As the GMC states, appropriate information sharing is an essential part of providing safe care.
It's reasonable to rely on implied consent for sharing information for clinical care as long as you have no reason to believe the patient has objected.
In practice, this means you should follow and understand these points of advice.
- Tell patients why, when and with whom information will be shared. You can do this through practice leaflets or waiting room notices, or in person.
- Once the patient understands how and why information might be shared, and has agreed to it, express consent is not required every time a patient is referred.
- If a patient objects to the sharing of personal information, this must be respected - except where disclosure would be justified in the public interest.
- In a medical emergency when a patient is unable to give consent or cannot be contacted, you should provide relevant information promptly to those treating the patient, unless the patient has expressly prohibited it. In doing so, you should always act in the patient's overall interests.
- When the patient becomes contactable or capable of understanding, you should let them know about the disclosure, if they might not reasonably have expected you to share the information.
Patients with a serious communicable disease
Those close to the patient
You should explain to patients with serious communicable diseases how they can protect others. If another person who is in close contact with a patient may be at risk of infection that is likely to cause serious harm, because the patient has not informed them and cannot be persuaded to do so, then minimal information may be disclosed to protect this person.
Ideally, you should tell the patient that you intend to disclose the information and why, to give them the opportunity to tell the other person. If it's possible to protect the patient's identity when tracing and notifying contacts, you should do so.
The healthcare team
If a patient with a serious communicable disease objects to other people within or outside the healthcare team being informed of their infection status, their wishes should be respected unless disclosure is necessary to protect healthcare workers or other patients from risk of death or serious harm.
These situations are likely to be very rare and disclosure without consent is unlikely to be justified where risk is managed through precautions that are routinely taken to protect healthcare workers and patients during exposure-prone procedures.
If a healthcare worker or anyone else suffers an exposure-prone injury (eg, a needlestick) while treating a patient who has a serious communicable disease, the patient's consent should be sought to disclose their infection status.
If the patient withholds consent, then information may be disclosed in the public interest - for example, to decide whether continued post-exposure prophylaxis is required.
Summary Care Records
Patients have the right to opt out of having their personal information placed on the national Summary Care Record database, and should be advised of this right by their GP or local primary care organisation.
Clinical audit
Doctors in clinical practice have a duty to participate in clinical audit and this will inevitably involve disclosing confidential information about patients.
The GMC draws a distinction between an audit undertaken by the team that provided care to the patient, and other organisations.
Clinical audit by the team that provided care or those who support them
Doctors may disclose identifiable information for local audit (by the team who provided care, or clinical audit staff) on the basis of implied consent if it is not practicable to use anonymised information. You must be satisfied that patients have been informed that data may be used in this way and that they understand their right to object but have not done so.
Clinical audit by another organisation
Information must be anonymised wherever practicable. Otherwise, express consent must be obtained from the patients concerned.
If a patient objects to information being used in this way, you should explain why the information is needed and how it may benefit their care. If withholding the information for audit would compromise safe care, you should explain this to patients and discuss the options open to them.
Third parties
Third parties, such as trusts, may request access to patient information for purposes such as rationalisation of records or updating IT information.
Practices may be pressed to disclose information and while patients might have given implied consent for the sharing of information within the wider healthcare team, you need to consider whether the patient would be surprised to know who their notes were being shared with and why.
There is unlikely to be any specific benefit to patient care, but there may be a wider public interest - for example, in keeping disease registers up to date.
Research
You should only disclose patient information for research if it has been properly approved by a research ethics committee and if there is a legal basis for disclosure.
Express consent to the use of records in research must be obtained in all but the most exceptional circumstances, such as where research involves patients unable to consent or where patients cannot be traced. In such circumstances, you should follow the GMC's guidance on disclosures in the public interest. Additionally, in England and Wales, section 251 of the NHS Act 2006 supports such disclosures.
The law around disclosures for research is complex and varies around the UK. Follow the GMC's guidance and if you receive a request for information that you are unsure of, please contact us for advice.
Financial audit and administration
Information for financial audit and administration should be anonymised wherever possible. If this is not possible and there is no legal basis for breaching confidentiality, you should obtain the patient's express consent to disclosure, informing them of the reasons for disclosure and their right to object.
It may be prudent to store financial and other administrative data separately from clinical information in computerised records so that sensitive data is not automatically displayed. This can help reduce the chance of an inadvertent breach of confidentiality.
Primary care bodies
In certain circumstances, GP contracts may require GPs to provide information to the primary care body or other authorised persons.
This includes patient records, and practices should take adequate steps to inform patients how their data will be used and that they have a right to object. You may wish to seek express consent from individual patients before disclosing identifiable confidential information to a primary care body.
It will be your decision whether to disclose or not. Before deciding, you will need to ensure that the primary care body has provided sufficient detail about the specific reasons and precise purpose for which the disclosure is needed.
If a primary care body seeks disclosure of clinical information against a patient's wishes and there is no statutory obligation to disclose, please contact us for advice.
Care Quality Commission
Care Quality Commission (CQC) in England has power to require access to patient information to help fulfil its statutory functions. CQC adheres to a code of practice on its use of confidential personal information, and a request to provide information necessary to fulfilling its statutory functions should be complied with. If you're in any doubt, we can help and advise.
Questions and answers
Do I still need consent to disclose information for research, if a research ethics committee has approved the project?
Express consent to the use of records in research must be obtained in all but the most exceptional circumstances, eg where research involves patients unable to consent or where patients cannot be traced. In such circumstances you should follow the GMC's guidance on disclosures in the public interest.
Additionally, in England and Wales, section 251 of the NHS Act 2006 supports such disclosures, but if it is possible to inform patients about the use of the data and respect any objections that might arise, you should do so.
Further guidance is available in the GMC's guidance on good practice in research.
This page was correct at publication on 20/04/2022. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.