Confidentiality and the healthcare team

Clinical information may need to be shared with other healthcare workers in the team to ensure proper care and treatment of a patient – but not for any other reason. Information is normally shared on a need-to-know basis.

  • Tell patients why, when and with whom information will be shared. You can do this through practice leaflets or waiting room notices, or in person.
  • Once the patient understands how and why information may be shared, and has agreed to it, express consent is not required every time a patient is referred.
  • If a patient objects to the sharing of personal information, this must be respected – except where to do so would put others at risk.
  • In the event of a medical emergency when a patient is unable to give consent or cannot be contacted, you should provide relevant information promptly to those treating the patient, unless the patient has expressly prohibited it. In doing so, you should always act in the patient's best interests.
  • When the patient becomes contactable or capable of understanding, you should let them know about the disclosure, if they might not reasonably have expected you to share the information.

Patients with a serious communicable disease

If a patient with a serious communicable disease objects to other people within or outside the healthcare team being informed of their infection status, their wishes should be respected unless a failure to disclose may put other healthcare workers or patients at risk of infection.

Such situations are likely to be very rare, not least because of the use of the precautions that are routinely taken to protect healthcare workers and patients during exposure-prone procedures.

If another person who is in close contact with a patient may be at risk of infection that is likely to cause serious harm, because the patient has not informed them and cannot be persuaded to do so, then minimal information may be disclosed to protect this person. Ideally, you should tell the patient that you intend to disclose the information and why, to give them the opportunity to tell the other person. If it is possible to protect the patient's identity when tracing and notifying contacts, you should do so. 

Exposure to risk of serious communicable infection due to injury

If a healthcare worker or anyone else suffers an exposure-prone injury (eg a needlestick) while treating a patient who has a serious communicable disease, the patient's consent should be sought to disclose their infection status. If the patient withholds consent, then information may be disclosed in the public interest – for example, to decide whether post-exposure prophylaxis is required.

Summary Care Records

Patients have the right to opt out of having their personal information placed on the national Summary Care Record database, and should be advised of this right by their GP or local primary care organisation.

Clinical audit

Doctors in clinical practice have a duty to participate in clinical audit and this will inevitably involve disclosure of confidential information about patients.

The GMC draws a distinction between audit undertaken by the team that provided care to the patient, and other organisations.

Audit by the team that provided care or those who supported them

Doctors may disclose identifiable information to these healthcare professionals on a need to know basis if it is not practicable to use anonymised information. You must be satisfied that patients have been informed that data may be disclosed and that they understand their right to object but have not done so.

Audit by another organisation

Information must be anonymised wherever practicable. Otherwise, express consent must be obtained from the patients concerned.

If a patient objects to information being used in this way, you should explain why the information is needed and how it may benefit their care. If withholding the information for audit would compromise safe care, you should explain this to patients and discuss the options open to them.

Third parties

Third parties, such as trusts, may request access to patient information for purposes such as rationalisation of records or updating IT information.

Practices may be pressed to disclose information and while patients might have given implied consent for the sharing of information within the wider healthcare team, you need to consider whether the patient would be surprised to know to whom their notes were being disclosed and why.

There is unlikely to be any specific benefit to patient care, but there may be a wider public interest – for example, in keeping disease registers up to date.

Research and epidemiology

Express consent should be sought for the use of patient information for research and it should be anonymised as far as possible.

The Health Service (Control of Patient Information) Regulations 2002 were made under the provisions of the Health and Social Care Act 2001. They enable the flow of clinical information within and from the NHS in England and Wales regarding:

  • cancer registries
  • medical purposes such as medical audit and research.

This legislation allows but does not compel you to disclose information under the provisions of the Health and Social Care Act 2001. However, the GMC requires doctors to disclose information if required by law, for example to notify known or suspected communicable diseases. It is advisable to continue to seek the patient's consent to disclose patient identifiable information where practicable, or call the MDU for advice.

Financial audit and administration

Information for financial audit and administration should be anonymised wherever possible. If this is not possible, you should obtain the patient's express consent to disclosure, informing them of the reasons for disclosure and their right to object.

It may be prudent to store financial and other administrative data separately from clinical information in computerised records so that sensitive data is not automatically displayed. This can help reduce the chance of an accidental breach of confidentiality.

Primary care bodies

The General Medical Services Contract (2005) requires GPs to provide information, including patient records, to the primary care body or other authorised persons, in certain circumstances.

Practices should take adequate steps to inform patients how their data will be used and that they have a right to object. You may wish to seek express consent from individual patients before disclosing identifiable confidential information to a primary care body.

It will be your decision whether to disclose or not. Before making a decision, you will need to ensure that the primary care body has provided sufficient detail about the specific reasons and precise purpose for which the disclosure is needed.

If a primary care body seeks disclosure of clinical information against a patient's wishes and there is no statutory obligation to disclose, please contact the MDU for advice.

Care Quality Commission

Care Quality Commission (CQC) has power to require access to patient information to help it fulfil its statutory functions. CQC adheres to a code of practice on its use of confidential personal information, and a request to provide information necessary to fulfilling its statutory functions should be complied with. If you are in any doubt, the MDU can help you.

Questions and answers

Do I still need consent to disclose information for research, if a research ethics committee has approved the project?

Express consent to the use of records in research must be obtained in all but the most exceptional circumstances, eg where research involves patients unable to consent or where patients cannot be traced. In such circumstances you should follow the GMC's guidance on disclosures in the public interest. Additionally, in England and Wales, section 251 of the NHS Act 2006 supports such disclosures. However, if it is possible to inform patients about the use of the data, and respect any objections, you should do so.

Further guidance is available in the GMC's guidance on good practice in research.

This guidance was correct at publication 10/11/2017. It is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.

You may also be interested in

Guide

Disclosure to third parties

Obtain consent to disclose identifiable patient information, unless it is required by law or justified in the public interest.

Read more
Guide

Notifiable infectious disease

Doctors have the statutory duty to notify a proper officer of the local authority of suspected cases of certain infectious diseases.

Read more
Guide

Confidentiality issues in insurance and other reports

A wide range of doctors provide reports about patients to third parties in the course of their work.

Read more

Comments

Login to comment

Be the first to comment