Where allowing access might be permissible
Situations can arise in which it is justifiable to disclose a patient’s medical records to a person other than the patient. In some cases, you might have a statutory duty to share certain information – such as reporting notifiable diseases or disclosing information concerning the commission of offences that may assist the police in the prevention and detection of a serious crime – but in these cases it is unlikely that you will also need to provide access to the medical records themselves.
There are other circumstances, however, where you might need to allow access to part or the whole of a patient’s medical records. Each situation must be assessed individually to determine whether disclosure is appropriate in the circumstances. It is essential that the reasons behind any decision to provide a third party with access to a patient’s records be comprehensively documented.
Disclosure with patient consent
The first and most obvious exception to the rule of confidentiality is disclosure made with the patient’s consent. Insurance companies, employers and people involved in legal proceedings frequently request information about patients. Any disclosure must be with, and limited to, the authority provided by the patient. If this is not forthcoming, no information may be provided. An authority provided by a patient should not constitute a general waiver of confidentiality. An authority should specify the purpose of the disclosure, who may make the disclosure and to whom the disclosure may be made.
Within a healthcare team
Patient care is usually team based and access to patient information is crucial for the safe delivery and continuity of care. The HPCSA states that sharing patient information within a team delivering are to that patient is permissible with the patient’s consent. This includes sharing information with professionals not regulated by the HPCSA.4 Consent can be assumed if a patient agrees, for example, to his doctor referring him to a specialist.
Most patients are aware that information about them needs to be shared among the healthcare professionals delivering care, but they may not know that they have a right to ask for certain information to be withheld. They should be informed of this (via leaflets, notices and verbally) and, if they ask for information about them to be kept confidential, this should be respected.
The sharing of information within the team should be on a need-to-know basis, depending on the role the member of staff has in the patient’s care.