Summary
Confidentiality is at the centre of maintaining trust between patients and doctors. As a doctor, you have access to sensitive personal information about patients and you have a duty to keep this information confidential, unless the patient consents to the disclosure, disclosure is required by law or is necessary in the public interest. This factsheet sets out the basic principles of confidentiality.
General principles
Patients have the right, under the Personal Data Protection Act, to expect that there will be no disclosure of any personal information unless they give consent. Steps should be taken to ensure that confidentiality is maintained regardless of the technology used to communicate health information. For example, do not leave confidential information on answering machines, and exercise caution when sending confidential material by mail, fax, or email.
You should take care to avoid unintentional disclosure – for example, by ensuring that any consultations with patients cannot be overheard, and records are kept securely. If you have any concerns about the security of personal information, follow the MMC’s guidelines on raising concerns about patient safety.
Ensure that administrative information, eg, names and addresses, is stored separately from clinical information so that sensitive information is not displayed automatically. For electronic records, an information governance policy should be in place to ensure that patient confidentiality is documented, maintained and disclosed in accordance with the MMC’s principles of confidentiality. For more information see MPS’s factsheet on Medical Records.
When disclosing information in any of the situations outlined below, you should ensure that the disclosure is proportional – anonymised if possible – and includes only the minimum information necessary for the purpose.
Consent to disclosure
Before disclosing any information about a patient to a third party, you should seek the patient’s consent. Consent may be implied or express, eg, most patients understand that information about their health needs to be shared within the healthcare team providing care, and so implied consent is adequate in this circumstance. There will also be circumstances where, because of a medical emergency, a patient’s consent cannot be obtained, but relevant information must be transferred between healthcare providers within the patient’s interests.
Express consent is needed if patient-identifiable data is to be disclosed for any other purpose, except if the disclosure is required by law or is necessary in the public interest.
Valid consent
In order for consent to disclosure to be valid, the patient needs to be competent to give consent, and provided with full information about the extent of the disclosure. Adult patients are assumed to be competent, unless you have specific reason to doubt this. When taking consent for disclosure of information about a patient, you should ensure the patient is aware of what data will be disclosed, and to whom.
Disclosure required by law
In some circumstances, you are obliged to disclose information to comply with a statutory requirement to disclose information, eg, the requirement to notify certain communicable diseases. In such cases, you should disclose the information – even if you do not have the patient’s consent. You should also inform the patient of the disclosure and reason for it.
You may also be ordered by a judge or presiding officer to provide information without a patient’s consent. You should object to the judge or presiding officer if attempts are made to compel you to disclose what appear to you to be irrelevant matters, eg, matters relating to relatives or partners of the patient who are not party to the proceedings. You must not disclose personal information to a third party such as a solicitor, police officer or officer of a court without the patient’s express consent, unless it is required by law or can be justified in the public interest.
The MMC or other statutory regulators may require patient records for an investigation into a healthcare professional’s fitness to practise. If information is requested, but is not required by law, or if the practitioner is referring concerns about a health professional to the regulatory body, the patient’s consent should be sought before disclosing personal information.
Disclosures in the public interest
In some cases, it is not possible to obtain the patient’s consent, such as when the patient is not contactable. Alternatively, the patient may have expressly refused their consent. If you believe that disclosure is necessary in the public interest, and that the benefits from disclosure outweigh the risks from doing so, it may be justified to disclose the information, even without the patient’s consent.
Such circumstances usually arise where there is a risk of death or serious harm to the patient or others. If possible, you should seek the patient’s consent and/or inform them of the disclosure before doing so. Examples of such a situation would include one in which disclosure of information may help in the prevention, detection or prosecution of a serious crime. A competent adult’s wishes should generally be respected if they refuse to allow disclosure and no-one else will suffer.
Disclosures involving patients who are not competent adults
Children and young people
Problems may arise if a child lacks capacity to give consent to treatment or disclosure. If such patients ask the practitioner not to disclose information about their condition or treatment to a third party, you should try to persuade them to allow a relevant person to be involved in the consultation. If they refuse and you believe that it is essential in their medical interest, you may disclose relevant information to a relevant person or authority. You should inform the patient before disclosing any information, documenting in the patient’s record the discussion with the patient and the reasons for deciding to disclose.
Patients lacking capacity
If a patient lacks capacity, you should respect the patient’s dignity and privacy and support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information. You should consider whether their lack of capacity is permanent or temporary, evidence of a patient’s previously expressed preferences, the views of anyone else the patient asks the practitioner to consult or who has legal authority to make a decision on their behalf, and the views of people close to the patient on the patient’s preferences. You may need to share personal information with a patient’s relatives or carers to act in the patient’s best interests, but they do not have a general right of access to the patient’s records or any irrelevant information.
After a patient's death
Your duty of confidentiality to your patient remains after death. In some situations, such as a complaint arising after a patient’s death, you should discuss relevant information with the family, especially if the patient was a child. If you reasonably believe that the patient wished that specific information should remain confidential after their death, or if the patient has asked, you should usually respect that wish.
If there are no directions from the patient, you should consider requests for information, taking into account, amongst other things, whether the person requesting has locus standi; whether the disclosure may cause distress to, or be of benefit to, the patient’s partner or family.
Difficulties may arise when there is a conflict of interest between parties affected by a patient’s death. For example, if an insurance company seeks information about a deceased patient in order to decide whether to make a payment under a life assurance policy, you should not release information without the consent of the patient’s executor, or next-of-kin.
You should disclose relevant information about a patient who has died to help a coroner in an inquest, when required by law or is justified in the public interest, for National Confidential inquiries or for clinical audit, on death certificates, for public health surveillance, or when a parent asks for information about the circumstances and causes of a child’s death.
Further information