The police explained that under the Data Protection Act 1998 (DPA) section 29(3), personal data are exempt from the usual non-disclosure provisions when the data is required specifically for the prevention or detection of crime. The police suggested that consent was not necessary, and indeed that the GP would interfere with their investigation if he informed the patient about their request for information by asking for his consent.
The GP had concerns about disclosing this information without his patient's consent and called the MDU for advice.
The adviser explained that the GP should seek more information from the police before deciding if he should disclose the information they were seeking. For example, what sort of crime was involved and why the police were asking him for contact details when some of the information might be available from other sources. The GP said he had asked the police to give him more information but they had refused.
The adviser explained that this put the GP in a difficult position in considering if he had enough information to justify disclosure of the confidential information. The adviser explained that although the police had cited the DPA, the GP would also need to consider his legal and ethical duty of confidentiality.
In respect of the DPA, while section 29(3) did, indeed, release a data holder from the obligation to protect data from disclosure, it did not require him to disclose it, so he would need to consider his other obligations. The GMC ethical guidance for doctors on confidentiality also applied and the GMC could apply sanctions, including erasure from the register, for serious or persistent failure to follow it.
An exception to a medical practitioner's ethical obligation to maintain patient confidentiality may be when failure to do so would expose the patient or others to the risk of death or serious harm. In its guidance on Confidentiality (2009), the GMC explains that such a situation might arise when a disclosure would be likely to assist in the prevention, detection or prosecution of a serious crime.
Serious crime is not defined in the GMC's confidentiality guidance, although footnote 23 to paragraph 54 refers to the NHS Code of Practice on Confidentiality, which includes 'crimes that involve substantial financial gain or loss' in its list of crimes regarded as serious. In situations where the patient withholds consent, or it is not practicable or permissible to obtain consent, the doctor needs to consider whether, in accordance with GMC guidance, disclosure may be justified in the public interest.
If this is so, the information provided should be the minimum necessary for the purpose, and a clear note should be made in the records detailing the reason for disclosure without patient consent and the attempts made to obtain it. In this situation it would be important to document that the police had indicated that if the doctor sought his patient's consent, he would interfere in their investigations.
The GP member was advised that a patient's identity, contact details and the dates he or she attended the surgery are confidential. In reaching a decision about whether disclosure of such information without patient consent is justifiable, the doctor should consider the nature of the crime. It may, for example, be more difficult to justify releasing information to assist with the investigation of alleged financial fraud against an institution, than a crime against a vulnerable individual such as an elderly person.
In the absence of any information to help him make these decisions, it was difficult for the GP to reach any conclusion other than that the police could not rely solely on the DPA and that they had given him no grounds to consider breaching his duty of confidentiality. He explained this to the police and they withdrew their request.
This page was correct at publication on 17/12/2010. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.