A policeman attends your surgery asking for the entire medical records of one of your patients, a 23-year-old man who has a history of epileptic fits. He explains the patient has been involved in a road traffic accident in which two children died. The man has suffered a severe head injury and is not expected to regain capacity.
The officer says he needs the patient’s records to facilitate a police investigation into the circumstances that may represent a serious crime. He gives you a document which he states obliges you to disclose the patient’s medical records. The document refers to Section 29 of the Data Protection Act 1998 (DPA). You are reluctant to disclose the entire records, especially since you are aware that the record contains sensitive information that is unrelated to the accident.
Are you obliged to make the disclosure?
The GMC recognises the long understood and fundamental benefit to public and patients of the need to keep medical information about an individual confidential. Without the reassurance of confidentiality and the trust that patients put in doctors to maintain it, people may be discouraged from seeking advice and treatment. This may become a societal issue if it includes a failure to seek treatment for communicable disease for example.
Therefore, to decide whether disclosure is justified, you must weigh the harms that are likely to arise if you do not disclose information against the possible harm (both to the patient and also to the overall trust between doctors and patients) that may arise from the release of that information.
Consequently, GMC guidance is clear that a doctor may justifiably disclose personal information about a patient in the public interest if failure to do so may expose others to a risk of death or serious harm. However, you should still seek the patient’s consent if practicable or safe to do so and consider reasons for refusal.
The GMC recognise that such situations might arise when disclosure would be likely to assist in the prevention, detection or prosecution of serious crime. Although there is no agreed definition of serious crime, the GMC publication ‘Confidentiality: NHS Code of Practice (Department of Health 2003)’ gives examples of serious crime (including murder, manslaughter, rape and child abuse; serious harm to the security of the State and public order and ‘crimes that involve substantial financial gain or loss’).
Examples provided of crimes that are not usually serious enough to warrant disclosure without consent include theft, fraud and damage to property where loss or damage is less substantial.
The police often quote Section 29 of the DPA when requesting confidential information from doctors. Section 29 allows disclosure without consent in relation to the prevention and detection of crime and the apprehension or prosecution of offenders. However, Section 29 does not remove a doctor’s ethical duty of confidentiality, as stated by the GMC.
Consequently, doctors are strongly advised always to consider the need for express consent. If express consent is not possible or practicable or is refused in a situation where a doctor feels information may justifiably be disclosed to an appropriate person or authority (such as the police or DVLA) without consent, in the public interest, the minimum information only should be given. Furthermore, the GMC stress that you should still inform the patient before disclosure, if practicable and safe to do so.
In this case, to assist the police in the investigation of possible serious crime and where consent cannot be obtained, it would be reasonable for you to give the minimum necessary information.
· Always consider the need for express consent.
· A doctor may justifiably disclose personal information about a patient in the public interest if failure to do so may expose others to a risk of death or serious harm. However, you should still seek the patient’s consent if practicable or safe to do so and consider reasons for refusal.
· If express consent is not possible or practicable or is refused in a situation where a doctor feels information may justifiably be disclosed to an appropriate person or authority, without consent, in the public interest, the minimum information only should be given.
· Section 29 of the Data Protection Act 1998 does not remove a doctor’s ethical duty of confidentiality.
· Seek the advice of your medical defence organisation.
Dr John Holden, senior medical adviser with the UK-wide medical and dental defence organisation MDDUS.