The Caldicott Committee ... was to review all patient-identifiable information, which passes from NHS organisations to other NHS or non-NHS bodies for purposes other than direct care, medical research, or where there is a statutory requirement for information. The committee was to consider each flow of patient-identifiable information and was to advise the NHS Executive whether patient identification was justified by the purpose and whether action to minimise risks of breach of confidentiality was desirable—for example, reduction, elimination, or separate storage of items of information.