Common confidentiality concerns addressed

Dr Edward Farnan provides answers to questions relating to the protection and disclosure of patient information

Confidentiality is an essential part of the doctor-patient relationship, reflected by its inclusion in statements, such as the Hippocratic Oath and the World Health Organisation’s Declaration of Geneva. All of the information you hold about a patient – including the simple fact that they are your patient – is confidential.

There are very good reasons for this. It encourages patients to be open and honest about even the most sensitive matters and is in the public interest.

Confidentiality is an ethical, legal, and in some cases, contractual requirement. The Medical Council’s Guide to Professional Conduct and Ethics for Registered Medical Professionals explains what is expected of doctors by their regulator. The General Data Protection Regulation, Data Protection Act 2018, Article 8 of the European Convention of Human Rights, and Article 40 of the Constitution of Ireland, as well as case law, all include stipulations on keeping certain information confidential.

However, the duty of confidentiality is not absolute, and there are circumstances when doctors can or must share information, which would otherwise be confidential.

Sharing information with solicitors and insurers

You can share information about your patient if they give you consent to do so. Most commonly this will be for the purposes of direct care. Even if you intend to share information with a colleague for this reason, the Medical Council expects that you will “explain to the patient that information is being shared for their benefit and with whom the information is being shared”.

If you have consent, you can also share information for other reasons, such as with a patient’s solicitor or an insurance company, but you will usually wish to see explicit, written consent for this.

For example, a patient may understand that a solicitor will ask for records directly relevant to injuries sustained in an accident, but may not understand that the solicitor will ask for their entire record. If you’re in doubt, it’s worth checking the patient understands what is to be disclosed.

Sharing legally required information

Some laws require you to share information. One example is infectious disease regulations, which require all medical practitioners to notify the medical officer of health or director of public health of certain diseases. These include Covid-19, influenza or infectious hepatitis. Before making a disclosure, you should ensure that the disclosure is in fact required. You should only disclose the information which is relevant and necessary. Generally, you should tell the patient that you are making the disclosure as it is required by law.

You must also share information if you are ordered to do so by a court or other body that has authority to do so. The Medical Council, for example, can require disclosure of records to assist in the investigation of a doctor’s fitness to practise. Again, it would be usual to tell the patient that you are making a disclosure in this situation, unless this would undermine the purpose of the disclosure.

If you are sharing information without a patient’s consent, even if this is required by law, you should carefully document what you have disclosed and on what basis you have done so. If you are not proposing to tell the patient, you should record your reasons for this.

Disclosing information in the public interest

It can be challenging to weigh up a decision to share information without consent where there is no legal obligation.

Situations when disclosure might be permitted, but not necessarily required, include the disclosure of information for the prevention, detection, investigation, and prosecution of criminal offences, which is permitted under the Data Protection Act 2018. You are not obliged to disclose information for these purposes and it does not override your ethical obligations. You may need to consider the nature of the information being sought and the seriousness of the alleged offence, as well as the option of seeking consent for the disclosure.

There will be other circumstances where disclosure without consent and contrary to the patient’s wishes might be justified in the wider public interest. Examples may include where there are child protection or safeguarding concerns, or if a patient acts in a way likely to put others at risk and cannot be dissuaded from doing so. Risky behaviour could include when you are aware a patient is driving a car when medically unfit to do so. The Medical Defence Union (MDU) website has further advice on what to do in this situation.

In such cases it’s appropriate to discuss any proposed disclosure with the patient before you make it, unless this would undermine the purpose of the disclosure, as well as telling the patient (preferably in writing) afterwards.

In all such cases, you should carefully document your reasons for sharing the information (or not sharing it if that is your decision) and your discussions with the patient. You should share the minimum amount of information necessary and relevant for the intended purpose.

Patients who lack capacity

If a patient lacks capacity to make an informed decision about their information being shared, then it is generally acceptable to do so if:

• It is of overall benefit to the patient;

• It is required by law;

• The wider public interest in disclosing the information outweighs the patient’s own interest in it remaining confidential.

Capacity is both time specific and decision specific. While a patient may lack capacity for some decisions, they may not lack capacity to be involved in decisions about disclosure of their records. Please get advice from the MDU or your medical defence organisation if considering sharing information about a patient who lacks capacity to give their consent.

It can be challenging to weigh up a decision to share information without consent where there is no legal obligation

Disclosing records after a death

Your ethical obligation of confidentiality continues after a patient has died, but it may be still acceptable to share information about them. This may depend on:

• Who has asked for the information;

• What information is being sought;

• What that information is to be used for.

It is important to consider any wishes the patient expressed before dying, as well as whether sharing the information would be beneficial or distressing to their family. Consider whether providing relevant information could help the family understand the circumstances of the patient’s death or assist in managing the patient’s estate.

This would not usually mean that the person making the request is entitled to see the entire medical record. It is usually enough to only disclose information relevant to a specific need. It may be appropriate, for example, to share relevant information about a patient’s final illness to help their family to understand the cause and circumstances of their death.

There is specific guidance on access to records relating to deceased persons.

These are often finely balanced decisions and MDU members are welcome to contact us for specific advice.

MDU membership gives State-indemnified doctors access to expert guidance with medico-legal dilemmas like confidentiality concerns. We can also support members with patient complaints, Medical Council investigations, inquests and criminal matters. To find out more see www.themdu.com/ireland.