment of cancer to be processed for the medical purposes set out in the regulation.\u201d<sup>13<\/sup><\/em><\/p>\n<p style=\"font-weight: 400\">Regulation 3:<\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026provides specific support for identifiable patient information to be processed to diagnose, control or prevent, or recognise trends in, communicable diseases and other risks to public health. Regulation 3 applications are managed by Public Health England.\u201d<\/em><sup>14 <\/sup>*<\/p>\n<p style=\"font-weight: 400\">*Public Health Wales<sup>15<\/sup> in\u2026 Wales.<\/p>\n<p style=\"font-weight: 400\">Or Regulation 5:<\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026used to permit processing for a range of medical purposes, broadly defined to include \u2018preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of health and adult social care services.\u201d<\/em><sup>16<\/sup><\/p>\n<p style=\"font-weight: 400\">However, there is a caveat, at least in England with the introduction of the National Data Opt-Out (NDOO)<sup>17<\/sup>. This doesn\u2019t apply for statistical, de-identified data, but when Section 251 support is relied upon to access confidential patient information, where the patient has opted-out of consenting for their confidential patient information to be shared for research and non-research medical purposes, access shall not be granted dictated by the patient\u2019s choice to opt-out. This does not, however, stop patients from providing consent to individual\/specific research studies of their choosing on a case-by-case basis. *<\/p>\n<p style=\"font-weight: 400\"><strong>*There is currently no national data opt-out service in Wales, and so the NDOO has no impact on patients in Wales.<\/strong><\/p>\n<h2 style=\"font-weight: 400\"><strong>Well, then why consent?<\/strong><\/h2>\n<p style=\"font-weight: 400\">Firstly, <u>consent isn\u2019t needed for de-identified data<\/u> \u2013 the clue is in the name. Consent isn\u2019t <em>actually<\/em> needed for confidential patient information data provided the collection and processing of the data is \u2018in the public interest\u2019 \u2013 as this forms the legal basis for the collection and processing of said data.<\/p>\n<p style=\"font-weight: 400\">Indeed, as far as UK GDPR (as part of the Data Protection Act 2018<sup>18<\/sup>) is concerned:<\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026consent would not be appropriate as a legal basis under this legislation where there is an imbalance of power in the relationship between the controller and the data subject, e.g. where the controller is a public authority and the data subject depends on their services\u2026\u201d<sup>19<\/sup> *<\/em><\/p>\n<p style=\"font-weight: 400\"><em>\u00a0<\/em><\/p>\n<p style=\"font-weight: 400\"><strong>*Psst! We\u2019re talking about the NHS here, and patients in the care of the NHS, if that wasn\u2019t obvious!<\/strong><\/p>\n<p style=\"font-weight: 400\"><strong>\u00a0<\/strong><\/p>\n<p style=\"font-weight: 400\"><strong><em>In fact:<\/em><\/strong><\/p>\n<p style=\"font-weight: 400\"><strong><em>\u00a0<\/em><\/strong><\/p>\n<p style=\"font-weight: 400\"><em>\u201c\u2026the legal basis for processing data for health and social care research should NOT be consent. This means that requirements in the GDPR relating to consent do NOT apply to health and care research.\u201d<sup>20<\/sup><\/em><\/p>\n<p style=\"font-weight: 400\"><em>\u00a0<\/em><\/p>\n<p style=\"font-weight: 400\"><strong>BUT!<\/strong> Whilst consent does not constitute the legal basis for processing personal (confidential) data for research, researchers must always adhere to the common law duty of confidentiality \u2013 taking measures to minimise the personal information required, and the necessary precautions to protect the data (again, see my blog on DPIAs).<\/p>\n<p style=\"font-weight: 400\"><strong>\u00a0<\/strong><\/p>\n<p style=\"font-weight: 400\">Consent is, however, <strong>still required<\/strong> for people <strong><em>external<\/em><\/strong> to the primary care team (let\u2019s say those running the clinical trial, including, the researcher, clinicians, research nurses, etc.), <strong>e.g., third-party data processors<\/strong> to access and use confidential patient information for research. Unless, of course, you\u2019ve been approved for Section 251 support by the CAG, as mentioned earlier.<\/p>\n<h2 style=\"font-weight: 400\"><strong>Summary<\/strong><\/h2>\n<p style=\"font-weight: 400\">Phew! That\u2019s a lot to take into consideration. I\u2019m sure you\u2019ll agree. To summarise:<\/p>\n<ol>\n<li>Consent is not required for the processing of confidential patient information provided its use is in the public interest \u2013 thus forming its legal basis.<\/li>\n<li>The legal definition of confidential patient information as defined in Section 251 of the NHS Act 2006 applies to both living persons and the deceased and is information which can lead to the direct identification of said persons.<\/li>\n<li>This information is given under confidence and governed by the common law duty of confidentiality. It cannot be disclosed, unless a Section 251 support is granted by the Confidentiality Advisory Group for medical purposes vital to NHS activities contingent upon this confidential information.<\/li>\n<li>A section 251 support may be given based upon set regulatory requirements which determine specific uses of the disclosure of this confidential information.<\/li>\n<li>A section 251 support may face hinderance by the NDOO in England, whereby patients can opt-out of sharing their confidential information. However, patients in England are free to opt-in to specific research and trials whereby confidential information may be given on a case-by-case basis. This is not applicable in Wales.<\/li>\n<\/ol>\n<h4 style=\"font-weight: 400\"><strong>References<\/strong><\/h4>\n<ol>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information\">https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information#:~:text=(10),information%E2%80%9D%20means%E2%80%94\">https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information#:~:text=(10),information%E2%80%9D%20means%E2%80%94<\/a><\/li>\n<li><a href=\"https:\/\/www.ukcgc.uk\/duty-of-confidentiality\">https:\/\/www.ukcgc.uk\/duty-of-confidentiality<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information#:~:text=In%20this%20section%20%E2%80%9Cmedical%20purposes%E2%80%9D%20means%20the%20purposes%20of%20any%20of%E2%80%94\">https:\/\/www.legislation.gov.uk\/ukpga\/2006\/41\/part\/13\/crossheading\/patient-information#:~:text=In%20this%20section%20%E2%80%9Cmedical%20purposes%E2%80%9D%20means%20the%20purposes%20of%20any%20of%E2%80%94<\/a><\/li>\n<li><a href=\"https:\/\/www.hra.nhs.uk\/about-us\/committees-and-services\/confidentiality-advisory-group\/\">Confidentiality Advisory Group &#8211; Health Research Authority<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/uksi\/2002\/1438\/contents\">The Health Service (Control of Patient Information) Regulations 2002<\/a><\/li>\n<li><a href=\"https:\/\/www.hra.nhs.uk\/\">Health Research Authority<\/a><\/li>\n<li><a href=\"https:\/\/www.gov.uk\/government\/ministers\/secretary-of-state-for-health-and-social-care\">Secretary of State for Health and Social Care &#8211; GOV.UK<\/a><\/li>\n<li><a href=\"https:\/\/www.england.nhs.uk\/\">NHS England<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/uksi\/2018\/644\/article\/43\">The Welsh Ministers (Transfer of Functions) Order 2018<\/a><\/li>\n<li><a href=\"https:\/\/www.hra.nhs.uk\/planning-and-improving-research\/application-summaries\/confidentiality-advisory-group-registers\/\">CAG registers &#8211; Health Research Authority<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/1998\/42\/contents\">Human Rights Act 1998<\/a><\/li>\n<li><a href=\"https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=Rights%20Act%201998-,Regulation%202,-permits%20confidential%20patient\">https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=Rights%20Act%201998-,Regulation%202,-permits%20confidential%20patient<\/a><\/li>\n<li><a href=\"https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=in%20the%20regulation.-,Regulation%203,-provides%20specific%20support\">https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=in%20the%20regulation.-,Regulation%203,-provides%20specific%20support<\/a><\/li>\n<li><a href=\"https:\/\/phw.nhs.wales\/use-of-site\/privacy-notice\/\">Privacy Notice &#8211; Public Health Wales<\/a><\/li>\n<li><a href=\"https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=Public%20Health%20England.-,Regulation%205,-can%20be%20used\">https:\/\/digital.nhs.uk\/services\/data-access-request-service-dars\/how-the-national-data-opt-out-affects-data-released-by-nhs-digital\/national-data-opt-out-guidance-for-researchers\/appendix-1-section-251-of-the-national-health-service-act-2006#:~:text=Public%20Health%20England.-,Regulation%205,-can%20be%20used<\/a><\/li>\n<li><a href=\"https:\/\/digital.nhs.uk\/services\/national-data-opt-out\">National Data Opt-Out &#8211; NHS England Digital<\/a><\/li>\n<li><a href=\"https:\/\/www.legislation.gov.uk\/ukpga\/2018\/12\/contents\">Data Protection Act 2018<\/a><\/li>\n<li><a href=\"https:\/\/www.hra.nhs.uk\/planning-and-improving-research\/policies-standards-legislation\/data-protection-and-information-governance\/gdpr-guidance\/what-law-says\/consent-research\/\">Consent in research &#8211; Health Research Authority<\/a><\/li>\n<li><a href=\"https:\/\/www.hra.nhs.uk\/planning-and-improving-research\/policies-standards-legislation\/data-protection-and-information-governance\/gdpr-guidance\/what-law-says\/consent-research\/#:~:text=the%20legal%20basis%20for%20processing%20data%20for%20health%20and%20social%20care%20research%20should%20NOT%20be%20consent.%20This%20means%20that%20requirements%20in%20the%20GDPR%20relating%20to%20consent%20do%20NOT%20apply%20to%20health%20and%20care%20research\">https:\/\/www.hra.nhs.uk\/planning-and-improving-research\/policies-standards-legislation\/data-protection-and-information-governance\/gdpr-guidance\/what-law-says\/consent-research\/#:~:text=the%20legal%20basis%20for%20processing%20data%20for%20health%20and%20social%20care%20research%20should%20NOT%20be%20consent.%20This%20means%20that%20requirements%20in%20the%20GDPR%20relating%20to%20consent%20do%20NOT%20apply%20to%20health%20and%20care%20research<\/a>.<\/li>\n<\/ol>\n<p style=\"font-weight: 400\">\n","protected":false},"excerpt":{"rendered":"Oh, wait, I\u2019m confusing interests again. The Section 251 discussed herein has nothing to do with Star WarsTM, nor is [&hellip;]","protected":false},"author":7176,"featured_media":39,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-38","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-governance"],"meta_box":[],"_links":{"self":[{"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/posts\/38","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/users\/7176"}],"replies":[{"embeddable":true,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/comments?post=38"}],"version-history":[{"count":4,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/posts\/38\/revisions"}],"predecessor-version":[{"id":44,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/posts\/38\/revisions\/44"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/media\/39"}],"wp:attachment":[{"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/media?parent=38"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/categories?post=38"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blogs.cardiff.ac.uk\/bioresource-data-accelerator\/wp-json\/wp\/v2\/tags?post=38"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}