2.—(1) Subject to paragraphs (2) to (3) and regulation 7, confidential patient information relating to patients referred for the diagnosis or treatment of neoplasia may be processed for medical purposes approved by the Secretary of State which comprise or include—
(a)the surveillance and analysis of health and disease;
(b)the monitoring and audit of health and health related care provision and outcomes where such provision has been made;
(c)the planning and administration of the provision made for health and health related care;
(d)medical research approved by research ethics committees;
(e)the provision of information about individuals who have suffered from a particular disease or condition where—
(i)that information supports an analysis of the risk of developing that disease or condition; and
(ii)it is required for the counseling and support of a person who is concerned about the risk of developing that disease or condition.
(2) For the purposes of this regulation, “processing” includes (in addition to the use, disclosure or obtaining of information) any operations, or set of operations, which are undertaken in order to establish or maintain databases for the purposes set out in paragraph (1), including—
(a)the recording and holding of information;
(b)the retrieval, alignment and combination of information;
(c)the organisation, adaption or alteration of information;
(d)the blocking, erasure and destruction of information.
(3) The processing of confidential patient information for the purposes specified in paragraph (1) may be undertaken by bodies or persons who (either individually or as members of a class) are—
(a)approved by the Secretary of State, and
(b)authorized by the person who lawfully holds the information.
(4) Where the Secretary of State considers that it is necessary in the public interest that confidential patient information is processed for a purpose specified in paragraph (1), he may give notice to any body or person who is approved and authorized under paragraph (3) to require that body or person to process that information for that purpose and any such notice may require that the information is processed forthwith or within such period as is specified in the notice.
(5) Where confidential information is processed under this regulation, the bodies and persons approved under paragraph (3) shall make available to the Secretary of State such information as he may require to assist him in the investigation and audit of that processing and in his annual consideration of the provisions of these Regulations which is required by section 60(4) of the Act.