Communication with others
In Confidentiality, the GMC advises that “information may be disclosed in the public interest, without patients’ consent, and in exceptional cases where patients have withheld consent, if the benefits to an individual or to society of the disclosure outweigh the public and the patient’s interest in keeping the information confidential”.
You should attempt to seek the patient’s consent, but there are certain circumstances when this will not be possible – for example, if the patient lacks capacity, you are not able to trace the patient, obtaining consent undermines the purposes for which the disclosure was being made, or the disclosure must be made quickly, such as cases of detection or control of communicable diseases.
Parental responsibility
Confidentiality within family situations can be difficult. Only those with parental responsibility have a right to request information about children. Unless she lacks capacity herself, a child’s mother automatically has parental responsibility.
A father will have parental responsibility if any of the following conditions apply:
- He is married to the mother of his child (or was married to her at the time of the child’s birth).
- He has made a parental responsibility agreement with the mother.
- He has obtained a court order granting him parental responsibility.
- The child was born after 15 April 2002 in Northern Ireland, 1 December 2003 in England or Wales, or 4 May 2006 in Scotland and the father is named on the child’s birth certificate, regardless of whether married or not.
Other individuals or organisations (such as social services) may be given parental responsibility by court order, or by being appointed as a guardian on the death of a parent.
Gillick competence
As children grow older and become competent to make their own decisions about treatment, they also become entitled to confidentiality about that treatment. Be aware that Gillick competent children may visit the surgery alone to talk about issues they want keeping confidential (such as family planning) but may still visit with a parent with other conditions. Problems like this crop up regularly in calls to MPS.
Child abuse
The Children Act 1989 places a statutory duty on medical professionals. The GMC also advises that if you believe a patient to be a victim of neglect, or physical, sexual or emotional abuse, and that they lack the capacity to consent to disclosure, you must give information promptly to an appropriate responsible person or authority, if you believe this is in the patient’s best interests or necessary to protect others from risk of serious harm. You should usually tell the patient that you intend to disclose the information before doing so. Where appropriate, you should also inform those with parental responsibility about the disclosure.
DVLA
The Driver and Vehicle Licensing Agency (DVLA) and Driver and Vehicle Agency (DVA) are legally responsible for deciding if a person is medically unfit to drive, and need to know if a driver has a condition or is undergoing treatment that may now, or in their future, affect their safety as a driver.
The driver is legally responsible for informing the DVLA about such a condition or treatment. If a patient refuses to accept the diagnosis or will not inform the DVLA, you should speak to them, and if they continue to drive against your advice you should contact the medical adviser at the DVLA and disclose any relevant information. Once you have told the DVLA you should confirm to the patient that you have done so.
The DVLA’s At a Glance Guide to the Current Medical Standards of Fitness to Drive can be found on their website.
Police
There can be a conflict between the need to maintain the confidentiality of patients and the need to help the police with their duties. The GMC advises that you should consider disclosing information without the consent of a patient where this will “assist in the prevention, detection or prosecution of a serious crime, especially crimes against the person”.
MPS is often approached by GPs about less serious crimes that involve the practice, eg, assaults against staff, damaging practice property or thefts from the surgery. If a patient is witnessed committing a crime, such as theft or violence, and then the police are informed, then they can be told who the patient is. However, if there is a theft from the surgery on a particular day, it would not be acceptable to give the list of patients seen that day to the police. If in any doubt, contact MPS for advice, as you need to be aware of GMC Confidentiality guidance.
Media
There may be occasions where the media ask for information about individual patients. For example:
- Updates on the condition of particular patients, eg, celebrities.
- After newsworthy incidents, eg, violent crimes or road traffic accidents.
- When someone is complaining publicly about their treatment.
The NHS Code of Practice on Confidentiality advises that, where practicable, the explicit consent of the patients concerned should be obtained.
Where consent cannot be obtained or is withheld, disclosure may still be justified in the “exceptional” public interest. A patient complaining about treatment would normally not be considered an exceptional circumstance. Do not hesitate to contact MPS for advice on dealing with the media.
See the MPS Media Handling Guide for more information.
Confidentiality after death
Your duty of confidentiality extends beyond the patient’s death. It is advisable to get the consent of the personal representative of the deceased before releasing any information. Any approach for access should be treated in the patient’s best interests. If the patient had asked that specific information remained confidential, their views should be documented, and respected, subject to disclosures that are required by law or justified in the public interest.
There may be circumstances when disclosure may be justified. For example, you are under a professional duty to respond to complaints, and this includes complaints made by bereaved relatives. Any disclosure must be justifiable and the reasons for doing so must be fully documented.
In certain circumstances, the coroner (or procurator fiscal in Scotland) is required to investigate the circumstances of a death – for example, if the death occurred in a violent manner or in custody. You are obliged to disclose any information you may hold about the deceased that is likely to be relevant to the investigation.
Statutory bodies
A variety of statutory bodies are entitled to access to confidential information about patients, including the GMC, the Audit Commission and the Parliamentary and Health Service Ombudsman. Under the Health and Social Care Bill, the Care Quality Commission can enter and inspect premises and, if it is "necessary or expedient”, “inspect, take copies of and remove from the premises any documents or records (including personal records)”.
Insurance companies
Reports for insurance companies should be completed fully, with the consent of the patient. The British Medical Association (BMA) and the Association of British Insurers (ABI) have developed a package to make it easier for doctors to provide information to their patients’ insurance companies. It includes a standard covering letter for insurers to send to GPs, a standard form for the GP’s report and a consent declaration for patients. Click here to view the guide.
More details on providing access to medical records can be found in the MPS booklet, Guide to Medical Records, and in the GMC’s supplementary guidance, Disclosing Information for Insurance, Employment and Similar Purposes (2009).
Caldicott Guardians
Caldicott Guardians are responsible for overseeing access to patient-identifiable information. All PCTs should have a Caldicott Guardian (usually a board-level clinician or other senior officer). GP practices should have an information governance lead, who will usually be clinically qualified.
Primary Care Trusts
PCTs request information from GPs, usually to carry out audits, for example on Quality and Outcomes Framework (QOF) visits. This information can normally be anonymised. If anonymisation is not possible, then the advice from the Department of Health is that non-anonymised data can be released. In addition, there are rare situations, such as the investigation of a complaint, where non-anonymised data can be seen by the PCT. If you are in any doubt, please contact MPS for advice.
Audit for summative assessment
If you intend to complete an audit as part of your assessment, you should make sure that the data are anonymised to maintain confidentiality. Many deaneries will not accept non-anonymised audits.