Regulation 222B Hub and spoke arrangements: sharing of data between different businessesF1

(1)

For the purposes of section 8(c) (lawfulness of processing: public interest etc) of, and paragraph 2(2)(a), (c) and (d) of Schedule 1 (special categories of personal data etc) to, the Data Protection Act 2018, paragraph (2) applies to the processing of any data—

(a)

by B1 or B2 (as defined in regulation 222A(1)(b)) which relates to a patient; and

(b)

which is necessary for the purposes of—

(i)

fulfilling an order submitted as mentioned in regulation 222A(1)(a) under the written arrangements between B1 and B2 of the type mentioned in regulation 222A(1)(b), or

(ii)

discharging any related professional obligations to the patient (including obligations relating to the keeping of records).

(2)

That processing is—

(a)

necessary for the performance of a task carried out in the public interest; and

(b)

if the data is personal data concerning health, necessary for the purposes of preventative medicine, medical diagnosis or for the provision of health care or treatment.

(3)

Any person (P) who—

(a)

is employed or engaged by B1 or B2; and

(b)

in the course of being so employed or engaged is required to undertake the processing of data described in paragraph (1),

owes a duty of confidentiality in respect of that data (whether or not they would do so but for this paragraph).

(4)

That duty—

(a)

is a duty of confidentiality which, if not owed by a health care professional, is owed under an enactment or rule of law for the purposes of section 11(1)(b) of the Data Protection Act 2018 (special categories of personal data etc: supplementary); and

(b)

is such that, if the processing is necessary for the purposes described in paragraph (1)(b), P is able, lawfully, to process that data by virtue of this regulation.

(5)

For the purposes of paragraph (1)(b)(ii), a professional obligation to a patient is to be regarded as such notwithstanding that discharging the obligation may—

(a)

also be an obligation that arises in some other way (for example, arising from a term of service that is part of NHS pharmaceutical services); or

(b)

be done by a person who is not a health care professional.

(6)

Paragraphs (1) and (2) do not apply where, in reliance or purported reliance on arrangements of the type mentioned in regulation 222A(1)(b), a person processes any data which relates to a patient but, in the course of the doing of anything that relates to the fulfilling of the order to which that data relates, there is a breach of—

(a)

the requirements to be fulfilled if what is done is to be treated as or as part of a retail sale in accordance with regulation 222A(2)(a); or

(b)

a duty of confidentiality owed in respect of the data by a health care professional or under an enactment or rule of law as mentioned in paragraph (4)(a).

(7)

Words and expressions used in both—

(a)

paragraphs (1) to (6); and

(b)

Parts 1 and 2 (preliminary and general processing) of, and paragraphs 2(2)(a), (c) and (d) of Schedule 1 to, the Data Protection Act 2018,

bear the meanings they bear in those provisions of the Data Protection Act 2018.

Annotations

Textual amendments

F1: Regs. 222A, 222B inserted (1.10.2025) by The Human Medicines (Amendments Relating to Hub and Spoke Dispensing etc.) Regulations 2025 (S.I. 2025/758), regs. 1(2), 9

Notes on Part 12

Modifications

C1: Pt. 12 modified (E.W.) (1.10.2015) by The Nicotine Inhaling Products (Age of Sale and Proxy Purchasing) Regulations 2015 (S.I. 2015/895), regs. 1(3), 4(2)