Electronic transmission of data is not totally secure or foolproof.
Patients need to know that it may not be possible to send their data safely through these media.

Video and audio recordings

You need a patient's consent if you intend to take any visual images (video or photographs, for example) or make audio recordings of them. It's important the recordings don't compromise the patient's privacy or dignity and are only used for the purpose for which consent was granted. They must also be stored securely.

The patient must give their consent freely, without any undue pressure or coercion. When seeking consent, you should make clear what secondary uses (if any) the recordings will have, such as education, and that the recordings will be anonymised or coded for this purpose. Make a careful note of the discussion in the patient's notes.

Recordings made for clinical purposes are part of the clinical records, and subject to the same duty of confidentiality. Clinical recordings should not be used for teaching purposes without consent if the patient is identifiable. This requirement does not extend to other media, such as anonymised pathology slides or X-rays.

Recordings for teaching purposes made since 1997 require consent from the patient. Recordings for teaching purposes made before 1997 might not have been made with appropriate consent, and should only be used if patients are not identifiable. Doctors with old recordings of this nature are advised to replace them with new recordings made with the patient's consent.

Emails, online chatrooms and faxes

Information should be sent and received securely. Emails, including email appointment systems, may not be a secure form of communication. You should make your email system as safe and confidential as you can, and anonymise and encrypt data if possible. You may want to consider other means of communication if you have to transmit sensitive patient information to other medical practitioners.

Online forums and chatrooms are popular, but while professional social media sites and closed forums can be useful places to exchange thoughts on current practice, you must be careful not to breach patient confidentiality by discussing specific cases.

Individual pieces of information may not be sufficient to identify a patient, but the sum of information could be enough to identify a patient or someone close to them. It's also possible for information to be copied and published elsewhere without your consent.

Confidential faxes should utilise 'safe haven' systems. A safe haven is either a secure location or an agreed set of administrative arrangements in place within an organisation to ensure the safe and secure communication of confidential information.

Medical advice lines

Calls by patients to medical advice lines or similar services are potentially sensitive, and callers need to know their call may be recorded. No call from a patient should be secretly recorded. We advise caution when considering taking part in this type of activity and to call us for guidance.

Television, radio, internet and print

There are additional issues to consider when seeking patient consent to recordings for broadcast or in other media accessible by the public.

A patient's written permission is required for all recordings for use in publicly accessible media, including medical journals. This applies whether or not you consider the patient is likely to be identifiable.

The position is slightly different if the patient has died. Some information may be published, depending on whether:

the information is already in the public domain
the information can be anonymised
the patient gave consent before death.

Before making any arrangements for individuals or organisations to film patients in a healthcare setting, you need to inform your employing or contracting body, and the organisation in which patients are being treated (if this is different). You should obtain appropriate permission for the recording. Within the NHS, a contract with the filmmaker will normally be required.

When a patient is to be recorded for television or other public media, you should make sure the patient has properly given their consent, even if you're not personally responsible for obtaining it.

When seeking the patient's consent, you'll need to consider their vulnerability and whether they might want to withhold consent but are reluctant to do so for fear of upsetting their treating doctor.

A patient who has agreed to the recording may also want to control how the recording is used. They will need to get agreement on future use in writing from the owners of the recording before recording begins.

Special consideration should be given to patients who are unable to give permission themselves - have the programme makers taken sufficient account of the patient's interests, wellbeing, privacy and dignity? If you have concerns about any of these issues, you might want to stop recording and consider withholding cooperation.

If you're in any doubt about the medico-legal position on confidentiality relating to photographic, recording or computer technology or dealing with the media, please call the MDU for advice.

Responding to the press

Personal criticism in the press or on social media can be very distressing, particularly if the comments are made by a patient or their representative. However, this does not remove your duty of confidentiality to the patient, and you must not put confidential patient information into the public domain.

It may constitute a breach of confidentiality even to confirm or deny information, so you need to exercise considerable caution when dealing with journalists.

If you're approached by the media for information about a patient-related matter, contact the MDU press office for further advice.

See also our quick guides on dealing with the media and dealing with online criticism.

Images for public display

Recordings originally obtained with the patient's consent may be displayed in public without further consent, as long as the recordings are effectively anonymised. This includes photographs of images from pathology slides, X-rays, laparoscopic or ultrasound images or images of internal organs.

However, where the patient has an unusual condition or presentation that might identify them, it's good practice to seek the patient's consent first before publishing.

Questions and answers

I've just had a call from a journalist asking me to confirm that a patient still has health problems as a result of inhaling smoke in a house fire. Apparently the patient is in dispute with the local council about rehousing.

The patient's asthma has been worse since the fire, and I want to help him if I can. What should I tell the journalist?

The law and the GMC are clear about a doctor's duty of confidentiality, even where the patient has put the information into the public arena. The GMC says, "Patients have a right to expect that information about them will be held in confidence by their doctors." This is true even if a patient puts their medical details into the public domain.

Just confirming that the man is a patient at your practice may in itself breach confidentiality. Even if you gained his consent to talk to the journalist, you may inadvertently reveal details he didn't consent to being released.

If you decide to go ahead, you will need to obtain the patient's consent. You'll also need to satisfy yourself he understands what you're going to say, and you may only discuss aspects of his condition for which you have consent.

You may prefer to explain that you're unable to comment because your duty of confidentiality to all patients prevents you from even confirming or denying that a person is a patient at your practice. If you need it, the MDU's press office can help you with your response.

I have been asked to take part in an online Q&A session about my specialist area, paediatrics. This has been set up by a local community group and I really want to help out.

If you're responding to individual letters, you need to consider that you may be creating a duty of care for patients you haven't seen or examined, in a situation where you may not have had all the information necessary to form a clinical judgement.

If you provide only general advice, it may still be relied upon by patients. Make sure the website includes a note stating that the medical advice you're providing is only general advice, and should not be used as a substitute for the advice patients receive on consulting their own doctor. You may still be called upon to justify the accuracy of any advice you give.

An important consideration is that of patient confidentiality. The GMC makes it clear that you're expected to obtain express consent from patients before publishing personal information about them, whether or not you believe the patient can be identified. You'll need to tell the patient exactly what you plan to publish in terms of case histories or other information, such as X-rays or photographs, and to respect their wishes if they don't give permission.

Also, registration with the GMC does not give you the right to practise medicine overseas. If you provide online advice to someone based overseas, you could be seen to be practising medicine in whatever place the person was when they asked you the question.

If so, you might need to be registered in that country. You would also need to be sure you had appropriate indemnity cover and complied with any relevant legislation - for example, in relation to prescribing. It may be helpful to ask those submitting questions to tick a box confirming they are based in the UK.

Last year, I filmed a consultation with a patient to use in teaching medical students. I now want to use this in a study day for non-medical healthcare workers, which will mean the video is seen by a wider audience than the patient may have originally thought.

Can I rely on the patient's original consent given that the video will still be used for teaching?

As you are aware, an audio-visual recording of a patient that identifies them may only be made with the patient's informed consent, or the parent/guardian's authority in the case of a minor. To give consent, the patient must be aware of the purposes of the recording, what it will then be used for, and the extent to which the recording will be broadcast.

The recording can only be used for the purpose and to the extent to which the patient consented. If you believe the patient's original consent might not encompass the way you're now intending to show the video, you should discuss it with them and get their express consent for these new circumstances. You must also respect a refusal to give consent.

Is it acceptable to leave voicemail messages for patients?

Because of your duty of confidentiality to your patients, you need to ask yourself if you can guarantee that any message you leave for a patient will remain confidential, assuming it even reaches them. There may be occasions when a patient has said they're happy with this method of communication, but apart from that you would need to consider whether it would be appropriate to leave a message.

You may not be certain you dialled the correct number, and even if you recognise the voice on the answerphone, you may not know whether somebody else could access the message. You would also need to consider if there was a better way of passing on the information that gave less scope for a breach of confidentiality.

If you did decide to go ahead, you would also need to have mechanisms to follow up the patient appropriately - for example, if they did not make an appointment as requested because for some reason they didn't pick up the message.

Education, media and confidentiality

Related articles

Membership in your pocket