Breaching confidentiality
It would be impossible to care for patients effectively while keeping their confidentiality absolute.
Healthcare is a multidisciplinary team process – you need to share information about patients with colleagues and other agencies. You also have a responsibility to act in the public interest, when the health and safety of others is endangered. So you will need to become comfortable with making decisions on these boundaries.
The GMC advises that any disclosures should be with the consent of patients whenever possible, kept to a minimum and anonymised where this will suffice. You should also ensure that any decisions you make are recorded, together with the reasoning behind them.
Practices should have a confidentiality statement that includes a clause to cover staff when they are no longer working at the practice, and should ensure that all staff receive and sign a copy, including the practice-employed cleaner.
Sharing with colleagues
All healthcare professionals have a professional ethical duty to respect patients’ confidentiality and should only access records if they are involved in the patient’s care. This is on a “need-to-know” basis.
Whilst it is assumed that patients consent to their personal information being shared among the clinical team for the purposes of their care, they should be made aware that this is the case and told that they have the right to withhold consent. Sometimes, patients may ask for certain – usually extremely sensitive – information to be kept private and you should respect this. However, in certain circumstances, this information may need to be released if failure to disclose would place others at risk of death or serious harm.
Administrative staff
The GMC advises that administrative staff should have access to information only on a “need-to-know” basis. When using computerised records, administrative data, such as names and addresses, should be accessible separately from clinical information, so that sensitive data are not automatically displayed.
This will help reduce the risk of accidental breaches of confidentiality in reception areas or other areas to which patients have access. All staff who have access to clinical information must have a full understanding of their duty of confidentiality, and understand their responsibilities.
Acts of Parliament
A number of Acts require the obligatory disclosure of information, under particular circumstances.
Communicable diseases
- Public Health (Control of Disease) Act 1984
If a patient refuses to allow you to inform someone outside the healthcare team of their infection status, you must respect their wishes – unless you consider that failure to disclose the information will put healthcare workers or other patients at risk of infection. You should pass information about serious communicable diseases to the relevant authorities for communicable disease control and surveillance.
The full list of notifiable diseases can be found on the Health Protection Agency website.
Traffic offences
Everyone, including doctors, must provide the police, if asked, with information that might identify a driver who has committed a traffic offence. However, this would normally mean simply providing a name and address. There should be no need to provide clinical information – and this should not be provided without the patient’s consent, or a court order.
Terrorism
- Prevention of Terrorism (Temporary Provisions) Act 1989 (Continuance) Order 2000
If you receive information about terrorist activity, you must inform the police as soon as possible.
Children
Section 47 of the Children Act 1989 places a statutory duty on health, education and other services to help social services departments with their enquiries, where there is reasonable cause to suspect that a child is suffering, or is likely to suffer, significant harm. Your first duty is to act in the best interests of the child. You should seek consent before disclosing the information, unless this would put the child at risk or hinder the investigation.
Births and deaths
Doctors attending patients during their last illness must sign a death certificate giving the cause of death. For sudden deaths, the deceased’s GP will be contacted if the death is not suspicious. If they feel able to, they can sign a death certificate although, depending on local protocol, the death will still be reported to the coroner.
Births must be reported within 36 hours, although this is usually done by the midwife.
Disease registers and public health initiatives
- Health and Social Care Act 2001
Many professional and government organisations rely on information from patients’ records. These iinclude public health initiatives, cancer registries and the Yellow Card Scheme for monitoring adverse drug reactions. The GMC advises that you must co-operate by providing relevant information wherever possible. Where personal information is needed, you should seek express consent before disclosing information.
If you are uncomfortable in a situation where you have been asked to provide personal information without consent, please contact MPS for advice.
Welcome to the world's leading medical defence organisation