The duty of confidentiality goes beyond undertaking not to divulge confidential information
Confidentiality may seem a very straightforward principle, but translating principle into practice can be problematic. There are all sorts of situations where it is difficult to know if patient information should be shared or not – with the police, for example, or Social Services.
Confidentiality is usually referred to as an ethical issue. It is, but it is also a legal principle.
- NHS employees will find a confidentiality clause in their contract
- There is a common-law duty to preserve professional confidence
- There are requirements under the Data Protection Act 1998 to keep personal data, including medical records, secure
- It is a condition of registration to abide by GMC guidance, which includes a requirement to respect patient confidentiality.
The duty of confidentiality goes beyond undertaking not to divulge confidential information; it includes a responsibility to make sure that written patient information is kept securely. Confidential records should not be left where other people may have casual access to them and information about patients should be sent under private and confidential cover, with appropriate measures to ensure that it does not go astray.
Confidentiality is not an absolute principle – there are several exceptions.
Disclosure with patient consent
Any disclosure must be with, and limited to, the authority provided by the patient
The first and most obvious exception is disclosure with the patient’s consent. Insurance companies, employers and people involved in legal proceedings frequently request information about patients.
Any disclosure must be with, and limited to, the authority provided by the patient. If this is not forthcoming, no information may be provided.
Disclosure without patient consent
Information can be disclosed without a patient’s consent in two instances – if the disclosure is required by law or if the disclosure is in the public interest. This is the case whether the patient has explicitly refused consent or is incapable of giving consent.
In addition, if the purpose of the intended disclosure is covered by a regulation made under section 251 of the NHS Act 2006, the disclosure can also be made without seeking the patient’s consent; however, if the patient has already made an explicit objection to the intended disclosure, it cannot be made.
Solicitors often ask for medical information, particularly those parts that are relevant to, for example, personal injury claims. The person the claim is being made against may ask for copies of certain documents, which could include details of the patient’s medical history.
According to court rules in England and Wales, the person in question can see all of the patient’s health records – it is the responsibility of the solicitor to explain this to the patient. In Scotland and Northern Ireland, records should be disclosed in accordance with the patient’s wishes or the orders of a court.
The mere threat of a court order is not sufficient to disclose
A doctor should comply with a judge’s direction in open court to answer questions, even if the patient has not consented to certain disclosures. Similarly, doctors should comply with a court order to disclose health records. Even if they have concerns about disclosing the records, they should still comply with the order and attach a covering letter to the judge describing their concerns.
Generally, compliance with a court order should be considered mandatory, but in exceptional circumstances, if you have concerns, it may be appropriate to seek advice from MPS. The mere threat of a court order is not sufficient to disclose.
Members of the clinical team
The sharing of information within the team should be on a need-to-know basis
Patient care is usually team based and access to patient information is crucial for patient safety and continuity of care. Most patients are aware that information about them needs to be shared among the healthcare professionals delivering care, but they may not know that they have a right to ask for certain information to be withheld.
They should be informed of this (via leaflets, notices and verbally) and, if they ask for information about them to be kept confidential, this should be respected. The only exception is if withholding information from staff would place others at risk of death or serious harm. The sharing of information within the team should be on a need-to-know basis, depending on the role the member of staff has in the patient’s care.
Publishing case reports, photographs and recordings
The patient’s consent is also required before individual case histories, photographs or recordings can be published in media that the public has access to, even if they have been anonymised. The exceptions to this rule are listed in Box 2.
Box 2: Recordings for which permission is not required
"Consent to make the recordings listed below will be implicit in the consent given to the investigation or treatment, and does not need to be obtained separately.
- Images of internal organs or structures
- Images of pathology slides
- Laparoscopic and endoscopic images
- Recordings of organ functions
- Ultrasound images
“When seeking consent to treatment or any other procedure that involves making one of the recordings listed in paragraph 10 (above), you should, where practicable, explain that such a recording will be made and could be used in anonymised form for secondary purposes, including in the public domain.
“You may disclose or use any of the recordings listed in paragraph 10 for secondary purposes without seeking consent provided that, before use, the recordings are anonymised; for example, by the removal or coding of any identifying marks such as writing in the margins of an X-ray. Further advice on anonymising information is available from the Information Commissioner’s Office.”
GMC, Making and Using Visual and Audio Recordings of Patients (2011) paras 10-12.
The GMC also recommends obtaining patients’ express consent before using their case histories or photographs for education and training. If this is not possible, the material can be used as long as it is not made available in the public domain; it should also be anonymised as far as is possible.2
You may need to share personal information with a patient’s relatives, friends or carers to enable you to assess the patient’s best interests. But that does not mean they have a general right of access to the patient’s records
Discussing a patient’s care with relatives can be problematic. In general, the information should be given to the patient, who can then pass it on to the family as he sees fit, but it would be extremely callous for a doctor to refuse to say anything to concerned relatives. If the patient is conscious and able to make decisions, the simplest thing is to ask whether he’s happy for you to talk to the relatives and, if so, how much you may tell them.
If the patient lacks capacity, the situation is a little more difficult. The GMC says, “You may need to share personal information with a patient’s relatives, friends or carers to enable you to assess the patient’s best interests. But that does not mean they have a general right of access to the patient’s records or to have irrelevant information about, for example, the patient’s past healthcare. You should also share relevant personal information with anyone who is authorised to make decisions on behalf of, or who is appointed to support and represent, a mentally incapacitated patient.”
Deciding how much you should tell them about the patient’s condition is a matter of judging what is in the patient’s best interests, taking into consideration the patient’s wishes and feelings if they are known. Those who are close to the patient may wish to share any concerns they have with you. Information from those close to the patient could be helpful in the treatment of the patient.
While it is not a breach of confidentiality to listen to their views, you should inform them that you cannot guarantee that you will not tell the patient about their comments. If any information you have received from someone close to the patient has influenced your treatment decisions in any way, you will need to inform the patient of this. You should also consider whether the patient would prefer you not to listen to the views of a particular person, and whether they themselves would consider any conversations to be a breach of trust.
Where discussing matters with a patient personally would be detrimental to the patient’s health, and the patient’s best interests require the doctor to reveal detailed information to relatives, you can do so. But these circumstances are rare and this is the sort of issue doctors – especially newly qualified doctors – should seek advice on.
In cases where a patient is brought in with gunshot or knife wounds, you have a duty to inform the police immediately
In general, the police have no more right of access to confidential information than anybody else, except in the following circumstances:
- Under road traffic legislation where the police may require the name and address of someone suspected of some forms of traffic offences.
- The patient has given consent to the release of information.
- In compliance with a court order.
- The public interest in disclosing information outweighs the public interest in preserving patient confidentiality.
GMC guidance also says: “Such a situation might arise, for example, when a disclosure would be likely to assist in the prevention, detection or prosecution of serious crime, especially crimes against the person. When victims of violence refuse police assistance, disclosure may still be justified if others remain at risk, for example, from someone who is prepared to use weapons, or from domestic violence when children or others may be at risk.”3
In cases where a patient is brought in with gunshot or knife wounds, you have a duty to inform the police immediately. A decision must also be made on whether the personal information of the patient should be disclosed – ie, whether or not it is in the public interest to do so. The police have a duty to consider whether there is a likelihood of further attacks – either at the scene of the original attack, or in the hospital itself. The GMC has comprehensive guidance on this.4