Confidentiality is crucial to the doctor/patient relationship. Patients need to be able to trust their doctor with very personal information, without which, patient care may be negatively affected.
However, confidentiality is not absolute and there may be rare occasions when disclosure of patient information is justified. A police request or where there is a legal obligation may be one of those times but your duty of confidentiality and your legal and ethical duties still need careful consideration.
Concerns have been raised that the Police, Crime and Sentencing bill currently going through parliament may undermine public trust in medical professionals to safeguard sensitive health information. Whatever the final law says, it is vital that public trust is maintained. Here we look at the current law and guidance that GPs need to be aware of.
Safeguarding confidential information
The GMC says that you must not disclose personal information to a third party without the patient’s explicit consent unless it is of overall benefit to a patient lacking capacity to consent, required by law, ordered by a court, or justifiable in the public interest.
It is not uncommon for GPs to be asked by the police to disclose information about a patient to them. Examples of where the law requires you to disclose or volunteer information to the police include the Road Traffic Act 1988 and the Terrorism Act 2000. Another situation in which you are obliged to disclose information applies if, in the course of your work, you discover an act of female genital mutilation (FGM) in a girl under the age of 18 in England and Wales.
In other circumstances, however, you will need to balance the potential harm to the patient and to your professional relationship with them against the benefits of releasing the information. If the police request information, you will need to consider whether overriding your duty of confidentiality can be justified in the best interest of the wider public.
The following anonymised scenarios are based on queries raised by MDU members:
A patient in custody
A police officer attended a GP practice and explained that a patient was being held in custody having committed a serious crime. Asking for a copy of a patient’s medical records, the officer quoted Data Protection Act (DPA) schedule 2 paragraph 2 and 5 and gave the GP a form signed by a senior officer.
MDU advice
The provisions quoted by the officer can, in appropriate circumstances, mean that there will not be a breach of the Data Protection Act in supplying information to the police. For example, if used for the prevention or detection of crime.
However, the provision is permissive only and does not place an obligation on you to disclose the requested information. Your ethical duty of confidence still applies.
You will need to have patient consent or to determine that in the absence of consent, the disclosure would be in the public interest. The police may be able to obtain a court order which would then mean you must disclose the specific information referred to in the order, without the patient’s consent.
GMC confidentiality guidance says that confidential information may be disclosed in the public interest without the patient’s consent, or in exceptional circumstances where consent has been withheld, 'if the benefits to an individual or to society outweigh both the public and the patient’s interest in keeping the information confidential'.
This means you must balance the potential harm to the patient and to the overall trust between patients and doctors caused by releasing the information, against the benefit that disclosure might bring to an individual or society.
One such example arises when failure to disclose the records 'may expose others to a risk of death or serious harm'. In this case the patient is in custody and does not pose a threat to the public, so it would be difficult to justify disclosure without consent from the patient.
If the patient lacks capacity, you should act in their best interests. This is likely to depend on the circumstances of the situation.
For example, if medical information has been requested so that the patient can be treated for a medical or psychiatric condition, relevant information should be disclosed to the doctor who is responsible for the care of the patient directly, rather than to the police.
The MDU adviser suggested that the practice manager ask the police officer whether the police had requested the patient’s consent or had a reason why they could not get consent. The practice manager could also ask the police what the alleged offence was, why they needed information from the clinical records and what type of information they were seeking. It is unlikely that the police would need a patient’s entire medical record.
This additional information would help the practice to decide whether or not they could justify disclosure of the records. If disclosure was appropriate, they should only disclose relevant parts. Any disclosure without consent should be necessary and proportionate and depend on the reason for the request.
The practice was advised to record their reasons for the decision they made either to disclose or withhold the requested information in case they were later called upon to justify the decision.
Disclosure in the public interest
A GP saw a patient he had been treating for stress. The patient was very upset during the most recent consultation about media coverage of historic child abuse. He went on to confess that he had recently abused a 13-year-old friend of his granddaughter’s when she was having a sleepover at their house.
He asked the GP not to tell anyone as he was very remorseful and ashamed and said he would never do anything like that again. The GP was shocked at the confession and rang the MDU to ask if the police should be informed.
MDU advice
You will need to judge whether failure to disclose this information 'may expose others to a risk of death or serious harm' (paragraph 64 of the GMC's confidentiality guidance). The confession of a serious crime such as child abuse is one example of when disclosure is likely to be appropriate.
The GMC does not define serious crime in its guidance but refers to examples given in the NHS’s Confidentiality Code of Practice. These include murder, manslaughter, rape, kidnapping, and child abuse or neglect causing significant harm.
When considering a disclosure in the public interest the GMC says that you must balance the effect of a disclosure on the patient and to trust in doctors generally against the potential benefits arising from release of information.
If you consider that failure to disclose would leave a risk so serious that it outweighs the patient’s and the public interest in confidentiality, you should disclose relevant information promptly to an appropriate person or authority.
Despite the man’s reassurances, he has confessed to a serious crime and children may well be at risk. If you decide to disclose without consent the GMC says you should inform the patient first if it is safe to do so.
Road traffic incident
A GP was approached by the police asking if she could identify a driver from some mobile phone footage that had been taken at the scene of an accident, by a passer-by. The driver of the car had been involved in an incident in which a cyclist was injured after the car emerged from the surgery car park. Witnesses at the scene had reported that the driver was driving recklessly and had then driven off.
The police officer explained they urgently needed information to identify the driver. The GP recognised the driver as a patient and wondered whether she should give their name and address to the police.
MDU advice
Disclosure under the Road Traffic Act 1988 is one of the limited circumstances which legally oblige you to disclose or volunteer information to the police.
Under certain circumstances the Act allows the police to obtain information from anyone, including doctors, which may lead to the identification of a driver alleged to have committed a road traffic offence. Importantly, it is an offence to fail to comply with such a police requirement.
The GMC expects you to disclose information if required by law, but only information relevant to the request and only in the way required by the law. The GMC’s confidentiality guidance states that you should also 'tell patients about such disclosures, wherever practicable, unless it would undermine the purpose of the disclosure to do so'.
In this situation, you have a legal obligation to provide relevant information to the police to identify the driver (usually name and address). You need to be able to justify the disclosure of any other information, such as details of the patient’s medical care, without patient consent. It’s important to make a record of the conversation with the police, noting what information was disclosed and why.
In summary
If you are considering making a disclosure without consent, get advice from colleagues, your Caldicott guardian, or your medical defence organisation.
You can do so in an anonymised way, without disclosing the patient’s identity. If you do decide to disclose information to the police, you should keep the information you provide to the minimum required for the purpose, and only provide information that is relevant.
It is important that you clearly document in the patient’s record your reasons for the disclosure, what information you have disclosed, the steps you have taken to obtain patient consent or your reasons for not doing so.
