Certain circumstances can justify the disclosure of medical information without the patient’s consent, says Dr Gerard Panting of the Medical Protection Society

Disclosure of medical data held by GPs about their patients may be requested under a host of different circumstances. Many of these requests are straightforward, presenting no dilemma for the GP. However there are many situations where there is potential for conflict.

The basic rule of confidentiality is very simple: confidential information should not be divulged without appropriate authority.

However, as with so many rules, there are exceptions, and sometimes disclosure can be justified despite a lack of patient consent. At other times the strict rule of professional secrecy must be observed no matter how much pressure is applied by the police or other authority.

Requests from the patient

The simplest case is the request for information from the patient or someone, such as a solicitor, authorised to act on the patient’s behalf.

Patients are entitled to have access to data held about them under the Data Protection Act 1998 and the only grounds for refusing are:

  • The patient failed to make the request in accordance with the requirements of the Act.
  • Acceding to the request would result in disclosure of information about somebody else without their consent.
  • Disclosure would be likely to cause serious harm to the mental or physical health of the patient.

Family history

Information relating to another individual should be withheld unless that person’s consent has been obtained; but what about recorded family history? If the patient has told the doctor in confidence about someone else in the family, can that information be disclosed without that other family member’s consent?

This issue is unresolved in law; however, a reasonable approach is to record the details only in the notes of the patient reporting the history. This ensures it is clear that the details have been provided by the patient, not the other family member, and are therefore unsubstantiated. The record should also not include that person’s name.

Information from sources other than the patient

If a family member tells the doctor that his patient is drinking heavily or exhibiting signs or symptoms of an illness affecting his ability to do his job, how and where should this information be recorded, and what should happen when there is a request for disclosure of those notes? This is more difficult. Here again, the doctor becomes aware of unsubstantiated observations which may be extremely damaging to the individual concerned.

In this situation there is a case for not making any record at all until the doctor has had the chance to establish the facts, so ensuring that anything recorded is accurate.

Purists may argue that failing to record the consultation with the family member who makes the report is wrong, as all contacts should be recorded. They would of course have a point.

However, in such a delicate situation it is probably better to wait until accurate details can be entered onto the patient record. Perhaps the more serious the potential consequences, the greater the justification for this approach.

Statutory duties

Doctors have a statutory duty to report various pieces of information. Here there is no requirement for consent as, whether the patient likes it or not, the doctor has to comply with the statute. Births, deaths and some infectious diseases are obvious examples in this category but there are many others.

For example, under Section 60 of the Health and Social Care Act 2001, the Secretary of State can make regulations requiring data to be provided to health authorities. Regulations to date apply only to cancer registries, communicable disease surveillance, research and audit but it is likely that there will be more, perhaps dealing with planning issues, gathering information on performance, investigating complaints and post-payment verification.

The GMC also has statutory powers to inspect medical records when investigating a doctor’s fitness to practise, as does the Commission for Health Improvement when conducting its investigations and audits. With such a complex regulatory framework, it can be extremely difficult to determine when to disclose information.

For example, in one case, a health authority attempted to recall the medical notes of various patients to investigate complaints about several GPs. The GPs asked the patients whether they consented to disclosure and a number declined to give their consent. Consequently, the notes were withheld.

The health authority attempted to force the issue through the courts claiming that under the terms of service, the GPs were under a statutory duty to return the notes to them, effectively upon request.

Although ultimately the notes were returned to the health authority, the Court of Appeal did not agree with that view, stating that each case must be judged on its own merits and there was no blanket authority for health authorities to recall medical records in this way.

When the courts order disclosure of medical records, failure to comply with the order amounts to contempt of court punishable by imprisonment, a fine or both. Furthermore, the issue will almost inevitably be referred on to the GMC who are also likely to be severely critical.

Disclosure to protect the patient or others

Perhaps the most difficult cases of all are disclosures to protect the patient or others.

The GMC gives the following advice:

‘Disclosure of personal information without consent may be justified where failure to do so may expose the patient or others to risk of death or serious harm. Where third parties are exposed to a risk so serious that it outweighs the patient’s privacy interest you should seek consent to disclosure where practicable. If it is not practicable, you should disclose the information promptly to an appropriate person or authority. You should generally inform the patient before disclosing the information.’

It then goes on to cite various circumstances where this may be necessary, including the situation where disclosure may assist in the prevention, detection or prosecution of a serious crime. The Council defines ‘serious crimes’ in this context as those which put someone at risk of death or serious harm; these are usually crimes against the person such as abuse of children.

Other situations where there is a clear public interest and a duty to take action to prevent harm to others include:

  • When a patient continues to drive against medical advice when unfit to do so.
  • When a medical practitioner or other healthcare professional places patients at risk as a result of an illness or other medical condition.

‘Part 8’ inquiries under the Children Act 1989 follow circumstances where children have died or suffered serious harm. The public interest in ensuring that any danger to other children is identified and removed demands -disclosure of information necessary for a proper inquiry, even when consent from the individuals concerned is not forthcoming.

Confidentiality after death

The duty of professional secrecy does not end with death, and information about dead patients should not be disclosed without authority from the executors to the estate unless the Access to Medical Reports Act applies or there is an order from the court.

However, coroners’ investigations are another example where the public interest in securing thorough investigation outweighs the conflicting public interest of keeping information confidential.

Confidentiality queries in practice take on many forms and often provoke vigorous debate among those who encounter them frequently.


Guidelines in Practice, April 2003, Volume 6(4)
© 2003 MGP Ltd
further information | subscribe