Dr Gerard Panting gives advice on when to maintain patient confidentiality, when it may be breached and when it is mandatory to disclose information

Confidentiality is a legal as well as an ethical principle: breaching confidence may result in censure by the GMC or a claim for damages.

The principle of professional confidence is fundamental to medical practice, but it is not absolute. There are times when confidence must be maintained, when breaching confidence can be justified, and when it is mandatory to divulge information even in the face of express objection by the patient. Balancing conflicting duties is often difficult, as demonstrated by the high proportion of enquiries made to the Medical Protection Society on this topic.

In Cornelius v de Taranto,1 a retired teacher recovered damages from a consultant forensic psychiatrist for disclosing a medical report written for legal purposes to the claimant's GP and another psychiatrist to whom the patient had been referred for treatment. That case, currently under appeal, is not unique.

Confidentiality is also covered in statute. The Data Protection Act 1998 requires holders of identifiable personal data stored within filing systems to comply with the data protection principles listed in Figure 1 (below). Article 8 of the Human Rights Act 1998 requires 'public authorities' (which includes NHS GPs) to respect the private and family life of individuals, which includes a requirement to respect the individual's right to confidentiality.

Figure 1: The data protection principles
  1. Personal data shall be processed fairly and lawfully and, in particular, shall not be processed unless:
    (a) at least one of the conditions in Schedule 2 is met, and
    (b) in the case of sensitive personal data, at least one of the conditions in Schedule 3 is also met.
  2. Personal data shall be obtained only for one or more specified and lawful purposes and shall not be further processed in any manner incompatible with that purpose or those purposes.
  3. Personal data shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.
  4. Personal data shall be accurate and, where necessary, kept up to date.
  5. Personal data processed for any purposes shall not be kept for longer than necessary for that purpose or those purposes.
  6. Personal data shall be processed in accordance with the rights of data subjects under this Act.
  7. Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data.
  8. Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

The GMC has published guidance on confidentiality2 which registered medical practitioners are expected to follow. Failure to do so may lead to a finding of serious professional misconduct.

The basic principle is very straightforward. Information about patients is confidential to them and should not be divulged to others. But such a rigid rule would be unworkable in practice, consequently there must be exceptions to the general rule.

When disclosure is justified

The first and most obvious exception is where the patient asks the doctor to disclose information, e.g. when completing a personal medical attendant report or pre-employment health check. Provided that the individual is competent to consent – i.e. understands the implications of allowing or withholding disclosure – the decision to disclose is usually one for the patient.

But what if the patient is a young child – too young for there to be any question of competence? The parent or anyone with parental responsibility may give consent, but there is also a best interests question to answer. No disclosure should be made if doing so would militate against the child's best interests.

Similar issues may arise with incompetent adults. In these circumstances, there may be considerable debate as to whether any other person has authority to consent on the patient's behalf. If, for instance, an elderly demented patient signed an enduring Power of Attorney which was subsequently registered, the Attorney will have charge of the patient's administrative affairs and, if disclosure of relevant medical information is required, can authorise that disclosure. But just as with children, the best interests issue still needs to be considered.

Clinical information is usually shared among the team providing patient care. Failure to do so has obvious adverse consequences. Generally speaking, no consent is required from the patient for these intra-team exchanges.

Sometimes the patient may forbid the doctor to convey certain information to other healthcare workers. In these cases, the pros and cons must be fully discussed with the patient, but ultimately the decision will normally rest with the patient.

When disclosure is mandatory

There are times, however, when the doctor has no option but to disclose information. Statutory notifications of birth, death, termination of pregnancy and infectious diseases are legally required disclosures, and the patient's sensibilities hold no sway.

Equally, if a doctor is ordered by a court to reveal information, failure to comply amounts to contempt which is a criminal offence usually resulting in a fine and inevitably referral to the GMC.

The GMC too has powers to inspect medical records without patient consent when undertaking a performance assessment as part of a fitness-to-practise investigation. The GMC also has statutory powers to require disclosure of documentation rele-vant to /ts other fitness-to-practise investigations.

The Commission for Health Improvement has powers of entry to NHS premises (including NHS GP practices) and power to inspect documentation, including medical records.

Disclosure of information may also be requested by health authorities or health boards for administrative purposes. On this subject, the GMC says the following:

'Information about patients is requested for a wide variety of purposes, including education, research, monitoring and epidemiology, public health surveillance, clinical audit, administration and planning. You have a duty to protect patients' privacy and respect their autonomy. When asked to provide information you should:

  • Seek patients' consent to disclosure of any information wherever possible, whether or not you judge that patients can be identified from the disclosure.
  • Anonymise data where unidentifiable data will serve the purpose.
  • Keep disclosures to the minimum necessary.'

This approach was endorsed by the courts in A Health Authority v X (unreported and currently subject to appeal) and others in which the Judge found that health authorities do not have an absolute right to recall patients' medical records for administrative purposes under the terms of service.

Confidentiality is one of those issues that appears blissfully simple on the surface, but once you start to dig a little deeper, conflicting duties become more apparent and the solutions less clear-cut.

There are some instances when the doctor should breach confidence in the face of a patient's refusal to disclose information.

Two examples – both quoted in the GMC's guidance on confidentiality – are as follows:

  • Reporting a patient who is not fit to drive to the Driver and Vehicle Licensing Agency (DVLA) (Figure 2).
  • Reporting health concerns about a colleague to an appropriate authority if patient care is jeopardised.
Figure 2: Disclosure of information about patients to the DVLA
  1. The DVLA is legally responsible for deciding if a person is medically unfit to drive. The Agency needs to know when driving licence holders have a condition which may now, or in the future, affect their safety as a driver.
  2. Therefore, where patients have such conditions you should:
    • Make sure that patients understand that the condition may impair their ability to drive. If a patient is incapable of understanding this advice, for example because of dementia, you should inform the DVLA immediately.
    • Explain to patients that they have a legal duty to inform the DVLA about the condition.
  3. If patients refuse to accept the diagnosis or the effect of the condition on their ability to drive, you can suggest that the patients seek a second opinion and make appropriate arrangements for the patients to do so. You should advise patients not to drive until the second opinion has been obtained.
  4. If patients continue to drive when they are not fit to do so, you should make every reasonable effort to persuade them to stop. This may include telling their next of kin.
  5. If you do not manage to persuade patients to stop driving, or you are given or find evidence that a patient is continuing to drive contrary to advice, you should disclose relevant medical information immediately, in confidence, to the medical adviser at the DVLA.
  6. Before giving information to the DVLA you should try to inform the patient of your decision to do so. Once the DVLA has been informed, you should also write to the patient, to confirm that a disclosure has been made.

Cases of suspected child abuse also require action, notwithstanding objection or even threats from involved adults. Obviously it is better to maintain a constructive relationship with all concerned, explaining the reasons for taking such action, the likely consequences and the fact that the practice will continue to provide support but that the interests of the child must be paramount.

Medical paternalism is, or should be, a thing of the past, but there are occasions when it is necessary to act to protect a vulnerable adult patient who, through intimidation or infirmity, cannot break out of an abusive situation, e.g. a person who is bed or chair bound and dependent upon an abusive 'carer'.

Fear of what may happen if that relationship is broken, with no-one to provide further care, may result in the patient colluding with the abuser in concocting explanations for physical injuries to put suspicious healthcare professionals off the scent. These cases are rare but do occur, leaving the victim subject to interminable misery if no action is taken.

Doctors may also feel compelled to break confidence when they have information about a serious crime, particularly when it involves physical harm to others and there is a chance that similar crimes may be committed in the future. Striking the balance in these cases is difficult: doctors facing such a dilemma should have a low threshold for seeking advice from experienced colleagues.


  1. Cornelius v de Taranto (2000), QBD (Morland J) 30/6/2000.
  2. Confidentiality: Protecting and Providing Information. London: GMC, 2000.

Guidelines in Practice, August 2001, Volume 4(8)
© 2001 MGP Ltd
further information | subscribe