GP Practices hold information about patients which must be kept private and confidential.
In some instances, patient records can be very sensitive and may contain information concerning third parties. Patient information must not be given to others unless the patient consents or the disclosure can be justified.
Dr T Abubacker is the Practice’s Caldicott Guardian.
This Code of Practice outlines how the Caldicott Guardian and all Practice staff will deal with information about its Patients. It reflects the standards that are expected of doctors when they hold or share information about patients, as per the following 2 GMC Documents:
“Confidentiality: Guidance for Doctors” effective October 2009.
“Raising and acting on concerns about patient safety” effective 12 March 2012.
Patients have a right to expect that information about them will be held in confidence by their doctors.
Confidentiality is central to trust between doctors and patients. Without assurances about confidentiality, patients may be reluctant to seek medical attention or to give doctors the information they need in order to provide good care.
However, sharing appropriate information is an essential part of providing efficient, safe, and effective care for both the individual patient and the wider community of patients.
Information should be readily available to patients, and they should clearly understand that unless they object, their personal information may be disclosed for the sake of their own care and for local clinical audit purposes.
Most patients understand the need for the healthcare team who provides their care to be aware of their personal information. However, they are less likely to be aware of disclosures to others for purposes other than their own care (e.g. service planning or medical research).
They must therefore be informed about disclosures for purposes they would not reasonably expect.
Although confidentiality is an important duty, it is not absolute because information can be disclosed if:
When disclosing information about a patient, the Practice must:
When the Caldicott Guardian is satisfied that information should be released, the Practice should act promptly to disclose all relevant information. This is often essential to the best interests of the patient, or to safeguard the well-being of others.
When you are responsible for personal information about patients you must make sure that it is effectively always protected against improper disclosure
Many improper disclosures are unintentional. You should not discuss patients where you can be overheard or leave patients’ records, either on paper or on screen, where they can be seen by other patients, unauthorised health care staff or the public.
All relevant practice staff must:
Practice staff responsible for the management of patient records and information should:
Disclosures required by statute.
You must disclose information to satisfy a specific statutory requirement, such as notification of a known or suspected communicable disease.
Many regulatory bodies have statutory powers to access patients’ records (e.g. as part of their duties to investigate complaints, accidents or health professionals’ fitness to practise) and have codes of practice governing how they will access and use personal information.
The Caldicott Guardian should be satisfied that any disclosure sought is required by law or can be justified in the public interest.
Patients should be informed about such disclosures (unless that would undermine the purpose), even if their consent is not required.
Should Patient records or personal information be requested, but is not required by law (e.g. by a statutory regulator to investigate a healthcare professional’s fitness to practise) the patient’s express consent must be sought, if practicable, before disclosure. In the event that it is not practicable to seek their consent, or a patient refuses to give consent, the regulatory body involved should be contacted to advise on whether the disclosure can be justified in the public interest.
You must also disclose information if ordered to do so by a judge or presiding officer of a court. You should object to the judge or the presiding officer if attempts are made to compel you to disclose what appear to you to be irrelevant matters, (e.g. matters relating to relatives who are not involved in the proceedings).
You must not disclose personal information to a third party such as a solicitor, police officer or officer of a court without the patient’s express consent, unless it is required by law or can be justified in the public interest.
Seeking a patient’s consent to disclosure of information shows respect and is part of good communication between doctors and patients.
Sharing information within the healthcare team or with others providing care
Most people understand and accept that information must be shared within healthcare teams, in order, to provide their care.
You should make sure that patients are aware that personal information about them will be shared within the healthcare team (including administrative and other supporting staff) unless they object. Generating awareness can take a number of forms (e.g. leaflets, posters, websites and face-to-face) but should be tailored to the patients’ identified needs wherever practicable.
You must respect the wishes of any patient who objects to, particular, information being shared within the healthcare team or others providing care, unless disclosure would be justified in the public interest.
Should a patient object to a disclosure that is, considered to be essential to the provision of safe care, it should be explained to them that unless that information is disclosed, they cannot be referred, nor can their treatment be arranged.
You must make sure that anyone to whom you disclose personal information understands that it is given to them in confidence, which they must respect.
All staff members receiving personal information, in order, to provide or support care are bound by a legal duty of confidence, whether or not they have contractual or professional obligations to protect confidentiality.
Circumstances may arise where a patient cannot be informed about the disclosure of information, for example because of a medical emergency. In these cases, you must pass relevant information promptly to those providing the patient’s care.
As and when the patient is capable of understanding, they should be informed how their personal information was disclosed, if it was in a way they would not reasonably expect.
Local clinical audit
Clinical audit is essential to the provision of good care.
All doctors in clinical practice have a duty to participate in clinical audit and to contribute to National Confidential Inquiries.
Where an audit is to be undertaken by the team which provided care, or those working to support them, such as clinical audit staff, you may disclose identifiable information, provided you are satisfied that the patient:
If a patient does object, you should explain why information is needed and how this may benefit their care. If it is not possible to provide safe care without disclosing information for audit, you should explain this to the patient and the options open to them.
Where clinical audit is to be undertaken by another organisation, information should be anonymised or coded wherever that is practicable. If this is not practicable, or anonymised data will not fulfil the requirements of the audit, identifiable data should be disclosed only if the patient’s express consent has been obtained.
Express consent is generally needed before the disclosure of identifiable information for purposes such as financial audit and insurance or benefit claims.
Should you be asked to provide information to third parties, (e.g. a patient’s insurer or employer, a government department or an agency assessing a claimant’s entitlement to benefits), either following an examination or from existing records, you should:
If a patient refuses consent, or if it is not practicable to get their consent, disclosure may still be made provided it is required by law or can be justified in the public interest. Where the purpose is covered by a regulation made under section 251 of the NHS Act 2006, disclosures can also be made without a patient’s consent, but not if the patient has objected.
Disclosures in the public interest
Confidential medical care is recognised in law as being in the public interest. However, there can also be a public interest in disclosing information:
Personal information may be disclosed in the public interest, without the patient’s consent, and in exceptional cases where patients have withheld consent, where the benefits to an individual or to society of the disclosure outweigh the public and the patient’s interest in keeping the information confidential.
In all cases where you consider disclosing information without consent from the patient, you must weigh the possible harm (both to the patient, and the overall trust between doctors and patients) against the benefits which are likely to arise from the release of information.
Before considering whether a disclosure of personal information ‘in the public interest’ would be justified, you must be satisfied that identifiable information is necessary for the purpose, or that it is not practicable to anonymise or code it.
In such cases you should still try to seek patients’ consent, unless it is not practicable to do so, for example because:
You should inform a patient that a disclosure will be made in the public interest, even if you have not sought consent, unless to do so:
You must document in the patient’s record:
Research, epidemiology, public health surveillance, health service planning, and education and training are among the important secondary uses made of patient information, each serving important public interests.
For many secondary uses, it will be sufficient and practicable to disclose only anonymised or coded information. When identifiable information is needed, or it is not practicable to remove identifiable information, it will often be perfectly practicable to get patients’ express consent.
You may disclose identifiable information without consent if it is required by law, if it is approved under section 251 of the NHS Act 2006, or if it can be justified in the public interest and it is either:
and, in either case, not practicable to seek consent (or efforts to seek consent have been unsuccessful).
In considering whether it is practicable to seek consent you must take account of:
When considering whether the public interest in disclosures for secondary uses outweighs patients’ and the public interest in keeping the information confidential, you must consider:
When considering applications for support under section 251 of the NHS Act 2006 in England and Wales, the National Information Governance Board considers:
It might not be practicable for the healthcare team, or those who usually support them, to anonymise or code information or to seek patients’ express consent:
If that is the case:
You should only disclose identifiable information for research if that research is approved by a Research Ethics Committee. You should alert Research Ethics Committees to disclosures of identifiable information without consent when applying for approval for research projects.
It may be appropriate to encourage patients to consent to disclosures you consider necessary for their protection, and to warn them of the risks of refusing to consent; but you should usually abide by a competent adult patient’s refusal to consent to disclosure, even if their decision leaves them, but nobody else, at risk of serious harm.
You should do your best to provide patients with the information and support they need to make decisions in their own interests (e.g. by arranging contact with relevant external agencies or organisations).
Disclosure without consent may be justified if it is not practicable to seek a patient’s consent.
Disclosure of personal information about a patient without consent may be justified in the public interest if failure to disclose may expose others to a risk of death or serious harm. You should still seek the patient’s consent to disclosure if practicable and consider any reasons given for refusal.
Such a situation might arise, for example, when a disclosure would be likely to assist in the prevention, detection, or prosecution of serious crime, especially crimes against the person. When victims of violence refuse police assistance, disclosure may still be justified if others remain at risk, (e.g. from someone who is prepared to use weapons, or from domestic violence when children or others may be at risk).
If a patient’s refusal to consent to disclosure leaves others exposed to a risk so serious that it outweighs the patient’s and the public interest in maintaining confidentiality, or if it is not practicable or safe to seek the patient’s consent, you should disclose information promptly to an appropriate person or authority. You should inform the patient before disclosing the information, if practicable and safe, even if you intend to disclose without their consent.
You should participate in procedures set up to protect the public from violent and sex offenders and co-operate with requests for relevant information about patients who may pose a risk of serious harm to others.
When making decisions about whether to disclose information about a patient who lacks capacity, you must:
You must also consider:
If a patient who lacks capacity asks you not to disclose personal information about their condition or treatment, you should try to persuade them to allow an appropriate person to be involved in the consultation.
Should they refuse, and you are convinced that it is essential in their best interests, you may disclose relevant information to an appropriate person or authority.
In such a case you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer, documenting in the patient’s record your discussions and the reasons for deciding to disclose the information.
Although you may need to share personal information with a patient’s relatives, friends or carers to enable you to assess the patient’s best interests, this does not mean they have a general right of access to the patient’s records or to have irrelevant information (e.g. about the patient’s past healthcare).
You should also share relevant personal information with anyone who is authorised to make decisions on behalf of, or who is appointed to support and represent, a mentally incapacitated patient.
If you believe that a patient may be a victim of neglect or physical, sexual or emotional abuse, and that they lack capacity to consent to disclosure, you must give information promptly to an appropriate responsible person or authority, if you believe that the disclosure is in the patient’s best interests or necessary to protect others from a risk of serious harm.
If you believe that disclosure of information is not in the best interests of a neglected or abused patient, you should discuss the issues with an experienced colleague.
In the event you decide not to disclose information, you should document in the patient’s record your discussions and the reasons for deciding not to disclose and be prepared to justify your decision.
Dr Talib Abubacker at the Practice is responsible for notifying the CQC without delay about allegations of abuse including:
In relation to where the alleged or possible victim of abuse is a child or young person under 18 years, the notification must include details of the allegation, including:
Where the Registered Person is unavailable, for any reason, Mel Quinn will be responsible for reporting the allegation to the CQC.
There is a dedicated Notification form for this type of incident. It can be found here: Paper Allegation of Abuse Notification for Publication
Early discussions with the patient (especially if the patient has fluctuating or diminished capacity or is likely to lose capacity, even temporarily) should try to establish what information they want you to share, who with, and in what circumstances. Such discussions can help to avoid disclosures that a patient would object to and misunderstandings with, or causing offence to, anyone the patient would want information to be shared with.
If a patient lacks capacity, you should share relevant information in accordance with the advice in the Section “Disclosure about patients who lack capacity to consent”.
Unless they indicate otherwise, it is reasonable to assume that a patient would want those closest to them to be kept informed of their general condition and prognosis.
In the event someone close to the patient wishes to discuss their concerns about the patient’s health, you should make it clear to them that, while it is not a breach of patient confidentiality to listen to their concerns, you cannot guarantee that you will NOT tell the patient about the conversation (e.g. you might need to share with a patient information you have received from others, if it has influenced your assessment and treatment of the patient).
You should not refuse to listen to a patient’s partner, carers or others on the basis of confidentiality, as the information they provide might help in your care of the patient.
However, you will need to evaluate whether your patient would consider you listening to the concerns of others about their health or care to be a breach of trust, particularly if they have asked you not to listen to specific people.
Genetic and some other information about your patient might also be information about others the patient shares genetic or other links with (e.g. the diagnosis of an illness in the patient might point to the certainty or likelihood of the same illness in a blood relative).
Most patients will readily share information about their own health with their children and other relatives, particularly if they are advised that it might help those relatives to:
However, should a patient refuse to consent to the disclosure of information that would benefit others, (e.g. where family relationships have broken down, or if their natural children have been adopted), disclosure might still be justified in the public interest.
If a patient refuses consent to disclosure, you will need to balance your duty to make the care of your patient your first concern against your duty to help protect the other person from serious harm. If practicable, you should not disclose the patient’s identity in contacting and advising others of the risks they face.
The duty of confidentiality continues after a patient has died.
Whether and what personal information may be disclosed after a patient’s death will depend on the circumstances:
There are circumstances in which you should disclose relevant information about a patient who has died, for example:
Archived records relating to deceased patients remain subject to a duty of confidentiality, although the potential for disclosing information about, or causing distress to surviving relatives or damaging the public’s trust will diminish over time.
All registered providers of primary medical services must notify certain deaths to CQC. Notifications must be submitted directly to CQC. The law does not allow providers of primary medical services to notify CQC via the NHS National Reporting and Learning System (NRLS).
However, not all deaths have to be notified.
The Health and Social Care Act (2008) requires that deaths must be notified if the death would not have happened if the person had been receiving appropriate care and treatment and either:
Such an incident would be classed as a significant event and these notifications must be submitted without delay.
There is a dedicated notification form to report such deaths.
Dr Talib Abubacker at the Practice is responsible for notifying the CQC immediately upon the death of a person who uses the Practice’s services.
Where the Registered Person is unavailable, for any reason, Mel Quinn will be responsible for reporting the death to the CQC.
(Please note: this form should not be used for reporting the death of a person detained or liable to be detained under the Mental Health Act 1983.)
This defines the terms used within this document. These definitions have no wider or legal significance.
Personal Information: Information about people which doctors learn in a professional capacity and from which individuals can be identified.
Anonymised Information: Information from which individuals cannot reasonably be identified. Names, addresses, full postcodes or identification numbers, alone or together or in conjunction with any other information held by or available to the recipient, can be used to identify patients.
Coded Information: Also known as pseudonymised information. Information from which individuals cannot be identified by the recipient, but which enables information about different patients to be distinguished or to link information about the same patients over time (for example, to identify drug side effects). A ‘key’ might be retained by the person or service which coded the information so that it can be reconnected with the patient.
Identifiable Information: Information from which a patient can be identified. Their name, address and full postcode will identify a patient; combinations of information may also do so, even if their name and address are not included. Information consisting of small numbers and rare conditions might also lead to the identification of an individual.
Consent: Agreement to an action based on knowledge of what the action involves and its likely consequences.
Express Consent: Consent which is expressed orally or in writing. Also known as explicit consent.
Implied Consent: Consent that can be inferred if the patient has been informed that information is to be disclosed, the purpose and extent of the disclosure, and that they have a right to object, but have not objected.
Clinical Audit: Evaluation of clinical performance against standards or through comparative analysis, to inform the management of services.
Disclosure: The provision or passing of information about a patient to anyone other than the patient, regardless of the purpose. Sharing information within healthcare teams is a form of disclosure, as is providing personal information about a patient to the police.
Healthcare Team: The healthcare team comprises the people providing clinical services for a patient, and the administrative and other staff who support the provision of their care.
Public Interest: The interests of the community as a whole, or a group within the community or individuals. Paragraphs 36 and 37 give an explanation of the balancing exercise required to decide if disclosure might be justified in the public interest.
The GMC has also published guidance which explains how the principles described in this document apply in the following situations which doctors often encounter or may find hard to deal with:
Click on a title to view the contents of that document.
Reporting concerns about patients to the DVLA
The Driver and Vehicle and Licensing Agency (DVLA) is legally responsible for deciding if a person is medically unfit to drive. This means it needs to know if a driving licence holder has a condition or is undergoing treatment that may now, or in the future, affect their safety as a driver.
You should seek the advice of an experienced colleague or the DVLA’s medical adviser if you are not sure whether a patient may be unfit to drive. You should keep under review any decision that they are fit, particularly if the patient’s condition or treatments change.
The DVLA’s publication “For Medical Practitioners: At a glance Guide to the current Medical Standards of Fitness to Drive” includes information about a variety of disorders and conditions that can impair a patient’s fitness to drive.
The driver is legally responsible for informing the DVLA about such a condition or treatment.
However, if a patient has such a condition, you should explain to the patient:
If a patient refuses to accept the diagnosis, or the effect of the condition on their ability to drive, you can suggest that they seek a second opinion, and help arrange for them to do so. You should advise the patient not to drive in the meantime.
If a patient continues to drive when they may not be fit to do so, you should make every reasonable effort to persuade them to stop. As long as the patient agrees, you may discuss your concerns with their relatives, friends or carers.
If you do not manage to persuade the patient to stop driving, or you discover that they are continuing to drive against your advice, you should contact the DVLA immediately and disclose any relevant medical information, in confidence, to the medical adviser.
Before contacting the DVLA you should try to inform the patient of your decision to disclose personal information.
You should then also inform the patient in writing once you have done so.
Disclosing records for financial and administrative purposes
If you are responsible for the management of patient records or other patient information, you should make sure that financial and administrative information is recorded separately from clinical information.
If you are asked to disclose information about patients for financial or administrative purposes you should, if practicable, provide it in anonymised or coded form, if that will serve the purpose. If identifiable information is needed, you should, if practicable, seek the patient’s express consent before disclosing it
You must draw attention to any system that prevents you from following this guidance and recommend change. Until changes are made, you should make sure that information is readily available to patients explaining that their personal information may be disclosed for financial, administrative, and similar purposes, and what they can do if they object.
If a patient asks, you should explain the nature and purpose of disclosures made for financial and administrative purposes. You should do your best to act on any objections. If you are satisfied that it is not possible to comply with the patient’s wishes, and still provide care, you should explain this to the patient and explain their options.
You should satisfy yourself that anyone who will have access to the information is bound by a duty of confidentiality not to disclose it further.
Disclosure may be required by law in some cases, for example, in the investigation of fraud by the NHS Counter Fraud Service or approved under section 251 of the NHS Act 2006.
For more information on commissioners’ access to personal information held by general practices for purposes such as Quality and Outcomes Framework reviews, see the relevant Confidentiality and Disclosure of Information Directions and Code of Practice.
Disclosing information about serious communicable diseases
Confidentiality is important to all patients. Those who have, or may have, a serious communicable disease might be particularly concerned about their privacy.
You should make sure that information you hold or control about a patient’s infection status is always effectively protected against improper disclosure.
All patients are entitled to good standards of care, regardless of their status, what disease they might have, or how they acquired it.
Healthcare workers who have, or may have, a serious communicable disease.
Good Medical Practice states that:
You should protect your patients, your colleagues and yourself by being immunised against common serious communicable diseases where vaccines are available.
If you know that you have, or think that you might have, a serious condition that you could pass on to patients, or if your judgement or performance could be affected by a condition or its treatment, you must consult a suitably qualified colleague.
You must ask for and follow their advice about investigations, treatment, and changes to your practice that they consider necessary. You must not rely on your own assessment of the risk you pose to patients.
You should raise any reasonable concern you have about any healthcare worker who has a serious communicable disease and practises, or has practised, in a way that places patients at risk of infection.
You should inform the healthcare worker’s employing or contracting body of your concerns, preferably through its occupational health service or, where appropriate, their regulatory body. You should inform the healthcare worker before passing the information on, as long as it is practicable and safe to do so.
For more advice on colleagues who might pose a risk to patients, see Raising concerns about patient safety.
Patients who are diagnosed with a serious communicable disease.
You should make sure information is readily available to patients explaining that personal information about them will be shared within the healthcare team, including administrative and other staff who support the provision of care, unless they object, and why this is necessary.
If a patient refuses to allow you to inform someone outside the healthcare team of their infection status, you must respect their wishes unless you consider that failure to disclose the information will put healthcare workers or other patients at risk of infection. But such situations are likely to be very rare, not least because of the use of universal precautions to protect healthcare workers and patients, particularly during exposure-prone procedures.
You should explain to patients how they can protect others from infection, including the practical measures they can take to avoid transmission, and the importance of informing sexual contacts about the risk of transmission of sexually transmitted serious communicable diseases.
Informing sexual contacts of patients with a serious communicable disease
You may disclose information to a known sexual contact of a patient with a sexually transmitted serious communicable disease if you have reason to think that they are at risk of infection and that the patient has not informed them and cannot be persuaded to do so.
In such circumstances, you should tell the patient before you make the disclosure, if it is practicable and safe to do so. You must be prepared to justify a decision to disclose personal information without consent.
When you are tracing contacts and notifying partners, you should not disclose the identity of the patient, if practicable.
Children and young people
Your patient must be your first concern; but you should also consider and act in the best interests of your patient’s children.
Most patients with a serious communicable disease who are parents or care for children will do all they can to protect those children from the risk of infection or the effects of the disease. You should make sure that the patient understands the information and advice you provide, which should be tailored to their needs.
You should do all you reasonably can to support them in caring for themselves and in protecting their children.
You should explain to a patient with a serious communicable disease the importance of testing any children who may already be infected, including children without symptoms and young people who might have been vertically infected with a blood-borne virus.
If you are concerned that a child is at risk of serious harm because their parents cannot be persuaded to protect them from the risk of infection, or because they refuse to allow the child to be tested, you should seek legal advice about whether to apply to court for a determination on the child’s best interests.
See 0-18 years: guidance for all doctors for more information about confidentiality and consent in respect of children and young people and about child protection, which is a responsibility of all doctors.
Injuries to healthcare workers and others
You should make sure that a risk assessment is made urgently by an appropriately qualified colleague if a healthcare worker, police officer or anyone else suffers a needlestick or similar injury involving a patient who has, or may have, a serious communicable disease.
Post-exposure prophylaxis should be offered in accordance with that risk assessment, which should include consideration of the type of body fluid or substance involved, and the route and severity of the exposure.
You should ask for the patient’s consent to disclose their infection status after exposure to a serious communicable disease. If the patient cannot be persuaded to consent to disclosure, or if it is not safe or practicable to ask for their consent, you may disclose information in the public interest. This could be, for example, if the information is needed for decisions about the continued appropriateness of post-exposure prophylaxis.
Recording serious communicable diseases on death certificates
If a serious communicable disease has contributed to the cause of death, you must record this on the death certificate.
Serious communicable disease control and surveillance
You should pass information about serious communicable diseases to the relevant authorities for the purpose of communicable disease control and surveillance. You should use anonymised or coded information, if practicable and, as long as, it will serve the purpose.
In this guidance the term ‘serious communicable disease’ applies to any disease that can be transmitted from human to human and that can result in death or serious illness. It particularly applies to, but is not limited to, HIV, tuberculosis, and hepatitis B and C.
The NHS (Venereal Diseases) Regulations 1974, The NHS Trusts (Venereal Diseases) Directions 1991 and The NHS Trusts and Primary Care Trusts (Sexually Transmitted Diseases) Directions 2000 state that various NHS bodies in England and Wales must:
‘take all necessary steps to secure that any information capable of identifying an individual… with respect to persons examined or treated for any sexually transmitted disease shall not be disclosed except –
There are different interpretations of the Regulations and Directions, and concerns about their compatibility with the European Convention on Human Rights. In particular, there have been concerns that a strict interpretation would prevent the disclosure of relevant information, except to other doctors or those working under their supervision, even with the patient’s consent or to known sexual contacts in the public interest.
The GMC view is that the Regulations and Directions do not preclude disclosure if it would otherwise be lawful at common law, for example with the patient’s consent or in the public interest without consent.
Disclosing information for insurance, employment and similar purposes
The first duty of a doctor registered with the GMC is to make the care of their patient their first concern. The term ‘patient’ in this guidance also refers to employees, clients, athletes and anyone else whose personal information you hold or have access to, whether or not you care for them in a traditional therapeutic relationship.
There are many circumstances in which a doctor might be asked to disclose information, either following an examination of a patient or from existing records, and in which they face ‘dual obligations’.
Usually, dual obligations arise when a doctor works for, is contracted by, or otherwise provides services to:
Alternatively, a person or organisation you have previously had no direct relationship with, such as your patient’s employer or insurance company, might ask you to provide a medical report or information about a patient. You might be offered payment for your own or your staff’s time and effort, giving rise to an obligation in addition to the one you have to your patient.
Extent of the disclosure
You should disclose only information relevant to the request for disclosure, which means you should not usually disclose a patient’s whole record. Exceptions to this general rule include benefit claims and litigation.
The whole record may be relevant to some benefits paid by government departments or agencies.
A solicitor may need to see their client’s whole record to assess which parts are relevant, for example, to personal injury claims. If the claim goes ahead, the person the claim is made against may ask for copies of important documents, which could include records containing the patient’s medical history. Under court rules in England and Wales, they can see all the patient’s health records. The solicitor should explain this to the patient.
When writing a report, you must:
If any of the exceptions apply, you should still disclose as much of the report as you can. The Department for Work and Pensions publishes further advice about reports for benefits purposes (see www.dwp.gov.uk/healthcare-professional/ guidance).
Doctors might provide their services to professional sports clubs (where the dual obligation is to both the patient and the club, which is very similar to the dual obligation of an occupational health doctor) or to associations (where the dual obligation is both to the patient and to a governing body or team of selectors).
Disclosing information for education and training purposes
The use of information about patients is essential to the education and training of medical and other healthcare students and trainees. For most of these uses, anonymised information will be sufficient and should be used whenever practicable.
When it is necessary to use identifiable information about a patient, or it is not practicable to anonymise information, you should seek the patient’s consent before disclosing it. You should make sure that the patient is under no pressure to consent. In particular, you should avoid any impression that their care depends on giving consent.
Publishing case studies
It may be difficult to anonymise case studies about patients while retaining enough detail to make publication useful. Simply changing a patient’s name will often not anonymise the information if other identifying details are included, such as age, sex, location or a detailed account of the patient’s illness and treatment.
If you cannot anonymise the information, you should seek the patient’s consent before disclosing it. When seeking the patient’s consent, you must provide them with enough information about the nature and purpose of the disclosure to enable them to make an informed decision. This should include a description of the information to be disclosed and an indication of how it will be used, for example, whether it will be published in a journal or shown at a medical conference.
You must then disclose that information only for the purposes for which the patient has given consent.
If for any reason you cannot get a patient’s consent, for example, because the information you want to disclose is so old that efforts to trace the patient have been or are likely to be unsuccessful, you will need to consider whether publication can be justified in the public interest.
You should respect a patient’s refusal to consent to publication of their identifiable information.
Teaching and training
Most patients understand and accept that the education and training of medical and other healthcare students and trainees relies on their having access to information about patients.
If trainees are part of the healthcare team providing or supporting a patient’s care, they can have access to the patient’s personal information like other team members, unless the patient objects.
If students need access to a patient’s personal information, but are not providing or supporting the patient’s care, anonymised information should be used whenever possible. This may not be practicable when they are directly involved in the provision of care, for example, on ward rounds, but it will then usually be practicable to seek the patient’s express consent to disclosure.
It might be necessary to disclose personal information, or not be practicable to anonymise it, and also not be practicable to seek a patient’s express consent to disclosure. However, if information has been made readily available to the patient about the disclosure and of their right to object, and they have not objected, you may disclose personal information necessary for the education of medical and other healthcare students.
School and college students
Doctors are sometimes asked to provide work experience for secondary school or further education college students, which may include allowing them to be present during consultations with patients. You should seek the patient’s express consent to a student observing their care.
You should make sure that the student understands the importance of respecting confidentiality and that their school or college takes seriously its responsibilities for its students’ conduct.
You should also satisfy yourself that the student’s presence does not adversely affect the patient’s care, for example, by inhibiting frank discussion.
Patients who lack capacity
You should not disclose personal information for education and training purposes about patients who lack capacity if you can practicably use information about other patients instead.
If you wish to disclose personal information about a patient who lacks capacity but who is likely to regain capacity, you should, if practicable, wait and seek their consent later.
You may disclose personal information about a patient who lacks capacity to consent if disclosure will benefit or is in the best interests of the patient, or if it is justified in the public interest.
If you are asked, or want, to disclose information about a patient who lacks capacity, you should seek the views of anyone the patient asks you to consult, or who has legal authority to make decisions on their behalf, or who has a close personal relationship with the patient.
They may be able to give you an indication of the patient’s previously expressed preferences, views and beliefs.
In the absence of any indication about the preferences of a patient who lacks capacity:
You should consider whether the work needed to anonymise or code the information or to seek patients’ consent is reasonably practicable in all the circumstances.
Only if unreasonable effort is required should you go on to consider whether disclosure of identifiable information is justified in the public interest.
If it is not practicable to anonymise or code the information or to seek or obtain patients’ consent without unreasonable effort, and the likelihood of distress or harm to patients is negligible, disclosure for an important secondary purpose may be proportionate. You should respect patients’ objections to disclosure.
In this context ‘trainees’ refers to registered medical practitioners in training grades, while ‘students’ refers to undergraduates pursuing a medical degree.
You must give patients the information they want or need about the extent to which students may be involved in their care, and of their right to refuse to take part in teaching.
Welfare attorneys, court-appointed guardians and court appointed deputies have legal authority to make some decisions on a patient’s behalf. In the context of public interest disclosures, you will be seeking their views about the patient’s preferences, rather than their consent to disclose.
Responding to criticism in the press
Doctors are sometimes criticised in the press by their patients or by someone their patients have a close personal relationship with. The criticism can include inaccurate or misleading details of the doctor’s diagnosis, treatment or behaviour.
Although this can be frustrating or distressing, it does not relieve you of your duty to respect your patient’s confidentiality. Disclosures of patient information without consent can undermine the public’s trust in the profession as well as your patient’s trust in you. You must not put information you have learned in confidence about a patient in the public domain without that patient’s express consent.
Disputes between patients and doctors conducted in the media often serve no practical purpose; they can prolong or intensify conflict and may undermine public confidence in the profession, even if they do not involve the disclosure of personal information without consent.
You should usually limit your public response to press reports to an explanation of your legal and professional duty of confidentiality.
However, from time to time, press reports might cause patients to be concerned about your practice, or that of a health service you are associated with. In such cases it may be appropriate to give general information about your normal practice. You must be careful not to reveal personal information about a patient, or to give an account of their care, without their consent.
If you deny allegations that appear in the press, you must be careful not to reveal, directly or by omission or inference, any more personal information about the patient than a simple denial demands.
You should seek advice from your professional or defence body, or from a solicitor, on how to respond to press criticism and, if appropriate, any legal redress available to you.
In this guidance, ‘patient’ is used to refer to both current and former patients.
Reporting gunshot and knife wounds
The guidance in confidentiality applies to all violent crime, but gunshot and knife wounds raise issues that warrant special consideration. That is not to suggest that information should not be disclosed to assist in the prevention, detection or prosecution of other serious crime.
This guidance describes a two-stage process:
Reporting gunshot and knife wounds
The police are responsible for assessing the risk posed by a member of the public who is armed with, and has used, a gun or knife in a violent attack.
They need to consider:
For this reason, the police should be informed whenever a person arrives at the Practice with a gunshot wound. Even accidental shootings involving lawfully held guns raise serious issues for the police about, for example, gun licensing.
The police should also be informed when a person arrives at a hospital with a wound from an attack with a knife, blade or other sharp instrument.
The police should not usually be informed if a knife or blade injury is accidental, or a result of self-harm. If you are in doubt about the cause of the injury, you should if possible, consult an experienced colleague.
Quick reporting at this stage may help prevent further incidents or harm to others. If you have responsibility for the patient, you should make sure that the police are contacted, but you can delegate this task to another member of staff.
Personal information, such as the patient’s name and address, should not usually be disclosed in the initial contact with the police. The police will respond even if the patient’s identity is not disclosed. The police need to be informed quickly in order, to respond to the risk to patients, staff and the public. They also need statistical information about the number of gunshot and knife injuries, and when and where they occur, to inform their own and their crime reduction partners’ operational and strategic priorities.
Making the care of the patient your first concern
When the police arrive, you should not allow them access to the patient if this will delay or hamper treatment or compromise the patient’s recovery.
If the patient’s treatment and condition allow them to speak to the police, you or another member of the healthcare team should ask the patient whether they are willing to do so. If they are not, you should explain what the consequences, if any, might be. You, the rest of the healthcare team, and the police must abide by the patient’s decision.
Disclosing personal information without consent
If it is probable that a crime has been committed, the police will ask for more information. If the patient cannot give consent because, for example, they are unconscious, or refuses to disclose information or to allow you or your colleagues to do so, you can still disclose information if it is required by law or if you believe it is justified in the public interest.
Disclosures in the public interest may be justified when:
If there is any doubt about whether disclosure without consent is justified, the decision should be made by, or with the agreement of, the consultant in charge, or the trust’s Guardian.
If practicable, you should seek the patient’s consent to the disclosure, or tell them that a disclosure has been made unless, for example, that:
You must document in the patient’s record your reasons for disclosing information without consent and any steps you have taken to seek their consent, to inform them about the disclosure, or your reasons for not doing so.
If there is no immediate public interest reason for disclosing personal information, no further information should be given to the police. The police may seek an order from a judge or a warrant for the disclosure of confidential documents.
You should tell those responsible for the continuing care of the patient that further discussion with the patient is needed to ensure, for example, that they are fit to hold a firearms licence.
Children and young people
Any child or young person under 18 arriving with a gunshot wound or a wound from an attack with a knife, blade or other sharp instrument will raise obvious child protection concerns. You must inform an appropriate person or authority promptly of any such incident.
Knife or blade injuries from domestic or occupational accidents might also raise serious concerns about the safety of children and young people. You should consider the advice on child protection in 0-18 years: guidance for all doctors whenever you are concerned that a child may be the victim of abuse or neglect.
You must be able to justify a decision not to share a concern that children or young people are at risk of abuse, neglect or other serious harm, having taken advice from a named or designated doctor for child protection or an experienced colleague, or a defence or professional body.
See 0-18 years: guidance for all doctors for more information and advice about doctors’ roles and responsibilities towards children and young people.