Confidentiality is a cornerstone of the doctor-patient relationship, but it is not absolute. Disclosing patient information without consent can only be justified in limited circumstances. Even if a request is from the police, your legal and ethical duties of confidentiality still apply.
Examples of statutes that require you to disclose or volunteer information to the police include the Road Traffic Act 1988 and the Terrorism Act 2000. Another situation in which you are obliged to disclose information applies if in the course of your work you discover an act of Female Genital Mutilation (FGM) in a girl under the age of 18 in England and Wales.
In other circumstances, however, you will need to balance the potential harm to the patient and to your professional relationship against the benefits of releasing the information. If the police request information, you will need to consider whether overriding your duty of confidentiality can be justified in the best interest of the wider public.
The following scenarios are based on queries raised by MDU members.
Road traffic incident
A GP was approached by the police asking if she could identify a driver from a CCTV photograph. The driver had apparently, seconds after the photo was taken, been involved in an incident in which a pedestrian was injured after the car emerged from the surgery car park. Witnesses at the scene had reported that the driver was driving recklessly.
The police said they urgently needed information to identify the driver. The GP recognised the driver as one of her patients and wondered whether she should give his name and address to the police.
MDU advice
There are limited circumstances that legally oblige you to disclose or volunteer information to the police.
One such situation is the legal requirement imposed by the Road Traffic Act 1988. This allows the police, under certain circumstances, to require information from anyone, including doctors, which may lead to the identification of a driver alleged to have committed a road traffic offence. In fact, under the Act, it is an offence to fail to comply with such a police requirement.
The GMC expects you to disclose information if required by law but only information relevant to the request and only in the way required by the law. The GMC's confidentiality guidance states that you should also 'tell patients about such disclosures, wherever practicable, unless it would undermine the purpose of the disclosure to do so'.
In this situation, the GP has a legal obligation to provide information to the police to identify the driver (usually name and address). The GP was advised to make a record of the conversation with the police, noting what information was disclosed and why.
A patient in custody
A police officer attended a GP practice. The officer explained that a patient was being held in custody and had committed a serious crime. He asked for a copy of the patient's medical records. The officer quoted section 29(3) of the Data Protection Act 1998 (DPA), stating that this waived the need for patient consent.
MDU advice
The provision referred to can in appropriate circumstances mean that there will not be a breach of the Data Protection Act in supplying information to the police.
That does not mean, however, that you are required to give that information. Your ethical duty of confidence still applies. You will need to have consent from the patient, or determine that in the absence of consent, the disclosure would nonetheless be in the public interest.
GMC guidance says that confidential information may be disclosed in the public interest without the patient's consent, or in exceptional circumstances where consent has been withheld, 'if the benefits to an individual or to society outweigh both the public and the patient's interest in keeping the information confidential'.
In other words, you must balance the potential harm to the patient and to the overall trust between patients and doctors caused by releasing the information, against the benefit that disclosure might bring to an individual or society.
One such example arises when failure to disclose the records 'may expose others to a risk of death or serious harm'. In this case, the patient was in custody and could not pose a threat to the public. Therefore the patient's consent should be sought in the first instance.
The MDU adviser suggested that the practice manager ask the police officer whether the police had requested the patient's consent, or to establish any other reason why they could not get consent. The adviser also suggested that the practice manager ask the police what the alleged offence was, specifically why they needed information from the clinical records and what type of information they were seeking. This additional information would help the practice make a decision as to whether or not they could justify disclosure of the records and, if appropriate, only disclose relevant portions of those records.
The practice was advised to record their reasons for the decision they made either to disclose or withhold the requested information, in case they were later called upon to justify the decision.
Disclosure in the public interest
A GP saw a patient he had been treating for headaches. The patient was very upset during the most recent consultation and said media coverage of historic child abuse brought back memories of when he was abused as a child. He went on to confess that he had recently abused a 13-year old friend of his daughter's when she was having a sleepover at their house. He asked the GP not to tell anyone as he would never do anything like that again.
The GP was shocked at the confession and contacted the MDU to ask if he should tell the police.
MDU advice
The MDU adviser told the GP that he would need to judge whether failure to disclose this information might 'expose others to a risk of death or serious harm'. One example of when such disclosure is likely to be appropriate arises when a patient has confessed to a serious crime, such as child abuse.
The GMC does not define serious crime in its guidance, but refers to examples given in the NHS Confidentiality Code of Practice. These include murder, manslaughter, rape, kidnapping and child abuse or neglect causing significant harm.
As with any situation in which you are considering a disclosure in the public interest, the GMC says that you must balance the effect of a disclosure on the patient and on trust in doctors generally, against the potential benefits arising from release of information. When you consider that failure to disclose would leave a risk so serious that it outweighs the patient's and the public interest in confidentiality, you should disclose relevant information promptly to an appropriate person or authority.
Despite the man's reassurances, he had confessed to a serious crime and children may well be at risk.
If you decide to disclose without consent, the GMC says that you should inform the patient first, if it is safe to do so.
This page was correct at publication on 17/11/2017. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.