Introduction

GP Practices hold information about patients which must be kept private and confidential.

In some instances, patient records can be very sensitive and may contain information concerning third parties. Patient information must not be given to others unless the patient consents or the disclosure can be justified.

Dr T Abubacker is the Practice’s Caldicott Guardian.

This Code of Practice outlines how the Caldicott Guardian and all Practice staff will deal with information about its Patients. It reflects the standards that are expected of doctors when they hold or share information about patients, as per the following 2 GMC Documents:

“Confidentiality: Guidance for Doctors” effective October 2009.

“Raising and acting on concerns about patient safety” effective 12 March 2012.

Patients’ right to confidentiality

Principles

Patients have a right to expect that information about them will be held in confidence by their doctors.

Confidentiality is central to trust between doctors and patients. Without assurances about confidentiality, patients may be reluctant to seek medical attention or to give doctors the information they need in order to provide good care.

However, sharing appropriate information is an essential part of providing efficient, safe, and effective care for both the individual patient and the wider community of patients.

Information should be readily available to patients, and they should clearly understand that unless they object, their personal information may be disclosed for the sake of their own care and for local clinical audit purposes.

Most patients understand the need for the healthcare team who provides their care to be aware of their personal information. However, they are less likely to be aware of disclosures to others for purposes other than their own care (e.g. service planning or medical research).

They must therefore be informed about disclosures for purposes they would not reasonably expect.

Although confidentiality is an important duty, it is not absolute because information can be disclosed if:

1. It is required by law.
2. The patient consents – either implicitly for the sake of their own care or expressly for other purposes
3. It is justified in the public interest.

When disclosing information about a patient, the Practice must:

• Use anonymised or coded information if practicable and if it will serve the purpose.
• Be satisfied that the patient:
  • Has ready access to information that explains that their personal information might be disclosed for the sake of their own care, or for local clinical audit, and that they can object; and
  • Has not objected.
• Get the patient’s express consent if identifiable information is to be disclosed for purposes other than their care or local clinical audit unless the disclosure is required by law or can be justified in the public interest.
• Keep disclosures to the minimum necessary; and
• Keep up to date with, and observe, all relevant legal requirements, including the common law and data protection legislation.
• Respect and help patients exercise their legal rights to
  • Be informed about how their information will be used.
  • Have access to, or copies of their health records.

When the Caldicott Guardian is satisfied that information should be released, the Practice should act promptly to disclose all relevant information. This is often essential to the best interests of the patient, or to safeguard the well-being of others.

Protecting information

When you are responsible for personal information about patients you must make sure that it is effectively always protected against improper disclosure

Many improper disclosures are unintentional. You should not discuss patients where you can be overheard or leave patients’ records, either on paper or on screen, where they can be seen by other patients, unauthorised health care staff or the public.

All relevant practice staff must:

• Be conversant with the Practice’s computer systems, policies and procedures designed to protect patients’ privacy (including use of laptops and portable media storage devices [e.g. “Flash Cards”]);
• Avoid abusing access privileges.
• Only access information which they have a legitimate reason to view.
• Raise concerns about patient safety, confidentiality, and information governance if issues about the security of personal information within the Practice are identified.

Practice staff responsible for the management of patient records and information should:

• Ensure they are stored securely.
• Ensure relevant staff are trained and understand their responsibilities.
• Use professional expertise when choosing or developing systems which record, access and send electronic data.
• Ensure administrative (e.g. patient names and addresses) and clinical information can be accessed separately, so that sensitive information is not automatically displayed when records are accessed.

Disclosures required by law

Disclosures required by statute.

You must disclose information to satisfy a specific statutory requirement, such as notification of a known or suspected communicable disease.

Many regulatory bodies have statutory powers to access patients’ records (e.g. as part of their duties to investigate complaints, accidents or health professionals’ fitness to practise) and have codes of practice governing how they will access and use personal information.

The Caldicott Guardian should be satisfied that any disclosure sought is required by law or can be justified in the public interest.

Patients should be informed about such disclosures (unless that would undermine the purpose), even if their consent is not required.

Should Patient records or personal information be requested, but is not required by law (e.g. by a statutory regulator to investigate a healthcare professional’s fitness to practise) the patient’s express consent must be sought, if practicable, before disclosure. In the event that it is not practicable to seek their consent, or a patient refuses to give consent, the regulatory body involved should be contacted to advise on whether the disclosure can be justified in the public interest.

Disclosures to courts or in connection with litigation

You must also disclose information if ordered to do so by a judge or presiding officer of a court. You should object to the judge or the presiding officer if attempts are made to compel you to disclose what appear to you to be irrelevant matters, (e.g. matters relating to relatives who are not involved in the proceedings).

You must not disclose personal information to a third party such as a solicitor, police officer or officer of a court without the patient’s express consent, unless it is required by law or can be justified in the public interest.

Disclosing information with consent

Seeking a patient’s consent to disclosure of information shows respect and is part of good communication between doctors and patients.

Circumstances in which patients may give implied consent to disclosure.

Sharing information within the healthcare team or with others providing care

Most people understand and accept that information must be shared within healthcare teams, in order, to provide their care.

You should make sure that patients are aware that personal information about them will be shared within the healthcare team (including administrative and other supporting staff) unless they object. Generating awareness can take a number of forms (e.g. leaflets, posters, websites and face-to-face) but should be tailored to the patients’ identified needs wherever practicable.

You must respect the wishes of any patient who objects to, particular, information being shared within the healthcare team or others providing care, unless disclosure would be justified in the public interest.

Should a patient object to a disclosure that is, considered to be essential to the provision of safe care, it should be explained to them that unless that information is disclosed, they cannot be referred, nor can their treatment be arranged.

You must make sure that anyone to whom you disclose personal information understands that it is given to them in confidence, which they must respect.

All staff members receiving personal information, in order, to provide or support care are bound by a legal duty of confidence, whether or not they have contractual or professional obligations to protect confidentiality.

Circumstances may arise where a patient cannot be informed about the disclosure of information, for example because of a medical emergency. In these cases, you must pass relevant information promptly to those providing the patient’s care.

As and when the patient is capable of understanding, they should be informed how their personal information was disclosed, if it was in a way they would not reasonably expect.

Local clinical audit

Clinical audit is essential to the provision of good care.

All doctors in clinical practice have a duty to participate in clinical audit and to contribute to National Confidential Inquiries.

Where an audit is to be undertaken by the team which provided care, or those working to support them, such as clinical audit staff, you may disclose identifiable information, provided you are satisfied that the patient:

• Has ready access to information which explains that their information may be disclosed for local clinical audit, and that they have the right to object; and
• Has not objected.

If a patient does object, you should explain why information is needed and how this may benefit their care. If it is not possible to provide safe care without disclosing information for audit, you should explain this to the patient and the options open to them.

Where clinical audit is to be undertaken by another organisation, information should be anonymised or coded wherever that is practicable. If this is not practicable, or anonymised data will not fulfil the requirements of the audit, identifiable data should be disclosed only if the patient’s express consent has been obtained.

Disclosures for which express consent should be sought.

Express consent is generally needed before the disclosure of identifiable information for purposes such as financial audit and insurance or benefit claims.

Should you be asked to provide information to third parties, (e.g. a patient’s insurer or employer, a government department or an agency assessing a claimant’s entitlement to benefits), either following an examination or from existing records, you should:

• Be satisfied that the patient has sufficient information about the scope, purpose and likely consequences of the examination and disclosure, and the fact that relevant information cannot be concealed or withheld.
• Obtain or have seen written consent to the disclosure from the patient or a person properly authorised to act on the patient’s behalf.
• You may accept an assurance from an officer of a government department or agency or a registered health professional acting on their behalf that the patient or a person properly authorised to act on their behalf has consented.
• Only disclose factual information you can substantiate, presented in an unbiased manner, relevant to the request; so, you should not usually disclose the whole record, although it may be relevant to some benefits paid by government departments and to other assessments of patients’ entitlement to pensions or other health-related benefits.
• Offer to show your patient, or give them a copy of, any report you write about them for employment or insurance purposes before it is sent, unless:
  • They have already indicated they do not wish to see it.
  • Disclosure would be likely to cause serious harm to the patient or anyone else.
  • Disclosure would be likely to reveal information about another person who does not consent.

If a patient refuses consent, or if it is not practicable to get their consent, disclosure may still be made provided it is required by law or can be justified in the public interest. Where the purpose is covered by a regulation made under section 251 of the NHS Act 2006, disclosures can also be made without a patient’s consent, but not if the patient has objected.

The public interest

Disclosures in the public interest

Confidential medical care is recognised in law as being in the public interest. However, there can also be a public interest in disclosing information:

• To protect individuals or society from risks of serious harm, such as serious communicable diseases or serious crime; or
• To enable medical research, education or other secondary uses of information that will benefit society over time.

Personal information may be disclosed in the public interest, without the patient’s consent, and in exceptional cases where patients have withheld consent, where the benefits to an individual or to society of the disclosure outweigh the public and the patient’s interest in keeping the information confidential.

In all cases where you consider disclosing information without consent from the patient, you must weigh the possible harm (both to the patient, and the overall trust between doctors and patients) against the benefits which are likely to arise from the release of information.

Before considering whether a disclosure of personal information ‘in the public interest’ would be justified, you must be satisfied that identifiable information is necessary for the purpose, or that it is not practicable to anonymise or code it.

In such cases you should still try to seek patients’ consent, unless it is not practicable to do so, for example because:

• The patients are not competent to give consent (in which case you should consult the patient’s welfare attorney, court-appointed deputy, guardian or the patient’s relatives, friends or carers); or
• You have reason to believe that seeking consent would put you or others at risk of serious harm.
• Seeking consent would be likely to undermine the purpose of the disclosure, (e.g. by prejudicing the prevention or detection of serious crime, or
• Action must be taken quickly (for example in the detection or control of outbreaks of some communicable diseases) and there is insufficient time to contact patients.

You should inform a patient that a disclosure will be made in the public interest, even if you have not sought consent, unless to do so:

• Is impracticable; or
• Would put you or others at risk of serious harm; or
• Would prejudice the purpose of the disclosure.

You must document in the patient’s record:

• Your reasons for disclosing information without consent; and
• Any steps you have taken to seek their consent to inform them about the disclosure or your reasons for not doing so.

Research and other secondary uses

Research, epidemiology, public health surveillance, health service planning, and education and training are among the important secondary uses made of patient information, each serving important public interests.

For many secondary uses, it will be sufficient and practicable to disclose only anonymised or coded information. When identifiable information is needed, or it is not practicable to remove identifiable information, it will often be perfectly practicable to get patients’ express consent.

You may disclose identifiable information without consent if it is required by law, if it is approved under section 251 of the NHS Act 2006, or if it can be justified in the public interest and it is either:

• Necessary to use identifiable information, or
• Not practicable to anonymise or code the information.

and, in either case, not practicable to seek consent (or efforts to seek consent have been unsuccessful).

In considering whether it is practicable to seek consent you must take account of:

• The age of records and the likely traceability of patients.
• The number of records; and
• The possibility of introducing bias because of a low response rate or because particular groups of patients refuse, or do not respond to, requests to use their information.

When considering whether the public interest in disclosures for secondary uses outweighs patients’ and the public interest in keeping the information confidential, you must consider:

• The nature of the information to be disclosed.
• What use will be made of the information.
• How many people will have access to the information.
• The confidentiality and security arrangements in place to protect the information from further disclosure.
• The advice of the Caldicott Guardian or similar expert adviser, who is not directly connected with the use for which disclosure is being considered, and
• The potential for distress or harm to patients.

When considering applications for support under section 251 of the NHS Act 2006 in England and Wales, the National Information Governance Board considers:

• The feasibility of doing the research or other activity with patients’ consent or by using anonymised or coded information, and
• Whether the use of identifiable information would benefit patients or the public sufficiently to outweigh patients’ right to privacy.

It might not be practicable for the healthcare team, or those who usually support them, to anonymise or code information or to seek patients’ express consent:

• For the disclosure of identifiable information for important secondary uses, or
• So that suitable patients can be recruited to clinical trials or other approved research projects.

If that is the case:

• Identifiable information may be sent to a ‘safe haven’, where they exist and have the capabilities and are otherwise suitable to process the information (including anonymising or coding it) and to manage the disclosure of information for secondary uses; or, if that is not practicable.
• The task of anonymising or coding the information or seeking patients’ consent to disclosure can be delegated to someone incorporated into the healthcare team on a temporary basis and bound by legal and contractual obligations of confidentiality.

You should only disclose identifiable information for research if that research is approved by a Research Ethics Committee. You should alert Research Ethics Committees to disclosures of identifiable information without consent when applying for approval for research projects.

Disclosures to protect the patient.

It may be appropriate to encourage patients to consent to disclosures you consider necessary for their protection, and to warn them of the risks of refusing to consent; but you should usually abide by a competent adult patient’s refusal to consent to disclosure, even if their decision leaves them, but nobody else, at risk of serious harm.

You should do your best to provide patients with the information and support they need to make decisions in their own interests (e.g. by arranging contact with relevant external agencies or organisations).

Disclosure without consent may be justified if it is not practicable to seek a patient’s consent. 

Disclosure to protect others.

Disclosure of personal information about a patient without consent may be justified in the public interest if failure to disclose may expose others to a risk of death or serious harm. You should still seek the patient’s consent to disclosure if practicable and consider any reasons given for refusal.

Such a situation might arise, for example, when a disclosure would be likely to assist in the prevention, detection, or prosecution of serious crime, especially crimes against the person. When victims of violence refuse police assistance, disclosure may still be justified if others remain at risk, (e.g. from someone who is prepared to use weapons, or from domestic violence when children or others may be at risk).

If a patient’s refusal to consent to disclosure leaves others exposed to a risk so serious that it outweighs the patient’s and the public interest in maintaining confidentiality, or if it is not practicable or safe to seek the patient’s consent, you should disclose information promptly to an appropriate person or authority. You should inform the patient before disclosing the information, if practicable and safe, even if you intend to disclose without their consent.

You should participate in procedures set up to protect the public from violent and sex offenders and co-operate with requests for relevant information about patients who may pose a risk of serious harm to others.

Disclosures about patients who lack capacity to consent.

When making decisions about whether to disclose information about a patient who lacks capacity, you must:

• Make the care of the patient your first concern.
• Respect the patient’s dignity and privacy, and
• Support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information.

You must also consider:

• Whether the patient’s lack of capacity is permanent or temporary and, if temporary, whether the decision to disclose could reasonably wait until they regain capacity.
• Any evidence of the patient’s previously expressed preferences.
• The views of anyone the patient asks you to consult, or who has legal authority to make a decision on their behalf or has been appointed to represent them.
• The views of people close to the patient on the patient’s preferences, feelings, beliefs and values, and whether they consider the proposed disclosure to be in the patient’s best interests, and
• What you and the rest of the healthcare team know about the patient’s wishes, feelings, beliefs and values.

If a patient who lacks capacity asks you not to disclose personal information about their condition or treatment, you should try to persuade them to allow an appropriate person to be involved in the consultation.

Should they refuse, and you are convinced that it is essential in their best interests, you may disclose relevant information to an appropriate person or authority.

In such a case you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer, documenting in the patient’s record your discussions and the reasons for deciding to disclose the information.

Although you may need to share personal information with a patient’s relatives, friends or carers to enable you to assess the patient’s best interests, this does not mean they have a general right of access to the patient’s records or to have irrelevant information (e.g. about the patient’s past healthcare).

You should also share relevant personal information with anyone who is authorised to make decisions on behalf of, or who is appointed to support and represent, a mentally incapacitated patient.

Disclosures when a patient may be a victim of neglect or abuse.

If you believe that a patient may be a victim of neglect or physical, sexual or emotional abuse, and that they lack capacity to consent to disclosure, you must give information promptly to an appropriate responsible person or authority, if you believe that the disclosure is in the patient’s best interests or necessary to protect others from a risk of serious harm.

If you believe that disclosure of information is not in the best interests of a neglected or abused patient, you should discuss the issues with an experienced colleague.

In the event you decide not to disclose information, you should document in the patient’s record your discussions and the reasons for deciding not to disclose and be prepared to justify your decision.

Notifying the CQC of allegations of abuse

Dr Talib Abubacker at the Practice is responsible for notifying the CQC without delay about allegations of abuse including:

• Any suspicion, concern or allegation from any source that a person using the service has been or is being abused, or is abusing another person (of any age), including:
  • Details of the possible victim(s), where this is known, including:
  • A unique identifier or code for the person.
  • The date they were or will be admitted to the service.
  • Their date of birth.
  • Their gender.
  • Their ethnicity.
  • Any disability.
  • Any religion or belief.
  • Their sexual orientation.
  • All relevant dates and circumstances, using unique identifiers and codes where relevant.
  • Anything you have already done about the incident.
  • A unique identifier or code for the actual or possible abusers, together with, where it is known:
  • The personal information listed above.
  • Their relationship to the abused person
•  A unique identifier or code for any person who has or may have been abused by a person using the service, together with (where known):
  • The same personal information listed in above.
  • Their relationship to the abused person
• The person who originally expressed the suspicion, concern or allegation (using a unique identifier or code).

In relation to where the alleged or possible victim of abuse is a child or young person under 18 years, the notification must include details of the allegation, including:

• Any relevant dates, witnesses (using unique identifiers or codes) and circumstances.
• The date the allegation was notified to the police, local safeguarding children board and the strategic health authority (where appropriate).
• The type of abuse (using the categories in the Department for Children, Families and Schools document Working Together).
• Anything the registered person has done as a result of the allegation.

Where the Registered Person is unavailable, for any reason, Mel Quinn will be responsible for reporting the allegation to the CQC.

There is a dedicated Notification form for this type of incident. It can be found here: Paper Allegation of Abuse Notification for Publication

Sharing information with a patient’s partner, carers, relatives or friends

Early discussions with the patient (especially if the patient has fluctuating or diminished capacity or is likely to lose capacity, even temporarily) should try to establish what information they want you to share, who with, and in what circumstances. Such discussions can help to avoid disclosures that a patient would object to and misunderstandings with, or causing offence to, anyone the patient would want information to be shared with.

If a patient lacks capacity, you should share relevant information in accordance with the advice in the Section “Disclosure about patients who lack capacity to consent”.

Unless they indicate otherwise, it is reasonable to assume that a patient would want those closest to them to be kept informed of their general condition and prognosis.

In the event someone close to the patient wishes to discuss their concerns about the patient’s health, you should make it clear to them that, while it is not a breach of patient confidentiality to listen to their concerns, you cannot guarantee that you will NOT tell the patient about the conversation (e.g. you might need to share with a patient information you have received from others, if it has influenced your assessment and treatment of the patient).

You should not refuse to listen to a patient’s partner, carers or others on the basis of confidentiality, as the information they provide might help in your care of the patient.

However, you will need to evaluate whether your patient would consider you listening to the concerns of others about their health or care to be a breach of trust, particularly if they have asked you not to listen to specific people.

Genetic and other shared information

Genetic and some other information about your patient might also be information about others the patient shares genetic or other links with (e.g. the diagnosis of an illness in the patient might point to the certainty or likelihood of the same illness in a blood relative).

Most patients will readily share information about their own health with their children and other relatives, particularly if they are advised that it might help those relatives to:

• Get prophylaxis or other preventative treatments or interventions.
• Make use of increased surveillance or other investigations; or
• Prepare for potential health problems.

However, should a patient refuse to consent to the disclosure of information that would benefit others, (e.g. where family relationships have broken down, or if their natural children have been adopted), disclosure might still be justified in the public interest.

If a patient refuses consent to disclosure, you will need to balance your duty to make the care of your patient your first concern against your duty to help protect the other person from serious harm. If practicable, you should not disclose the patient’s identity in contacting and advising others of the risks they face.

Disclosure after a patient’s death

The duty of confidentiality continues after a patient has died.

Whether and what personal information may be disclosed after a patient’s death will depend on the circumstances:

• If the patient had asked for information to remain confidential, you should usually respect their wishes.
• If you are unaware of any instructions from the patient, when you are considering requests for information you should take into account:
  • Whether the disclosure of information is likely to cause distress to, or be of benefit to the patient’s partner or family;
  • Whether the disclosure will also disclose information about the patient’s family or anyone else;
  • Whether the information is already public knowledge or can be anonymised or coded; and
  • The purpose of the disclosure.

There are circumstances in which you should disclose relevant information about a patient who has died, for example:

• To help a coroner or other similar officer with an inquest or fatal accident inquiry.
• When disclosure is required by law, is authorised under section 251 of the NHS Act 2006, or is justified in the public interest, (e.g. for education or research);
• For national confidential inquiries or for local clinical audit.
• On death certificates (which you must complete honestly and fully).
• For public health surveillance (the information should be anonymised or coded unless that would defeat the purpose).
• When a parent asks for information about the circumstances and causes of a child’s death.
• When a partner, close relative or friend asks for information about the circumstances of an adult’s death, and there is no reason to believe that the patient would have objected to such a disclosure; and
• When a person has a right of access to records under the Access to Health Records Act 1990

Archived records relating to deceased patients remain subject to a duty of confidentiality, although the potential for disclosing information about, or causing distress to surviving relatives or damaging the public’s trust will diminish over time.

Reporting the Death of a Patient to the CQC

All registered providers of primary medical services must notify certain deaths to CQC. Notifications must be submitted directly to CQC. The law does not allow providers of primary medical services to notify CQC via the NHS National Reporting and Learning System (NRLS).

However, not all deaths have to be notified.

The Health and Social Care Act (2008) requires that deaths must be notified if the death would not have happened if the person had been receiving appropriate care and treatment and either:

• The death occurred while a person was actually receiving a regulated activity from or at the GP practice (including in a person’s own home, for example during a home visit)
• The death occurred, or may have occurred, as a result of regulated activity having been provided by your GP practice in the two weeks before the person died.

Such an incident would be classed as a significant event and these notifications must be submitted without delay.

There is a dedicated notification form to report such deaths. 

Dr Talib Abubacker at the Practice is responsible for notifying the CQC immediately upon the death of a person who uses the Practice’s services.

Where the Registered Person is unavailable, for any reason, Mel Quinn will be responsible for reporting the death to the CQC.

(Please note: this form should not be used for reporting the death of a person detained or liable to be detained under the Mental Health Act 1983.)

Glossary

This defines the terms used within this document. These definitions have no wider or legal significance.

Personal Information: Information about people which doctors learn in a professional capacity and from which individuals can be identified.

Anonymised Information: Information from which individuals cannot reasonably be identified. Names, addresses, full postcodes or identification numbers, alone or together or in conjunction with any other information held by or available to the recipient, can be used to identify patients.

Coded Information: Also known as pseudonymised information. Information from which individuals cannot be identified by the recipient, but which enables information about different patients to be distinguished or to link information about the same patients over time (for example, to identify drug side effects). A ‘key’ might be retained by the person or service which coded the information so that it can be reconnected with the patient.

Identifiable Information: Information from which a patient can be identified. Their name, address and full postcode will identify a patient; combinations of information may also do so, even if their name and address are not included. Information consisting of small numbers and rare conditions might also lead to the identification of an individual.

Consent: Agreement to an action based on knowledge of what the action involves and its likely consequences.

Express Consent: Consent which is expressed orally or in writing. Also known as explicit consent.

Implied Consent: Consent that can be inferred if the patient has been informed that information is to be disclosed, the purpose and extent of the disclosure, and that they have a right to object, but have not objected.

Other Terms

Clinical Audit: Evaluation of clinical performance against standards or through comparative analysis, to inform the management of services.

Disclosure: The provision or passing of information about a patient to anyone other than the patient, regardless of the purpose. Sharing information within healthcare teams is a form of disclosure, as is providing personal information about a patient to the police.

Healthcare Team: The healthcare team comprises the people providing clinical services for a patient, and the administrative and other staff who support the provision of their care.

Public Interest: The interests of the community as a whole, or a group within the community or individuals. Paragraphs 36 and 37 give an explanation of the balancing exercise required to decide if disclosure might be justified in the public interest.

Source: Confidentiality Guidance for Doctors: GMC 2009

Supplementary Guidance

The GMC has also published guidance which explains how the principles described in this document apply in the following situations which doctors often encounter or may find hard to deal with:

• Reporting concerns about patients to the DVLA.
• Disclosing records for financial and administrative purposes.
• Disclosing information about serious communicable diseases.
• Disclosing information for insurance, employment and similar purposes.
• Disclosing information for education and training purposes.
• Responding to criticism in the press.
• Reporting gunshot and knife wounds.

Click on a title to view the contents of that document.

Reporting concerns about patients to the DVLA

The Driver and Vehicle and Licensing Agency (DVLA) is legally responsible for deciding if a person is medically unfit to drive. This means it needs to know if a driving licence holder has a condition or is undergoing treatment that may now, or in the future, affect their safety as a driver.

You should seek the advice of an experienced colleague or the DVLA’s medical adviser if you are not sure whether a patient may be unfit to drive. You should keep under review any decision that they are fit, particularly if the patient’s condition or treatments change.

The DVLA’s publication “For Medical Practitioners: At a glance Guide to the current Medical Standards of Fitness to Drive” includes information about a variety of disorders and conditions that can impair a patient’s fitness to drive.

The driver is legally responsible for informing the DVLA about such a condition or treatment.

However, if a patient has such a condition, you should explain to the patient:

• That the condition may affect their ability to drive (if the patient is incapable of understanding this advice, for example, because of dementia, you should inform the DVLA immediately), and
• That they have a legal duty to inform the DVLA about the condition.

If a patient refuses to accept the diagnosis, or the effect of the condition on their ability to drive, you can suggest that they seek a second opinion, and help arrange for them to do so. You should advise the patient not to drive in the meantime.

If a patient continues to drive when they may not be fit to do so, you should make every reasonable effort to persuade them to stop. As long as the patient agrees, you may discuss your concerns with their relatives, friends or carers.

If you do not manage to persuade the patient to stop driving, or you discover that they are continuing to drive against your advice, you should contact the DVLA immediately and disclose any relevant medical information, in confidence, to the medical adviser.

Before contacting the DVLA you should try to inform the patient of your decision to disclose personal information.

You should then also inform the patient in writing once you have done so.

Disclosing records for financial and administrative purposes

If you are responsible for the management of patient records or other patient information, you should make sure that financial and administrative information is recorded separately from clinical information.

If you are asked to disclose information about patients for financial or administrative purposes you should, if practicable, provide it in anonymised or coded form, if that will serve the purpose. If identifiable information is needed, you should, if practicable, seek the patient’s express consent before disclosing it

You must draw attention to any system that prevents you from following this guidance and recommend change. Until changes are made, you should make sure that information is readily available to patients explaining that their personal information may be disclosed for financial, administrative, and similar purposes, and what they can do if they object.

If a patient asks, you should explain the nature and purpose of disclosures made for financial and administrative purposes. You should do your best to act on any objections. If you are satisfied that it is not possible to comply with the patient’s wishes, and still provide care, you should explain this to the patient and explain their options.

You should satisfy yourself that anyone who will have access to the information is bound by a duty of confidentiality not to disclose it further.

Disclosure may be required by law in some cases, for example, in the investigation of fraud by the NHS Counter Fraud Service or approved under section 251 of the NHS Act 2006.

For more information on commissioners’ access to personal information held by general practices for purposes such as Quality and Outcomes Framework reviews, see the relevant Confidentiality and Disclosure of Information Directions and Code of Practice.

Disclosing information about serious communicable diseases

Confidentiality is important to all patients. Those who have, or may have, a serious communicable disease might be particularly concerned about their privacy.

You should make sure that information you hold or control about a patient’s infection status is always effectively protected against improper disclosure.

All patients are entitled to good standards of care, regardless of their status, what disease they might have, or how they acquired it.

Healthcare workers who have, or may have, a serious communicable disease.

Good Medical Practice states that:

You should protect your patients, your colleagues and yourself by being immunised against common serious communicable diseases where vaccines are available.

If you know that you have, or think that you might have, a serious condition that you could pass on to patients, or if your judgement or performance could be affected by a condition or its treatment, you must consult a suitably qualified colleague.

You must ask for and follow their advice about investigations, treatment, and changes to your practice that they consider necessary. You must not rely on your own assessment of the risk you pose to patients.

You should raise any reasonable concern you have about any healthcare worker who has a serious communicable disease and practises, or has practised, in a way that places patients at risk of infection.

You should inform the healthcare worker’s employing or contracting body of your concerns, preferably through its occupational health service or, where appropriate, their regulatory body. You should inform the healthcare worker before passing the information on, as long as it is practicable and safe to do so.

For more advice on colleagues who might pose a risk to patients, see Raising concerns about patient safety.

Patients who are diagnosed with a serious communicable disease.

You should make sure information is readily available to patients explaining that personal information about them will be shared within the healthcare team, including administrative and other staff who support the provision of care, unless they object, and why this is necessary.

If a patient refuses to allow you to inform someone outside the healthcare team of their infection status, you must respect their wishes unless you consider that failure to disclose the information will put healthcare workers or other patients at risk of infection. But such situations are likely to be very rare, not least because of the use of universal precautions to protect healthcare workers and patients, particularly during exposure-prone procedures.

You should explain to patients how they can protect others from infection, including the practical measures they can take to avoid transmission, and the importance of informing sexual contacts about the risk of transmission of sexually transmitted serious communicable diseases.

Informing sexual contacts of patients with a serious communicable disease

You may disclose information to a known sexual contact of a patient with a sexually transmitted serious communicable disease if you have reason to think that they are at risk of infection and that the patient has not informed them and cannot be persuaded to do so.

In such circumstances, you should tell the patient before you make the disclosure, if it is practicable and safe to do so. You must be prepared to justify a decision to disclose personal information without consent.

When you are tracing contacts and notifying partners, you should not disclose the identity of the patient, if practicable.

Children and young people

Your patient must be your first concern; but you should also consider and act in the best interests of your patient’s children.

Most patients with a serious communicable disease who are parents or care for children will do all they can to protect those children from the risk of infection or the effects of the disease. You should make sure that the patient understands the information and advice you provide, which should be tailored to their needs.

You should do all you reasonably can to support them in caring for themselves and in protecting their children.

You should explain to a patient with a serious communicable disease the importance of testing any children who may already be infected, including children without symptoms and young people who might have been vertically infected with a blood-borne virus.

If you are concerned that a child is at risk of serious harm because their parents cannot be persuaded to protect them from the risk of infection, or because they refuse to allow the child to be tested, you should seek legal advice about whether to apply to court for a determination on the child’s best interests.

See 0-18 years: guidance for all doctors for more information about confidentiality and consent in respect of children and young people and about child protection, which is a responsibility of all doctors.

Injuries to healthcare workers and others

You should make sure that a risk assessment is made urgently by an appropriately qualified colleague if a healthcare worker, police officer or anyone else suffers a needlestick or similar injury involving a patient who has, or may have, a serious communicable disease.

Post-exposure prophylaxis should be offered in accordance with that risk assessment, which should include consideration of the type of body fluid or substance involved, and the route and severity of the exposure.

You should ask for the patient’s consent to disclose their infection status after exposure to a serious communicable disease. If the patient cannot be persuaded to consent to disclosure, or if it is not safe or practicable to ask for their consent, you may disclose information in the public interest. This could be, for example, if the information is needed for decisions about the continued appropriateness of post-exposure prophylaxis.

Recording serious communicable diseases on death certificates

If a serious communicable disease has contributed to the cause of death, you must record this on the death certificate.

Serious communicable disease control and surveillance

You should pass information about serious communicable diseases to the relevant authorities for the purpose of communicable disease control and surveillance. You should use anonymised or coded information, if practicable and, as long as, it will serve the purpose.

Endnotes

In this guidance the term ‘serious communicable disease’ applies to any disease that can be transmitted from human to human and that can result in death or serious illness. It particularly applies to, but is not limited to, HIV, tuberculosis, and hepatitis B and C.

The NHS (Venereal Diseases) Regulations 1974, The NHS Trusts (Venereal Diseases) Directions 1991 and The NHS Trusts and Primary Care Trusts (Sexually Transmitted Diseases) Directions 2000 state that various NHS bodies in England and Wales must:

‘take all necessary steps to secure that any information capable of identifying an individual… with respect to persons examined or treated for any sexually transmitted disease shall not be disclosed except –

• For the purpose of communicating that information to a medical practitioner, or to a person employed under the direction of a medical practitioner in connection with the treatment of persons suffering from such disease or the prevention of the spread thereof, and
• For the purpose of such treatment and prevention’.

There are different interpretations of the Regulations and Directions, and concerns about their compatibility with the European Convention on Human Rights. In particular, there have been concerns that a strict interpretation would prevent the disclosure of relevant information, except to other doctors or those working under their supervision, even with the patient’s consent or to known sexual contacts in the public interest.

The GMC view is that the Regulations and Directions do not preclude disclosure if it would otherwise be lawful at common law, for example with the patient’s consent or in the public interest without consent.

Disclosing information for insurance, employment and similar purposes

The first duty of a doctor registered with the GMC is to make the care of their patient their first concern. The term ‘patient’ in this guidance also refers to employees, clients, athletes and anyone else whose personal information you hold or have access to, whether or not you care for them in a traditional therapeutic relationship.

There are many circumstances in which a doctor might be asked to disclose information, either following an examination of a patient or from existing records, and in which they face ‘dual obligations’.

Usually, dual obligations arise when a doctor works for, is contracted by, or otherwise provides services to:

• A patient’s employer (as an occupational health doctor)
• An insurance company
• An agency assessing a claimant’s entitlement to benefits.
• The police (as a police surgeon)
• The armed forces
• The prison service, or
• A sports team or association.

Alternatively, a person or organisation you have previously had no direct relationship with, such as your patient’s employer or insurance company, might ask you to provide a medical report or information about a patient. You might be offered payment for your own or your staff’s time and effort, giving rise to an obligation in addition to the one you have to your patient.

Extent of the disclosure

You should disclose only information relevant to the request for disclosure, which means you should not usually disclose a patient’s whole record. Exceptions to this general rule include benefit claims and litigation.

The whole record may be relevant to some benefits paid by government departments or agencies.

A solicitor may need to see their client’s whole record to assess which parts are relevant, for example, to personal injury claims. If the claim goes ahead, the person the claim is made against may ask for copies of important documents, which could include records containing the patient’s medical history. Under court rules in England and Wales, they can see all the patient’s health records. The solicitor should explain this to the patient.

Writing reports

When writing a report, you must:

• Do your best to make sure that it is not false or misleading; you must take reasonable steps to verify the information in the report and must not deliberately leave out any relevant information.
• Complete and send the report without unreasonable delay.
• Restrict the report to areas in which you have direct experience or relevant knowledge, and
• Make sure that any opinion you include is balanced and be able to state the facts or assumptions on which it is based.

Endnotes

If any of the exceptions apply, you should still disclose as much of the report as you can. The Department for Work and Pensions publishes further advice about reports for benefits purposes (see www.dwp.gov.uk/healthcare-professional/ guidance).

Doctors might provide their services to professional sports clubs (where the dual obligation is to both the patient and the club, which is very similar to the dual obligation of an occupational health doctor) or to associations (where the dual obligation is both to the patient and to a governing body or team of selectors).

Disclosing information for education and training purposes

The use of information about patients is essential to the education and training of medical and other healthcare students and trainees. For most of these uses, anonymised information will be sufficient and should be used whenever practicable.

When it is necessary to use identifiable information about a patient, or it is not practicable to anonymise information, you should seek the patient’s consent before disclosing it. You should make sure that the patient is under no pressure to consent. In particular, you should avoid any impression that their care depends on giving consent.

Publishing case studies

It may be difficult to anonymise case studies about patients while retaining enough detail to make publication useful. Simply changing a patient’s name will often not anonymise the information if other identifying details are included, such as age, sex, location or a detailed account of the patient’s illness and treatment.

If you cannot anonymise the information, you should seek the patient’s consent before disclosing it. When seeking the patient’s consent, you must provide them with enough information about the nature and purpose of the disclosure to enable them to make an informed decision. This should include a description of the information to be disclosed and an indication of how it will be used, for example, whether it will be published in a journal or shown at a medical conference.

You must then disclose that information only for the purposes for which the patient has given consent.

If for any reason you cannot get a patient’s consent, for example, because the information you want to disclose is so old that efforts to trace the patient have been or are likely to be unsuccessful, you will need to consider whether publication can be justified in the public interest.

You should respect a patient’s refusal to consent to publication of their identifiable information.

Teaching and training

Most patients understand and accept that the education and training of medical and other healthcare students and trainees relies on their having access to information about patients.

If trainees are part of the healthcare team providing or supporting a patient’s care, they can have access to the patient’s personal information like other team members, unless the patient objects.

If students need access to a patient’s personal information, but are not providing or supporting the patient’s care, anonymised information should be used whenever possible. This may not be practicable when they are directly involved in the provision of care, for example, on ward rounds, but it will then usually be practicable to seek the patient’s express consent to disclosure.

It might be necessary to disclose personal information, or not be practicable to anonymise it, and also not be practicable to seek a patient’s express consent to disclosure. However, if information has been made readily available to the patient about the disclosure and of their right to object, and they have not objected, you may disclose personal information necessary for the education of medical and other healthcare students.

School and college students

Doctors are sometimes asked to provide work experience for secondary school or further education college students, which may include allowing them to be present during consultations with patients. You should seek the patient’s express consent to a student observing their care.

You should make sure that the student understands the importance of respecting confidentiality and that their school or college takes seriously its responsibilities for its students’ conduct.

You should also satisfy yourself that the student’s presence does not adversely affect the patient’s care, for example, by inhibiting frank discussion.

Patients who lack capacity

You should not disclose personal information for education and training purposes about patients who lack capacity if you can practicably use information about other patients instead.

If you wish to disclose personal information about a patient who lacks capacity but who is likely to regain capacity, you should, if practicable, wait and seek their consent later.

You may disclose personal information about a patient who lacks capacity to consent if disclosure will benefit or is in the best interests of the patient, or if it is justified in the public interest.

If you are asked, or want, to disclose information about a patient who lacks capacity, you should seek the views of anyone the patient asks you to consult, or who has legal authority to make decisions on their behalf, or who has a close personal relationship with the patient.

They may be able to give you an indication of the patient’s previously expressed preferences, views and beliefs.

In the absence of any indication about the preferences of a patient who lacks capacity:

• You should not publish information from which they can be identified, but
• You may disclose personal information to medical and other healthcare students and trainees to the extent necessary for their education and training.

Endnotes

You should consider whether the work needed to anonymise or code the information or to seek patients’ consent is reasonably practicable in all the circumstances.

Only if unreasonable effort is required should you go on to consider whether disclosure of identifiable information is justified in the public interest.

If it is not practicable to anonymise or code the information or to seek or obtain patients’ consent without unreasonable effort, and the likelihood of distress or harm to patients is negligible, disclosure for an important secondary purpose may be proportionate. You should respect patients’ objections to disclosure.

In this context ‘trainees’ refers to registered medical practitioners in training grades, while ‘students’ refers to undergraduates pursuing a medical degree.

You must give patients the information they want or need about the extent to which students may be involved in their care, and of their right to refuse to take part in teaching.

Welfare attorneys, court-appointed guardians and court appointed deputies have legal authority to make some decisions on a patient’s behalf. In the context of public interest disclosures, you will be seeking their views about the patient’s preferences, rather than their consent to disclose.

Responding to criticism in the press

Doctors are sometimes criticised in the press by their patients or by someone their patients have a close personal relationship with. The criticism can include inaccurate or misleading details of the doctor’s diagnosis, treatment or behaviour.

Although this can be frustrating or distressing, it does not relieve you of your duty to respect your patient’s confidentiality. Disclosures of patient information without consent can undermine the public’s trust in the profession as well as your patient’s trust in you. You must not put information you have learned in confidence about a patient in the public domain without that patient’s express consent.

Disputes between patients and doctors conducted in the media often serve no practical purpose; they can prolong or intensify conflict and may undermine public confidence in the profession, even if they do not involve the disclosure of personal information without consent.

You should usually limit your public response to press reports to an explanation of your legal and professional duty of confidentiality.

However, from time to time, press reports might cause patients to be concerned about your practice, or that of a health service you are associated with. In such cases it may be appropriate to give general information about your normal practice. You must be careful not to reveal personal information about a patient, or to give an account of their care, without their consent.

If you deny allegations that appear in the press, you must be careful not to reveal, directly or by omission or inference, any more personal information about the patient than a simple denial demands.

You should seek advice from your professional or defence body, or from a solicitor, on how to respond to press criticism and, if appropriate, any legal redress available to you.

Endnote

In this guidance, ‘patient’ is used to refer to both current and former patients.

Reporting gunshot and knife wounds

The guidance in confidentiality applies to all violent crime, but gunshot and knife wounds raise issues that warrant special consideration. That is not to suggest that information should not be disclosed to assist in the prevention, detection or prosecution of other serious crime.

This guidance describes a two-stage process:

• You should inform the police quickly whenever a person arrives with a gunshot wound or an injury from an attack with a knife, blade or other sharp instrument. This will enable the police to make an assessment of risk to the patient and others, and to gather statistical information about gun and knife crime in the area
• You should make a professional judgement about whether disclosure of personal information about a patient, including their identity, is justified in the public interest.

Reporting gunshot and knife wounds

The police are responsible for assessing the risk posed by a member of the public who is armed with, and has used, a gun or knife in a violent attack.

They need to consider:

• The risk of a further attack on the patient
• The risk to staff, patients and visitors on the practice premises, and
• The risk of another attack near to, or at, the site of the original incident.

For this reason, the police should be informed whenever a person arrives at the Practice with a gunshot wound. Even accidental shootings involving lawfully held guns raise serious issues for the police about, for example, gun licensing.

The police should also be informed when a person arrives at a hospital with a wound from an attack with a knife, blade or other sharp instrument.

The police should not usually be informed if a knife or blade injury is accidental, or a result of self-harm. If you are in doubt about the cause of the injury, you should if possible, consult an experienced colleague.

Quick reporting at this stage may help prevent further incidents or harm to others. If you have responsibility for the patient, you should make sure that the police are contacted, but you can delegate this task to another member of staff.

Personal information, such as the patient’s name and address, should not usually be disclosed in the initial contact with the police. The police will respond even if the patient’s identity is not disclosed. The police need to be informed quickly in order, to respond to the risk to patients, staff and the public. They also need statistical information about the number of gunshot and knife injuries, and when and where they occur, to inform their own and their crime reduction partners’ operational and strategic priorities.

Making the care of the patient your first concern

When the police arrive, you should not allow them access to the patient if this will delay or hamper treatment or compromise the patient’s recovery.

If the patient’s treatment and condition allow them to speak to the police, you or another member of the healthcare team should ask the patient whether they are willing to do so. If they are not, you should explain what the consequences, if any, might be. You, the rest of the healthcare team, and the police must abide by the patient’s decision.

Disclosing personal information without consent

If it is probable that a crime has been committed, the police will ask for more information. If the patient cannot give consent because, for example, they are unconscious, or refuses to disclose information or to allow you or your colleagues to do so, you can still disclose information if it is required by law or if you believe it is justified in the public interest.

Disclosures in the public interest may be justified when:

• Failure to disclose information may put the patient, or someone else, at risk of death or serious harm, or
• Disclosure is likely to help in the prevention, detection or prosecution of a serious crime.

If there is any doubt about whether disclosure without consent is justified, the decision should be made by, or with the agreement of, the consultant in charge, or the trust’s Guardian.

If practicable, you should seek the patient’s consent to the disclosure, or tell them that a disclosure has been made unless, for example, that:

• May put you or others at risk of serious harm, or
• Would be likely to undermine the purpose of the disclosure, by prejudicing the prevention, detection or prosecution of a crime.

You must document in the patient’s record your reasons for disclosing information without consent and any steps you have taken to seek their consent, to inform them about the disclosure, or your reasons for not doing so.

If there is no immediate public interest reason for disclosing personal information, no further information should be given to the police. The police may seek an order from a judge or a warrant for the disclosure of confidential documents.

You should tell those responsible for the continuing care of the patient that further discussion with the patient is needed to ensure, for example, that they are fit to hold a firearms licence.

Children and young people

Any child or young person under 18 arriving with a gunshot wound or a wound from an attack with a knife, blade or other sharp instrument will raise obvious child protection concerns. You must inform an appropriate person or authority promptly of any such incident.

Knife or blade injuries from domestic or occupational accidents might also raise serious concerns about the safety of children and young people. You should consider the advice on child protection in 0-18 years: guidance for all doctors whenever you are concerned that a child may be the victim of abuse or neglect.

You must be able to justify a decision not to share a concern that children or young people are at risk of abuse, neglect or other serious harm, having taken advice from a named or designated doctor for child protection or an experienced colleague, or a defence or professional body.

See 0-18 years: guidance for all doctors for more information and advice about doctors’ roles and responsibilities towards children and young people.