Confidentiality Summary

Core Principles

  • Trust is essential in doctor-patient relationships
  • Confidentiality encourages patients to seek help
  • Balance between privacy and necessary information sharing

GMC Principles

  • Use minimum necessary information
  • Protect information from improper access
  • Comply with data protection laws
  • Support patient access to their information

When to Disclose

  • Patient consents (explicitly or implicitly)
  • Required by law
  • Overall benefit to incapacitated patient
  • Justified in public interest

Legal Framework

  • Common Law duty of confidentiality
  • GDPR & Data Protection Act 2018
  • Human Rights Act 1998 (Article 8)
  • Freedom of Information Acts

Protection Measures

  • Secure storage of records
  • Password protection
  • Avoid discussions in public areas
  • Legitimate access only

Confidentiality and Data Protection

Medical guidelines for protecting patient information and legal responsibilities

Importance of Confidentiality in Healthcare

Trust is an essential part of the doctor-patient relationship and confidentiality is central to this. Patients may avoid seeking medical help, or may under-report symptoms, if they think their personal information will be disclosed by doctors without consent, or without the chance to have some control over the timing or amount of information shared.

Dual Responsibilities

Doctors are under both ethical and legal duties to protect patients' personal information from improper disclosure. But appropriate information sharing is essential for providing safe and effective care.

Risk of Non-Disclosure

Patients may be put at risk if those providing their care do not have access to relevant, accurate and up-to-date information about them.

Balancing Act

Healthcare professionals must balance the duty of confidentiality with the need to share information for direct care purposes and when required by law.

GMC Confidentiality Principles

Fundamental Guidelines

The General Medical Council provides clear principles to guide healthcare professionals in managing patient information responsibly and lawfully.

Use the minimum necessary personal information. Use anonymised information if it is practicable to do so and if it will serve the purpose.
Manage and protect information. Make sure any personal information you hold or control is effectively protected at all times against improper access, disclosure or loss.
Be aware of your responsibilities. Develop and maintain an understanding of information governance that is appropriate to your role.
Comply with the law. Be satisfied that you are handling personal information lawfully.
Share relevant information for direct care in line with the principles in this guidance unless the patient has objected.
Ask for explicit consent to disclose identifiable information about patients for purposes other than their care or local clinical audit, unless the disclosure is required by law or can be justified in the public interest.
Inform patients about disclosures of personal information you make that they would not reasonably expect, or check they have received information about such disclosures, unless that is not practicable or would undermine the purpose of the disclosure.
Support patients to access their information. Respect, and help patients exercise, their legal rights to be informed about how their information will be used and to have access to, or copies of, their health records.

When You Can Disclose Personal Information

Confidentiality is an important ethical and legal duty but it is not absolute. You may disclose personal information without breaching duties of confidentiality when any of the following circumstances applies:

  • The patient consents, whether implicitly or explicitly for the sake of their own care or for local clinical audit, or explicitly for other purposes.
  • The patient has given their explicit consent to disclosure for other purposes.
  • The disclosure is of overall benefit to a patient who lacks the capacity to consent.
  • The disclosure is required by law, or the disclosure is permitted or has been approved under a statutory process that sets aside the common law duty of confidentiality.
  • The disclosure can be justified in the public interest.

Requirements When Disclosing Information

When disclosing information about a patient you must:

  • Use anonymised information if it is practicable to do so and if it will serve the purpose
  • Be satisfied the patient has ready access to information explaining how their personal information will be used and that they have the right to object
  • Get the patient's explicit consent if identifiable information is to be disclosed for purposes other than their own care or local clinical audit, unless the disclosure is required by law or can be justified in the public interest
  • Keep disclosures to the minimum necessary for the purpose
  • Follow all relevant legal requirements, including the common law and data protection law

Managing and Protecting Personal Information

Unintentional Disclosures

Many improper disclosures of patient information are unintentional. Conversations in reception areas, at a patient's bedside and in public places may be overheard. Notes and records may be seen by other patients, unauthorised staff, or the public if they are not managed securely.

Protection Guidelines

Secure Information Handling

Make sure any personal information about patients that you hold or control is effectively protected at all times against improper access, disclosure or loss. Do not leave patients' records unattended and do not share passwords.

Legitimate Access Only

Do not access a patient's personal information unless you have a legitimate reason to view it. Access should be limited to those directly involved in patient care.

Discretion in Communication

Do not share personal information about patients where you can be overheard, for example in a public place or in an internet chat forum. Minimize breaches of confidentiality as much as possible.

Sources of Law on Confidentiality, Data Protection and Privacy

Common Law

Information acquired by doctors in their professional capacity will generally be confidential under the common law. This duty is derived from court judgments establishing that information given or obtained in confidence should not be used or disclosed further except in certain circumstances.

Permitted disclosures: patient consent, required by law, or justified in the public interest.

Data Protection Laws (UK)

The General Data Protection Regulation (GDPR), supplemented by the Data Protection Act 2018, regulates the processing of personal data about living individuals in the UK.

Key authority: Information Commissioner's Office (ICO) - www.ico.org.uk

Personal data definition: any information relating to an identified or identifiable natural person.

GDPR Principles

Personal data must be:

  • Processed lawfully, fairly and transparently
  • Collected for specified, explicit purposes
  • Adequate, relevant and limited to what is necessary
  • Accurate and kept up to date
  • Kept no longer than necessary
  • Processed securely

Human Rights Act 1998 UK

Incorporates the European Convention on Human Rights (ECHR) into UK law. Article 8 protects a person's right to respect for their private and family life.

Balance test: Any interference with privacy must be necessary and proportionate, balancing individual rights against public interests.

Freedom of Information Acts

The Freedom of Information Act 2000 (England, Northern Ireland and Wales) and Freedom of Information (Scotland) Act 2002 give public access to information held by public authorities.

Note: These acts do not provide access to personal information like health records, which are covered by data protection laws.

Practical Implications

Healthcare professionals must be aware that even if a disclosure is permitted under common law, it must still satisfy the requirements of data protection law. The legal frameworks work together to protect patient information while allowing necessary sharing for care and other legitimate purposes.