As the GMC states, appropriate information sharing is an essential part of providing safe care.

It's reasonable to rely on implied consent for sharing information for clinical care as long as you have no reason to believe the patient has objected.

In practice, this means you should follow and understand these points of advice.

Tell patients why, when and with whom information will be shared. You can do this through practice leaflets or waiting room notices, or in person.
Once the patient understands how and why information might be shared, and has agreed to it, express consent is not required every time a patient is referred.
If a patient objects to the sharing of personal information, this must be respected – except where disclosure would be justified in the public interest.
In a medical emergency when a patient is unable to give consent or cannot be contacted, you should provide relevant information promptly to those treating the patient, unless the patient has expressly prohibited it. In doing so, you should always act in the patient's overall interests.
When the patient becomes contactable or capable of understanding, you should let them know about the disclosure, if they might not reasonably have expected you to share the information.

Summary Care Records

Patients have the right to opt out of having their personal information placed on the national Summary Care Record database, and should be advised of this right by their GP or local primary care organisation.

Clinical audit

Doctors in clinical practice have a duty to participate in clinical audit and this will inevitably involve disclosing confidential information about patients.

The GMC draws a distinction between an audit undertaken by the team that provided care to the patient, and other organisations.

Clinical audit by the team that provided care or those who support them

Doctors may disclose identifiable information for local audit (by the team who provided care, or clinical audit staff) on the basis of implied consent if it is not practicable to use anonymised information. You must be satisfied that patients have been informed that data may be used in this way and that they understand their right to object but have not done so.

Clinical audit by another organisation

Information must be anonymised wherever practicable. Otherwise, express consent must be obtained from the patients concerned.

If a patient objects to information being used in this way, you should explain why the information is needed and how it may benefit their care. If withholding the information for audit would compromise safe care, you should explain this to patients and discuss the options open to them.

Third parties

Third parties, such as trusts, may request access to patient information for purposes such as rationalisation of records or updating IT information.

Practices may be pressed to disclose information and while patients might have given implied consent for the sharing of information within the wider healthcare team, you need to consider whether the patient would be surprised to know who their notes were being shared with and why.

There is unlikely to be any specific benefit to patient care, but there may be a wider public interest - for example, in keeping disease registers up to date.

Research

You should only disclose patient information for research if it has been properly approved by a research ethics committee and if there is a legal basis for disclosure.

Express consent to the use of records in research must be obtained in all but the most exceptional circumstances, such as where research involves patients unable to consent or where patients cannot be traced. In such circumstances, you should follow the GMC's guidance on disclosures in the public interest. Additionally, in England and Wales, section 251 of the NHS Act 2006 supports such disclosures.

The law around disclosures for research is complex and varies around the UK. Follow the GMC's guidance and if you receive a request for information that you are unsure of, contact us for advice.

Financial audit and administration

Information for financial audit and administration should be anonymised wherever possible. If this is not possible and there is no legal basis for breaching confidentiality, you should obtain the patient's express consent to disclosure, informing them of the reasons for disclosure and their right to object.

It may be prudent to store financial and other administrative data separately from clinical information in computerised records so that sensitive data is not automatically displayed. This can help reduce the chance of an inadvertent breach of confidentiality.

Primary care bodies

In certain circumstances, GP contracts may require GPs to provide information to the primary care body or other authorised persons.

This includes patient records, and practices should take adequate steps to inform patients how their data will be used and that they have a right to object. You may wish to seek express consent from individual patients before disclosing identifiable confidential information to a primary care body.

It will be your decision whether to disclose or not. Before deciding, you will need to ensure that the primary care body has provided sufficient detail about the specific reasons and precise purpose for which the disclosure is needed.

If a primary care body seeks disclosure of clinical information against a patient's wishes and there is no statutory obligation to disclose, please contact us for advice.

Care Quality Commission

Care Quality Commission (CQC) in England has power to require access to patient information to help fulfil its statutory functions. CQC adheres to a code of practice on its use of confidential personal information, and a request to provide information necessary to fulfilling its statutory functions should be complied with. If you're in any doubt, we can help and advise.

Questions and answers

Do I still need consent to disclose information for research, if a research ethics committee has approved the project?

Express consent to the use of records in research must be obtained in all but the most exceptional circumstances, eg where research involves patients unable to consent or where patients cannot be traced. In such circumstances you should follow the GMC's guidance on disclosures in the public interest.

Additionally, in England and Wales, section 251 of the NHS Act 2006 supports such disclosures, but if it is possible to inform patients about the use of the data and respect any objections that might arise, you should do so.

Further guidance is available in the GMC's guidance on good practice in research.

Confidentiality and the healthcare team

Related articles

Membership in your pocket