These Regulations are made under section 33D of the Human Fertilisation and Embryology Act 1990 (“the Act”)(1) and govern the procedure for applications for authorisations for the disclosure and use of disclosable protected information for medical or other research purposes.

Disclosable protected information is defined in regulation 2(2) for the purposes of the Regulations. Subject to exceptions set out in the Regulations, it is information kept by the Human Fertilisation and Embryology Authority (“the Authority”) on its register, which relates to or identifies individuals during the period on or after the 1st August 1991 and on or before the 30th September 2009; or information entered by the Authority on its register after the 1st October 2009 in relation to a relevant individual. Relevant individual is defined in the Act as meaning a person who was or may have been born as a result of either treatment services (other than basic partner treatment services) or the procurement or distribution of sperm (other than partner donated sperm) in the course of providing non-medical fertility services.

Regulation 3 provides that the Authority is to be the authorising body under the Regulations, to which applications are made by research establishments under regulation 4.

Regulation 4 sets out the procedures to be followed in respect of an application for an authorisation.

Regulation 5 allows the National Information Governance Board for Health and Social Care to provide advice and assistance to the Authority in relation to the Authority’s functions under these Regulations.

Regulation 6 provides for an authorisation to be granted where there is an approval for disclosure of information given under Regulations made under section 251 of the National Health Service Act 2006(2) in England and Wales in respect of the research project provided that the Authority is satisfied that there are no exceptional reasons why the information should not be used for the purpose of the research project.

Regulation 7 sets out the grounds on which the Authority must refuse to grant an authorisation.

Regulation 8(1) sets out the mandatory conditions which apply where the authorisation is granted; and regulation 8(2) allows the Authority to impose additional conditions, which may be varied on application by the research establishment under regulation 9.

Regulation 10 provides for the duration of an authorisation granted under regulation 3, which cannot exceed 5 years in the case of an initial authorisation and 5 years in the case of an extension.

Regulation 11 requires the Authority to give notice and reasons for its decision to grant or refuse an authorisation or an application to vary conditions under regulation 9.

Regulation 12 provides that the Authority may review its decision and must review its decision if requested in writing to do so by the research establishment.

Regulation 13 sets out the basis for calculating the fee to be paid to the Authority in respect of the disclosure of information to the research establishment.

Regulation 14 provides that the Authority must disclose the disclosable protected information to the research establishment within 90 days beginning with the date on which payment of the fee is received by the Authority. It also provides that the Authority will not be in any breach of any duty of confidence in doing so.

Regulation 15 sets out further legal requirements with which the research establishment must comply in order to use the disclosable protected information disclosed under the Regulations. It also provides that the research establishment will not be in breach of any duty of confidence in using the disclosable protected information disclosed to it for the purposes of its research project.

Regulations 16 and 17 set out the circumstances in which the Authority may suspend or revoke an authorisation granted under regulation 3.

Regulation 18 sets out the circumstances in which the disclosable protected information must be destroyed.

Regulation 19 imposes an obligation on the research establishment to submit an annual report and provide information including information about the security systems in place to safeguard the disclosable protected information to the Authority.

Regulation 20 allows the Authority to conduct inspections of premises with the consent of the research establishment.

Regulation 21 specifies that the Authority is to set up a committee, in particular, to monitor the operation of the Regulations and the use of the information disclosed to the research establishments.

Under regulation 22, the Authority can issue guidance on making an application and using the disclosable protected information authorised by the Regulations.