Confidentiality in the modern NHS: Part 1

Posted 18 Oct 2013

This, the first of a two-part series, examines the legal and ethical aspects of confidentiality and when it may be appropriate or mandatory to disclose patient information, with or without consent

The duty of medical confidentiality is enshrined in the Hippocratic Oath:

‘Whatever, in connection with my professional service, or not in connection with it, I see or hear, in the life of men, which ought not to be spoken of abroad, I will not divulge, as reckoning that all such should be kept secret.’¹

Historically it was founded on medical practice but, in today’s world it governs all clinicians, doctors and nurses alike. It is intended to maintain trust between health professionals and their patients,² allowing patients to disclose sensitive information freely, without fear of exposure.

In this article, the first of a two part series, we examine confidentiality – what it means in the modern NHS, when we might consider breaching it, when we must do so and how to make the judgments involved.

LAW AND CONFIDENTIALITY

Medical confidentiality is not specifically enshrined in UK Parliamentary law, but is a part of common law.³Common law is not written out in one document, like an Act of Parliament, but is law based on previous court cases, also referred to as case law. In common law if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

Confidentiality is part of good medical and nursing practice.⁴It is a condition of registration that we, as health professionals abide by our registering bodies’ guidance on this issue. The legal imperative to maintain confidentiality will also be covered in a confidentiality clause in your employment contract.

The Data Protection Act,⁵ (Box 1) also relates to the legal requirement to keep the data we hold on patients secure. In the modern NHS new risks have been revealed in this area, for example:

The lost laptop with patient information on it
The fax or email which goes to the wrong person
The email trail inadvertently distributed
The anonymised comment on social media, which in fact identifies a patient
Firewall problems allowing the curious access to information
The text to a patient read by her mother
The telephone call from someone pretending to be a patient or relative.

ETHICS AND CONFIDENTIALITY

Confidentiality is an ethical duty, and we can use ethics to help us apply it.⁶ This involves weighing up not only the patient’s expressed (or unexpressed) wishes, but also the public interest, and harm versus good. (Figure 1) When deciding whether we must observe confidentiality in a specific situation we need to consider the patients best interests – the balance of harm and good – but we must also consider their autonomy and the public interest.

Where a patient with capacity gives informed consent to disclosure then there is usually no decision to make and autonomy prevails. Where such a patient refuses consent, however, your judgment of harm versus good does NOT allow you to override their clearly made decision – unless the public interest is at risk. Patients with capacity have a right to make decisions which are not in their own best interests and, in this situation autonomy prevails.

Where the patient is unable to express a wish through lack of capacity, however, then one has to judge the public interest and the issues of harm versus good – together with, if known, the likely wishes of the patient.

DISCLOSURE WITH CONSENT

Patients often consent to disclosure of their medical records. The disclosure must be within the authority provided by the patient, and you need to be sure that the patient has fully understood what they have agreed to disclose.

Solicitors often ask for medical information in, for example, personal injury claims. The person the claim is being made against may ask for full details of the patient’s medical history. According to court rules in England and Wales they are entitled to see all of the patient’s health records. The solicitor must explain this to the patient making the claim, and they must consent in order to proceed.⁸In Scotland and Northern Ireland, unless the patient consents, a court order is needed.

In other instances consent may be limited to relevant information. If a patient agrees to have information disclosed to an employer this would be expected to be restricted to what is relevant.⁹For example, the fact that this individual had a termination ten years ago is unlikely to be relevant to their employer.

If a patient does not consent – or if the consent you are shown looks to be out of date and not specific to the current request for information – then disclosure should not be made without a fresh, specific consent.

The Case Studies illustrate some of the issues around consent and disclosure.

CONFIDENTIALITY AND CHILDREN

Children are also entitled to confidentiality, but this comes with certain caveats. Maintaining confidentiality may not be in a child’s best interests and it is important not to promise children absolute secrecy when they may then tell you something that you need to disclose.

The decision to maintain a child’s confidentiality also depends on the competence of the child: for example, a 15-year-old who comes for contraceptive advice. The guidance around this subject is clearly laid out. You have a duty to attempt to persuade her to involve her parents. If she is adamant that she will not do so and you are clear, both that she will have sexual intercourse with or without contraception and that she is not being coerced or in an abusive relationship, then you must respect her confidentiality. This guidance will broadly apply to most consultations.¹⁰

If, however, a child of 14 comes to you and discloses sexual abuse, then confidentiality would have to be breached in order to properly help the child. Their best interests (and potentially the public good) would override their autonomy, in part because it would be likely that a 14-year-old in such a situation would not have full capacity to understand the consequences, for her, of non-disclosure.

DISCLOSURE WITHOUT CONSENT

Information can be disclosed without a patient’s consent in two other instances:

1. If the disclosure is required by law

2. If the disclosure is in the public interest.

Disclosures required by law

Court orders

We are obliged to comply with a judge’s direction in open court to disclose, even if the patient has not consented. Similarly, we must comply with a court order to disclose health records. If we have concerns about this harming the patient, we can separately inform the judge.

The Police

There is no similar requirement to disclose to the police.⁸They cannot override confidentiality to help their investigations, even into serious crime. However, if it is in the public interest that you disclose because it is clear that someone will suffer harm if you do not, then you may do so.

You and the police may differ in your interpretation of what is in the public interest. Solving serious crime is, obviously, always in the public interest, but that does not necessarily mean that refusing to disclose your patient’s details will result in public harm.

Deciding when to disclose information to the police can be challenging, as Activity 2 illustrates.

Statutory duty of disclosure

These statutory duties include notification of births and deaths, and terminations of pregnancy carried out under the Abortion Act. No consent from the patient is required and patients cannot prevent disclosure. Communicable disease notification is a disclosure in the public interest and also does not require the patient’s consent.

Disclosure in the public interest

There are several areas where it is mandatory to disclose in the pubic interest although, unless time pressures make it impossible, you should always try to obtain consent from the patient first.

Such disclosures include:

Informing the DVLA that a patient who is not fit to drive is continuing to do so despite your advising him to inform the DVLA
Gunshot or knife wounds: you have a duty to inform the police immediately that the patient has been brought to you
Under road traffic legislation the police can ask for the name and address of someone suspected of some forms of traffic offences
The public interest in disclosing information outweighs the public interest in preserving patient confidentiality
Communicable disease notifications.

CONCLUSION

Maintaining a patient’s confidentiality is fundamental to good medical and nursing practice, but it is not always straightforward or easy. There are circumstances where breaches of confidentiality are either mandatory or in the patient’s or public’s best interest. An understanding of the legal and ethical issues around disclosure of information can help us make appropriate decisions.

The NHS in the 21st century is a vast organisation and advances in electronic communication present us with new dilemmas and challenges in maintaining our patients’ confidentiality. This is the subject of the second article in this series.

REFERENCES

1. W.H.S. Jones, The Doctor’s Oath. (Cambridge UP, 1924). http://www1.umn.edu/phrm/oaths/oath1.html

2. Higgins GL, The History of Confidentiality in Medicine: Can Fam Physician 1989 April: 35:914, 921-26 http://www.ncbi.nlm.nih.gov/pmc/articles/PMC2280818/

3. Anon.: The Common Law Duty of Confidentiality in Dept of Health National Archives http://webarchive.nationalarchives.gov.uk/+/www.dh.gov.uk/en/publicationsandstatistics/publications/publicationspolicyandguidance/browsable/DH_5803173

4. GMC Guidance on Confidentiality http://www.gmc-uk.org/guidance/ethical_guidance/confidentiality_contents.asp

5. Guide to the Data Protection Act: Information Commissioner’s Office http://ico.org.uk/for_organisations/data_protection/the_guide/the_principles

6. Hope T: Chapter 7 in Medical Ethics, A Very Short Introduction (pub 2004 Very Short Introductions)

7. Beauchamp TL, Childress J. Principles of biomedical ethics. New York. Oxford University Press. 5th Edition. 2001

8. Medical Protection Society Website http://www.medicalprotection.org/uk/booklets/medical-records/confidentiality

9. Litchfield P Ethics; chapter 6 in Snashall D and Patel D: ABC of Occupational and Environmental Medicine 3rd edition pub 2012, Wiley

10.GP Notebook. Gillick competence http://www.gpnotebook.co.uk/simplepage.cfm?ID=x20050425225920411760

ACTIVITIES: DISCUSSION

ACTIVITY 1. Mrs Williams and her employer

Mrs Williams has given informed consent to a report. She had a right to see it before it went, which she may or may not have chosen to exercise. That was her decision. She did not however consent for you to talk to her employer and you should not do so other than to clarify the meaning of the content of your report.

Her employer may ask her to sign a consent to a discussion of her case with you, but as it would be difficult for her to know in advance what you would be asked or what you might say in response then it is difficult to see how she could give a meaningful, informed and complete consent.

The recommendation would be that the employer put their questions in writing and, given a further consent from Mrs Williams, that she be offered the chance to see your responses before they are sent.