Confidentiality is a legal as well as an ethical principle: breaching confidence may result in censure by the GMC or a claim for damages.
The principle of professional confidence is fundamental to medical practice, but it is not absolute. There are times when confidence must be maintained, when breaching confidence can be justified, and when it is mandatory to divulge information even in the face of express objection by the patient. Balancing conflicting duties is often difficult, as demonstrated by the high proportion of enquiries made to the Medical Protection Society on this topic.
In Cornelius v de Taranto,1 a retired teacher recovered damages from a consultant forensic psychiatrist for disclosing a medical report written for legal purposes to the claimant's GP and another psychiatrist to whom the patient had been referred for treatment. That case, currently under appeal, is not unique.
Confidentiality is also covered in statute. The Data Protection Act 1998 requires holders of identifiable personal data stored within filing systems to comply with the data protection principles listed in Figure 1 (below). Article 8 of the Human Rights Act 1998 requires 'public authorities' (which includes NHS GPs) to respect the private and family life of individuals, which includes a requirement to respect the individual's right to confidentiality.
|Figure 1: The data protection principles|
The GMC has published guidance on confidentiality2 which registered medical practitioners are expected to follow. Failure to do so may lead to a finding of serious professional misconduct.
The basic principle is very straightforward. Information about patients is confidential to them and should not be divulged to others. But such a rigid rule would be unworkable in practice, consequently there must be exceptions to the general rule.
When disclosure is justified
The first and most obvious exception is where the patient asks the doctor to disclose information, e.g. when completing a personal medical attendant report or pre-employment health check. Provided that the individual is competent to consent – i.e. understands the implications of allowing or withholding disclosure – the decision to disclose is usually one for the patient.
But what if the patient is a young child – too young for there to be any question of competence? The parent or anyone with parental responsibility may give consent, but there is also a best interests question to answer. No disclosure should be made if doing so would militate against the child's best interests.
Similar issues may arise with incompetent adults. In these circumstances, there may be considerable debate as to whether any other person has authority to consent on the patient's behalf. If, for instance, an elderly demented patient signed an enduring Power of Attorney which was subsequently registered, the Attorney will have charge of the patient's administrative affairs and, if disclosure of relevant medical information is required, can authorise that disclosure. But just as with children, the best interests issue still needs to be considered.
Clinical information is usually shared among the team providing patient care. Failure to do so has obvious adverse consequences. Generally speaking, no consent is required from the patient for these intra-team exchanges.
Sometimes the patient may forbid the doctor to convey certain information to other healthcare workers. In these cases, the pros and cons must be fully discussed with the patient, but ultimately the decision will normally rest with the patient.
When disclosure is mandatory
There are times, however, when the doctor has no option but to disclose information. Statutory notifications of birth, death, termination of pregnancy and infectious diseases are legally required disclosures, and the patient's sensibilities hold no sway.
Equally, if a doctor is ordered by a court to reveal information, failure to comply amounts to contempt which is a criminal offence usually resulting in a fine and inevitably referral to the GMC.
The GMC too has powers to inspect medical records without patient consent when undertaking a performance assessment as part of a fitness-to-practise investigation. The GMC also has statutory powers to require disclosure of documentation rele-vant to /ts other fitness-to-practise investigations.
The Commission for Health Improvement has powers of entry to NHS premises (including NHS GP practices) and power to inspect documentation, including medical records.
Disclosure of information may also be requested by health authorities or health boards for administrative purposes. On this subject, the GMC says the following:
'Information about patients is requested for a wide variety of purposes, including education, research, monitoring and epidemiology, public health surveillance, clinical audit, administration and planning. You have a duty to protect patients' privacy and respect their autonomy. When asked to provide information you should:
- Seek patients' consent to disclosure of any information wherever possible, whether or not you judge that patients can be identified from the disclosure.
- Anonymise data where unidentifiable data will serve the purpose.
- Keep disclosures to the minimum necessary.'
This approach was endorsed by the courts in A Health Authority v X (unreported and currently subject to appeal) and others in which the Judge found that health authorities do not have an absolute right to recall patients' medical records for administrative purposes under the terms of service.
Confidentiality is one of those issues that appears blissfully simple on the surface, but once you start to dig a little deeper, conflicting duties become more apparent and the solutions less clear-cut.
There are some instances when the doctor should breach confidence in the face of a patient's refusal to disclose information.
Two examples – both quoted in the GMC's guidance on confidentiality – are as follows:
- Reporting a patient who is not fit to drive to the Driver and Vehicle Licensing Agency (DVLA) (Figure 2).
- Reporting health concerns about a colleague to an appropriate authority if patient care is jeopardised.
|Figure 2: Disclosure of information about patients to the DVLA|
Cases of suspected child abuse also require action, notwithstanding objection or even threats from involved adults. Obviously it is better to maintain a constructive relationship with all concerned, explaining the reasons for taking such action, the likely consequences and the fact that the practice will continue to provide support but that the interests of the child must be paramount.
Medical paternalism is, or should be, a thing of the past, but there are occasions when it is necessary to act to protect a vulnerable adult patient who, through intimidation or infirmity, cannot break out of an abusive situation, e.g. a person who is bed or chair bound and dependent upon an abusive 'carer'.
Fear of what may happen if that relationship is broken, with no-one to provide further care, may result in the patient colluding with the abuser in concocting explanations for physical injuries to put suspicious healthcare professionals off the scent. These cases are rare but do occur, leaving the victim subject to interminable misery if no action is taken.
Doctors may also feel compelled to break confidence when they have information about a serious crime, particularly when it involves physical harm to others and there is a chance that similar crimes may be committed in the future. Striking the balance in these cases is difficult: doctors facing such a dilemma should have a low threshold for seeking advice from experienced colleagues.
- Cornelius v de Taranto (2000), QBD (Morland J) 30/6/2000.
- Confidentiality: Protecting and Providing Information. London: GMC, 2000.