In the absence of patient consent, a legal obligation or anonymisation, any decision as to whether identifiable information is to be shared with third parties must be made on a case by case basis and must be justifiable in the 'public interest'.
Public interest is the general welfare and rights of the public that are to be recognised, protected and advanced. Disclosures in the public interest based on the common law are made where disclosure is essential to prevent a serious and imminent threat to public health, national security, the life of the individual or a third party or to prevent or detect serious crime. The GMC also advises that a disclosure without consent can be justified in the public interest to enable medical research. Ultimately, the public interest can only be determined by the courts.
However, when considering disclosing information to protect the public interest, health professionals must:
- consider how the benefits of making the disclosure balance against the harms associated with breaching the patient's confidentiality both to the individual clinical relationship and to maintaining public trust in a confidential service
- assess the urgency of the need for disclosure
- persuade the patient to disclose voluntarily
- inform the patient before making the disclosure and seek his or her consent, unless to do so would increase the risk of harm or inhibit effective investigation
- disclose the information promptly to the appropriate body
- reveal only the minimum information necessary to achieve the objective
- seek assurance that the information will be used only for the purpose for which it is disclosed
- document the steps taken to seek or obtain consent, and the reasons for disclosing the information without consent
- be able to justify the decision; and
- document both the extent of and grounds for the disclosure.
Health professionals should be aware that they risk criticism, and even legal liability, if they fail to take action to avoid serious harm. Advisory bodies, such as the BMA, cannot tell health professionals whether or not to disclose information in a particular case, but can provide general guidance about the categories of cases in which decisions to disclose may be justifiable (see below).
Guidance should be sought from their Caldicott guardian, professional body or defence body where there is any doubt as to whether disclosure should take place in the public interest.
In the past, professional guidance has not viewed medical research as a justifiable reason for a 'public interest' disclosure without consent. Rather, research has been categorised exclusively as a secondary use of data which, aside from disclosures which are covered by law, requires either consent or anonymisation prior to disclosure. New GMC guidance advises that doctors can now disclose identifiable information without consent for research purposes if it is in the public interest.
The GMC guidance states that doctors can disclose identifiable information without consent for research purposes in the public interest if:
- it is necessary to use identifiable information; or
- it is not practicable to anonymise the information and, in either case not practicable to seek consent.
The GMC advises that a number of factors must be taken in to account in any consideration as to whether the research justifies a breach of confidentiality in the public interest:
- the nature of the information must be considered
- the use that will be made of it
- how many people will have access to it
- the security arrangements to protect further disclosure
- the advice of an independent expert advisor, such as a Caldicott Guardian, should be sought
- the potential for harm or distress to patients.
When faced with requests for access to identifiable data from researchers health professionals must assess each case on its individual merits. These decisions are complex and it may be extremely difficult to make a judgement as to when the public interest can or cannot constitute a legitimate disclosure for research. Health professionals are under no obligation to disclose information and should seek further advice from the GMC if there is doubt as to whether the research is in the public interest.
The BMA is of the view that unless health professionals are confident they can make a reasonable assessment as to whether the research is in the public interest a cautious approach should be adopted. Reasons for any disclosure should be documented.
Serious crime and national security
There is no legal definition as to what constitutes a 'serious crime'.
In the Police and Criminal Evidence Act 1984 a 'serious arrestable offence' is an offence that has caused or may cause:
- serious harm to the security of the state or to public order
- serious interference with the administration of justice or with the investigation of an offence
- serious injury; or
- substantial financial gain or serious loss.
This includes crimes such as murder, manslaughter, rape, treason, kidnapping and abuse of children or other vulnerable people. Serious harm to the security of the state or to public order and serious fraud will also fall into this category. In contrast, theft, minor fraud or damage to property where loss or damage is less substantial would generally not warrant breach of confidence.
A common example of what can be categorised as public safety occurs in connection with the assessment of patients with, for example, diabetes, epilepsy, defective eyesight, hypoglycaemia or serious cardiac conditions who have been advised by health professionals to discontinue driving, but who nevertheless continue. The DVLA should be informed if anybody is thought to be at risk.
Issues of public safety may similarly arise in circumstances where an individual who legitimately possesses firearms is thought by health professionals to be a risk because of drug or alcohol addiction or a medical condition such as depression. The police should be informed if anybody is thought to be at risk.
When a person has a medical condition that puts others at risk, for example, infection from a serious communicable disease such as HIV, doctors must discuss with the patient how to minimise the risk to others. If patients refuse to modify their behaviour or inform others, doctors are advised by the GMC that they may breach confidentiality and inform a known sexual contact. The same considerations apply to circumstances where the potential disclosure relates to a health professional who poses a threat to the health of patients or colleagues because of illness or addiction.
Confidentiality and health records tool kit - Card 10 (PDF)