Confidentiality is a cornerstone of the doctor patient relationship but is not absolute. Disclosing patient information without consent can only be justified in limited circumstances. Even if a request is from the police, your legal and ethical duties of confidentiality still apply.
The GMC’s new Confidentiality guidance, which comes into effect on 25 April 2017, says that you must not disclose personal information to a third party without the patient’s explicit consent unless it is of overall benefit to a patient lacking the capacity to consent, required by law, ordered by a court, or justifiable in the public interest.
Examples of statutes that require you to disclose or volunteer information to the police include the Road Traffic Act 1988 and the Terrorism Act 2000. Another situation in which you are obliged to disclose information applies if in the course of your work you discover an act of Female Genital Mutilation (FGM) in a girl under the age of 18 in England and Wales.
In other circumstances, however, you will need to balance the potential harm to the patient and to your professional relationship against the benefits of releasing the information. If the police request information, you will need to consider whether overriding your duty of confidentiality can be justified in the best interest of the wider public.
The following anonymised scenarios are based on queries raised by MDU members:
Road traffic incident
A GP was approached by the police asking if she could identify a driver from a CCTV photograph. The driver had apparently, seconds after the photo was taken, been involved in an incident in which a pedestrian was injured after the car emerged from the surgery car park. Witnesses at the scene had reported that the driver was driving recklessly.
The police said they urgently needed information to identify the driver. The GP recognised the driver as one of her patients and wondered whether she should give his name and address to the police.
There are limited circumstances that legally oblige you to disclose or volunteer information to the police. One such situation is the legal requirement imposed by the Road Traffic Act 1988.
This allows the police, under certain circumstances, to require information from anyone, including doctors, which may lead to the identification of a driver alleged to have committed a road traffic offence. In fact, under the Act, it is an offence to fail to comply with such a police requirement.
The GMC expects you to disclose information if required by law, but only information relevant to the request and only in the way required by the law. Paragraph 88 of the GMC’s Confidentiality guidance states that you should also 'tell patients about such disclosures, wherever practicable, unless it would undermine the purpose of the disclosure to do so.'
In this situation, the GP has a legal obligation to provide information to the police to identify the driver (usually name and address). The GP was advised to make a record of the conversation with the police, noting what information was disclosed and why.
A patient in custody
A police officer attended a GP practice and explained that a patient was being held in custody and had committed a serious crime. He asked for a copy of a patient’s medical records. The officer quoted section 29(3) of the Data Protection Act 1998 (DPA), stating that this waived the need for patient consent.
The provision referred to can, in appropriate circumstances, mean that there will not be a breach of the Data Protection Act in supplying information to the police.
That does not mean, however, that you are required to give that information. Your ethical duty of confidence still applies. You will need to have consent from the patient or to determine that in the absence of consent, the disclosure would nonetheless be in the public interest.
The GMC guidance says that confidential information may be disclosed in the public interest without the patient’s consent, or in exceptional circumstances where consent has been withheld, 'if the benefits to an individual or to society outweigh both the public and the patient’s interest in keeping the information confidential' (paragraph 22).
In other words, you must balance the potential harm to the patient and to the overall trust between patients and doctors caused by releasing the information, against the benefit that disclosure might bring to an individual or society.
One such example arises when failure to disclose the records 'may expose others to a risk of death or serious harm' (paragraph 64). In this case, the patient was in custody and could not pose a threat to the public. Therefore the patient’s consent should be sought in the first instance.
The MDU adviser suggested that the practice manager ask the police officer whether the police had requested the patient’s consent or to establish any other reason why they could not get consent. The adviser also suggested that the practice manager ask the police what the alleged offence was, specifically why they needed information from the clinical records and what type of information they were seeking.
This additional information would help the practice to make a decision as to whether or not they could justify disclosure of the records and, if appropriate, only disclose relevant portions of those records.
The practice was advised to record their reasons for the decision they made either to disclose or withhold the requested information, in case they were later called upon to justify the decision.
Disclosure in the public interest
A GP saw a patient he had been treating for headaches. The patient was very upset during the most recent consultation and said media coverage of historic child abuse had brought back memories of when he was abused as a child. He went on to confess that he had recently abused a 13-year-old friend of his daughter’s when she was having a sleepover at their house.
He asked the GP not to tell anyone as he would never do anything like that again. The GP was shocked at the confession and asked if he should tell the police.
You will need to judge whether failure to disclose this information 'may expose others to a risk of death or serious harm' (paragraph 64). One example of when such disclosure is likely to be appropriate arises when a patient has confessed to a serious crime such as child abuse.
The GMC does not define serious crime in its guidance but refers to examples given in the NHS’s Confidentiality Code of Practice. These include murder, manslaughter, rape, kidnapping, and child abuse or neglect causing significant harm.
As with any situation in which you are considering a disclosure in the public interest the GMC says that you must balance the effect of a disclosure on the patient and to trust in doctors generally against the potential benefits arising from release of information (paragraph 67).
When you consider that failure to disclose would leave a risk so serious that it outweighs the patient’s and the public interest in confidentiality, you should disclose relevant information promptly to an appropriate person or authority (paragraph 68).
Despite the man’s reassurances, he has confessed to a serious crime and children may well be at risk. If you decide to disclose without consent the GMC says you should inform the patient first, if it is safe to do so (paragraph 68).
If you are considering making a disclosure without consent, you may wish to seek advice from your colleagues, the Caldicott guardian of your NHS England Area team, or your medical defence organisation.
You may do so in an anonymised way, without disclosing the patient’s identity. If you do decide to disclose information to the police, you should keep the information you provide to the minimum required for the purpose, and only provide information that is relevant.
It is important that you clearly document in the patient’s record your reasons for the disclosure, what information you have disclosed, the steps you have taken to obtain patient consent or your reasons for not doing so.