Introduction
The duty of confidentiality as between doctor and patient enjoys both ethical and legal recognition. The duty is founded upon the notion that unless patients are confident that details about their condition and treatment will be kept secret, they may be unwilling to give doctors the information they need in order to provide good care. That is to say, the relationship between a doctor and his patient should be based on the moral principles of loyalty and fair dealing. A doctor is therefore under obligation of confidence to his patient with respect to personal information obtained for the purpose of treatment. The doctor must not disclose such information to others without the patient’s consent. This essay examines the ethical and legal bases of the duty of confidentiality as well as the circumstances where, in the absence of consent, the doctor can justify disclosure of personal information.
Ethical basis of the duty
Apart from the fact that doctors swear the Hippocratic Oath, promising to keep silence on whatever they see or hear from their patients[1], almost all associations of medical and healthcare professionals have introduced guidance on the use and protection of patient information. For example, according to the General Medical Council (GMC) guidance,[2] confidentiality is central to the trust between doctors and patients. The guidance states that if doctors are asked to provide information about patients they should seek patient’s consent to disclosure wherever possible, whether or not they judge that patients can be identified from disclosure. Where identifiable data is needed for any purpose other than the provision of care or clinical audit, members of the GMC are also required to seek patients’ express consent to disclosure of information. A serious breach of the guidelines by a doctor constitutes professional misconduct and the doctor may be struck of the professional register.
The Department of Health has also taken upon itself the responsibility of ensuring that confidentiality of personal information is respected within the National Health Service (NHS). The Department introduced a code of practice[3] for doctors and all other NHS staff with regard to confidentiality. Essentially, the NHS ensures that ‘all patient information is processed fairly, lawfully and as transparently as possible’ in order that patients will, among other things, be confident to consent to disclosure and use of their personal information. The duty of confidentiality is also recognized worldwide. The World Medical Association (WMA) Code of Ethics requires that physicians respect patients’ right to confidentiality.[4] Clearly, ‘respect’ in this context means that not only must doctors avoid disclosing information but they must also take steps to prevent disclosure of information. It is ethical though, according to the WMA code of ethics, to disclose confidential information when the patient consents to it.
Legal basis of the duty
A doctor’s duty of confidentiality is also based on common law and statute law. It must however be mentioned that the law relating to doctor-patient confidentiality is not clear. Case law illustrates that a doctor will breach his duty of confidentiality if others obtain confidential information about patient through his negligent conduct. Case law further illustrates that once personal information was received on the express basis that it was confidential, there would be a breach of confidence if the information was revealed to others. The court’s decision in Stephens v Avery and Others[5] attests to this fact. In every case the court will also determine whether the disclosure of information could cause harm to the person. Thus, in Campbell v MGN[6], the House of Lord held:
The potential for the disclosure of the information to cause harm was an important factor, to which a good deal of weight had to be attached, in the assessment of the extent of the restriction that was needed to protect the claimant's right to privacy.
It is therefore clear that the duty of confidentiality will not only be breached where there is a confidential relationship between the person who gave the information and the one who received it and revealed it to others. It is enough if it can be shown that (i) the information was reasonably expected to be private or confidential; and (ii) disclosure would be highly offensive to a reasonable person. The House of Lord’s decision in the Campbell v MGN case is in line with the decision in the Australian case of Australian Broadcasting Corporation v Lenah Game Meats Pty Ltd[7] which illustrates that there will be a breach of confidence if disclosure would give substantial offence to the person. It is also the case that in determining whether there has been breach of confidence the court may have regard to relevant professional guidelines.[8]
The Human Rights Act 1998 also enables a person to bring a claim against a public authority for breach of his right under the European Convention on Human Rights (ECHR). Article 8 of the ECHR guarantees the right to private and family life and breach of confidentiality can be a cause of action under Article 8. The claimant in the Campbell v MGN case, for example, invoked article 8 in her claim. Other statutes which place people under obligation in relation to confidential information include the Data Protection Act 1998. Under section 10 of the 1998 Act, for example, an individual has the right to prevent processing of data that is likely to cause damage or distress to him.
Disclosure without patient’s consent
As explained above, it is only when a patient is confident that information he/she gives to the doctor about his/her condition will be kept secret that he/she will be willing to tell doctors the information they need in order to provide good care. However, this does not lead to the conclusion that information about a patient should never be disclosed without the patient’s consent. It is both ethically and legally permissible to disclose information about a patient without the patient’s consent. As noted above, where identifiable data is needed for the purpose of clinical audit, information can be disclosed without the patient’s consent. The health care system is such that without disclosure of medical information to others, the system can hardly work efficiently. Arguably, what matters is that disclosure of personal information should not be done in bad faith.
Confidentiality is therefore not a qualified right. In certain circumstances, personal information can be disclosed without the person’s express consent or permission. Without a patient’s consent, a doctor will be justified in breaking confidentiality in the patient’s own interest. This usually happens when the doctor has to consult with other doctors or health care professionals so as to find the best treatment for the patient. The doctor, however, still has a duty to persuade the patient to consent to disclosure of the information and also to tell the party receiving the information that the information is given in confidence. The doctor may also disclose information to an unrelated third party where he has a reason to suspect that the patient is, for example, a victim of physical or sexual abuse. The case of C v Cairns[9] suggests that a doctor will not be liable in negligence for failing to report physical or sexual abuse to a third party where he did not believe that disclosure of information was in the patient’s best interest.
When there is an overriding public interest in disclosure a doctor will be justified in disclosing information about patient. It must be borne in mind that there is the public interest in protecting confidence as well as the public interest in disclosure. Where public interest in disclosure outweighs public interest in protecting confidence, disclosure of information without the patient’s consent will be justified as being in the public interest. The case of Lion Laboratory Ltd v Evans[10] shows that it is in the public interest to disclose personal information without the person’s consent where there has been wrongdoing by the person. Similarly, in A-G v Guardian newspaper (No 2)[11] it was made clear that the right to confidence would not be upheld when to do so would be to cover up wrongdoing.
Doctors can also justify disclosure as being in the public interest if there is a threat of serious harm to others. In W v Egdell[12] the public interest in disclosure of information was found to have outweighed the public interest in the duty of confidentiality. The court ruled that suppression of information would have deprived others (i.e. hospital and the Secretary of State for Information) of information which was relevant to questions of public safety. It follows that a doctor will be justified in revealing information to appropriate authorities if he believes that his patient is likely to be more dangerous than other doctors believe. However, disclosure must be proportionate in extent and made to the appropriate authorities. The GMC Guidance also allows doctors to disclose information without the patient’s consent where there is a risk of serious harm to others. According to the Guidance:
Disclosure of personal information without consent may be justified in the public interest where failure to do so may expose the patient or others to risk of death or serious harm. Where the patient or others are exposed to a risk so serious that it outweighs the patient’s privacy interest, you should seek consent to disclosure where practicable. If it is not practicable to seek consent, you should disclose information promptly to an appropriate person or authority.[13]
There is also a threat of serious harm to others where a patient is infected with a disease which can be easily transmitted to others such as a sexual partner. One of such diseases is HIV. The GMC has issued guidance relating to ‘serious communicable diseases’ which directs doctors to disclose information about a patient, whether living or dead, so as to protect a person from risk of death or serious harm. Doctors may reveal information about a patient with HIV where they have reason to believe that the patient has not informed a known sexual contact of him/her of the disease and ‘cannot be persuaded to do so’. Doctors should however tell the patient, according to the guidance, before they make the disclosure, and must be prepared to justify a decision to disclose information. The guidance requires them not to disclose information to others such as relatives who are not at risk of infection.[14] The Court emphasised in the Egdell case that disclosure may be made only to those whom it is necessary to tell in order to protect the public interest; and to justify disclosure the risk must be ‘real’ rather than fanciful.[15] In X v Y[16] the names of two doctors being treated in hospital for AIDS were improperly disclosed. The health authority sought and obtained an injunction to prevent their publication by a newspaper. The case illustrates that a doctor or other health care worker being treated for a serious communicable disease is entitled to the same confidentiality as other patients but disclosure may be necessary in the public interest to protect others.
Guidance issued by he Department of Health specifies conditions which have to be satisfied in order for disclosure of information to be justified as helping to tackle crime. According the guidance, disclosure will be justified where the task of preventing, detecting or prosecuting crime would be seriously prejudiced or delayed. Disclosure will also be justified where:
Information is limited to what is strictly relevant to a specific investigation; there are satisfactory undertakings that the information will not be passed on or used for any purpose other than the present investigation[17]
Similarly, guidance issued by the GMC provides that disclosure that will be justified where it may assist in prevention or detection of a serious crime.[18] The fact that patient information is relevant to prevention of crime is demonstrated in a number of cases. In R v Singleton[19] for example, it was made clear that a police officer may obtain access to excluded material or special procedure material for the purposes of a criminal investigation when disclosure is in the best interests of a child or young person or vulnerable adult who does not have the maturity or understanding to make a decision about disclosure. However, It must be stressed that only the prevention of ‘serious crime’ may justify disclosure of confidential information. In every case, a balance will be struck between public interest in maintaining confidential information and public interest in disclosing it.
The law also permits disclosure of confidential information for conduct of medical research, teaching and clinical audit. The GMC guidance directs that a patient’s consent should be obtained, where possible, for disclosure of personal information even where disclosure of information about patients for the purpose of research, medical or clinical audit, education or training, or for public heath safety is unlikely to have personal consequences for the patient. The guidance further states that doctors may anonymise records but where it is not practicable to obtain patient’s express consent or anonymise the records, data may be disclosed without consent. The case of R v Department of Health ex parte Source Informatics Ltd[20] makes clear that it is not a breach of confidence to disclose anonymised patient information. In order that patients would understand the purpose for which information about them is to be disclosed, the DoH guidance states:
All NHS bodies must have an active policy for informing patients of the kind of research purposes for which information about them is collected and the categories of people or organisations to which information may need to be passed.[21]
A doctor may also not incur liability or face disciplinary action for disclosing clinical records for administrative or financial audit purposes, according to the GMC guidance. The guidance requires that financial or other administrative data be recorded separately from clinical information and provided in anonymised form, wherever that is possible. This is clearly in line with the decision of the European Court of Human Rights in MS v Sweden[22] , where it was held that disclosure to monitor proper use of public funds was necessary for the ‘economic well-being of the country’. Furthermore, section 98 of the National Health Service Act 1977 enables financial auditors to access patient information. Disclosure of patient information for purposes, such as financial audit purpose can be said to be something that is done with the patient’s implied consent. This is because, as stated above, without access to patient information by certain third parties, medical practice or hospital cannot operate efficiently.
Disclosure of genetic information may also be justified in the public interest. The justification lies in the fact that personal genetic information may be relevant to the health of a family member. According to the British Medical Association (BMA), much as the general principles of confidentiality apply equally to genetic information, genetic testing of one individual has relevance for other family members. It is not clear as to the level of confidentiality required for genetic information. However, the view of the BMA is that, with regard to genetic information, the doctor’s duty of confidentiality should only be breached when there is a legal requirement or an overriding public interest.
Apparently, a doctor owes no duty of confidentiality where the patient is a child, that is, someone who is incompetent to make a medical decision. Usually, a child under the age of 16 does not have the right to autonomy. A doctor will therefore be justified in disclosing information about such a patient to his/her parents. However, where a child is under the age 16 but is found to be mentally competent, he/she can prevent disclosure of personal information. The fact that a competent child who is able to understand the nature of the application for access to medical records is entitled to prevent their records being disclosed to parents is endorsed by the Data Protection (Subject Access Modification) (Health) Order 2000.[23] The burden is on the doctor to ‘justify excepting the duty of confidence’.[24]
Conclusion
It is clear from the above discussion that in certain situations, a doctor can depart from the duty of confidentiality. In other words, he will be justified in disclosing information about patient without the patient’s express consent. From the patient’s point of view, departure from the duty of confidentiality constitutes a breach of the principles of morality and fair dealing on which the duty is based. Clearly, the fact that information about a patient can be revealed to third parties without the patient’s express consent can discourage many people from giving doctors and other health care professionals adequate or correct information about their condition with the consequence that good care may be rendered impossible. It is argued that breach of confidentiality does not only harm the individual concerned but is also capable of affecting ‘the general public’s willingness to trust medical professionals and this can harm the health of the nation’.[25]
On the hand, although breach of confidentiality is defensible in certain situations, the restrictions imposed on disclosure of information, particularly by statutes, put more pressure on the decisions of the individual practitioner. For example, not only does the Data Protection Act 1998 gives the patient the right of access to their health records but it also enables the patient to discover if their data is being processed. It is argued that the ‘individualistic legal approach to medical confidentiality is too narrow to reflect the complex situations that exist in health care settings’.[26] It is further argued that confidentiality between patient and doctor should be a thing of the past; instead, the focus should be on protection of records and how to safeguard against the use of medical data for improper purposes.[27] The fact that the Human Rights Act 1998 enables persons to bring actions against public authorities for failing to uphold a person’s right to respect for private and family life also means that there will be more litigation where patients claim that confidentiality has not been respected.
References
[1] See for example, Kennedy, I. and Grubb, A. (2000) Medical Law, London: Buttherworths, p 1047 for the full statement.
[2] General Medical Council Confidentiality: Protecting and Providing Information (2000)
[3] Confidentiality: NHS Code of Practice. November, 2003
[4] World Medical Association: International Code of Ethics, 14. 10.2006
[5] [1988] 2 All ER 477
[6] [2004] UKHL 22
[7] (2001) 185 ALR 1
[8] See for example, Re C [1996] 1 FCR 605
[9] [2003] Lloyd’s Rep Med 90 QB
[10] [1984] 2 All ER 417
[11] [1988] 3 All ER 545
[12] [1990] 1 All ER 835
[13] General Medical Council Confidentiality: Protecting and Providing Information (2000)
[14] General Medical Council Serious Communicable Diseases (1997)
[15] See Bingham LJ’s judgment, para 853
[16] [1988] 2 All ER 648
[17] Department of Health The Protection and Use of Patient Information (1996)
[18] Ibid. n 13
[19] [1995] 1 Cr App rep 431
[20] (1999) 52 BMRL 65
[21] Ibid. n 17
[22] (1997) 45 BMLR 133
[23] SI 2000/413, article 5
[24] Ngwanga, C. and Chadwick, R. ‘Genetic Information and the Duty of Confidentiality: Ethics and the Law’ (1993) 1 Med Law Int 73
[25] Hall, M. ‘Law, Medicine and Trust’ Stanford Law Review, 2002, 55:463
[26] Gilbar, Roy, Medical Confidentiality with the family the Doctor’s Duty Considered, Int. J.L.P.F. 2004 18(2), 195-213
[27] See for example, Gostin, L. ‘Health Information Privacy’ Cornell Law Review 1995, 80:451
Bibliography
Herring, J. (2008) medical Law and Ethics, Oxford: Oxford University Press
Kennedy, I. and Grubb, A. (2000) Medical Law, London: Butterworths
Mason, J.K. and Laurie, G.T. (2006) Mason & McCall Smith’s Law and Medical Ethics, Oxford: Oxford University Press
Gilbar, R. ‘Medical Confidentiality with the family the Doctor’s Duty Considered’, Int. J.L.P.F. 2004 18(2), 195-213
Hall, M. ‘Law, Medicine and Trust’ Stanford Law Review, 2002, 55:463
Gostin, L. ‘Health Information Privacy’ Cornell Law Review 1995, 80:451