Medical records: Disclosing confidential clinical information
Although our courts remain reluctant to create any general right to privacy, whether under common law or even by virtue of statutes such as the Human Rights Act 1998, one important aspect of privacy is recognised in common law - that of the confidentiality of medical information.
‘In common with other professional men for instance a priest... the doctor is under a duty not to disclose [voluntarily], without the consent of his patient, information which he, the doctor, has gained in his professional capacity, save... in very exceptional circumstances... [for] example... the murderer still manic, who would be a menace to society.. .The law will enforce that duty.’ (Hunter v.Mann[1974])
The main purpose of the courts in recognising clinical confidentiality in common law is not primarily for the protection of any one individual patient’s right to privacy, but for the good of society as a whole: if clinicians were not required to keep confidence people would be reluctant to provide them with personal information about their physical and mental health. In the case of psychiatric patients, a proportion of whom might also be dangerous, this public interest is arguably even greater. The proper assessment of the mental state of such patients and their treatment and supervision requires full cooperation by the patient in informing the clinician of their behaviour and thoughts. Patients should be free of the fear that they will be harmed by disclosure of clinical information as a result of engaging with a doctor.
However, as is clear from the above quotation, the duty of confidence is not absolute. This paper will consider the circumstances in which confidential clinical information can be disclosed and the extent of patients’ rights of access to their own medical records.
What clinical information is confidential?
Generally a doctor should consider all patient information received
as part of their professional duties to be confidential. There
will be an
exception if the information is already clearly in the public domain. Also, where information has been confidential
but has become public knowledge, and no further harm can be
done by further publication, such duty of confidence as remains
is unlikely to be enforced (Attorney-General
v. Guardian Newspapers
(No 2) [
1990]). Anonymisation of information does not necessarily
avoid the obligation of confidentiality if by the nature of
the information it remains possible to identify the patient.
Patients’ rights of access to their own medical records
The Court of Appeal has confirmed that
common law does not give an unconditional right of access to one’s own medical records. In the case of R
v. Mid Glamorgan FHSA
ex parte Martin
[
1995], a
patient with a long mental health history was refused access to his clinical records on the grounds that disclosure would be detrimental to him. The records, which were all created
before 1991, pre-dated the various statutory rights of access
discussed below. The court found that a Health Authority had
a general duty to act at all times in the
patient’s best interests and thus could deny access to the patient where it
was in the patient’s best interests to do so.
The Data Protection Act 1998 currently provides individuals with a statutory right of access to their ‘personal data’. This includes information about their physical and mental health. However, the common law position in ex parte Martin (above) is now echoed in the statutory provisions. The Data Protection (Subject Access Modification)(Health) Order 2000 (SI 20000/413) exempts health records from the general right of access where such access would be ‘likely to cause serious harm to the physical or mental health or condition of the data subject or any other person’. Where a patient requests access to their own records under the DPA and the person controlling the records is not a health professional (e.g. a Trust Administrator), there is an obligation to consult the person most recently responsible for the clinical care of a patient and confirm that there is no risk of harm before releasing the records to the patient.
The Access to Medical Reports Act 1988 gives an individual the right to see medical reports prepared for insurance and employment purposes by a doctor who has had clinical care of them. The subject is entitled to request to see the report before it is supplied to the insurer/employer (Section 4). In the face of such a request, the doctor must not supply the report before the subject has had opportunity to see it and request any amendments to it. Access to the report can be refused where, in the doctor’s opinion, disclosure would cause serious harm to the subject or others (Section 7).
The Access to Health Records Act 1990, which formerly gave patients a statutory right to see those manual medical records not previouslycovered by the Data Protection Act 1994, has largely been repealed and the statutory right to records is now governed by the Data Protection Act 1998. Section 3(f) of the Access to Health Records Act 1990, however, remains in force and gives third parties rights of access to the medical records of a deceased patient.
Disclosure of confidential clinical information
Generally disclosure of confidential clinical material to someone other than the patient will be an actionable breach of confidence. There are, however, three circumstances when clinicians can release confidential clinical information:
- when the patient has given their consent;
- when the law requires disclosure (either under statute or a court order);
- when there is a public interest in disclosure.
The patient has consented
Although the duty of confidence exists for the public good,
in any specific case the confidentiality is that of the individual
patient and is owed to the patient, not society as a whole.
Thus, only the patient can sue for breach of confidence and
a patient’s consent to disclosure of information will
release the clinician from their obligation of confidentiality.
To give proper consent to disclosure, the patient must be informed
of the nature of the information to be revealed, to whom it
will be revealed, the purpose for which the information will
be used and the potential consequences. Patients can consent
only to limited disclosure for a limited purpose (such as disclosure
limited only to physical health issues and excluding mental
health issues) and any limits on the consent must be respected
(see also the General Medical Council [GMC] guidance ‘Seeking
patients’ consent: the ethical considerations’
at
www.gmc-uk.org/standards).
In law, a person’s verbal consent to disclosure is just as valid as written consent. However, in practice, a clinician would always be wise to ask for a written record of the consent as this could be valuable evidence should a dispute later arise. Where a third party (such as a solicitor, employee or insurance company) requests disclosure and purports to make this request on behalf of the patient, the clinician should satisfy him/herselfthat the patient has in fact consented. In such circumstances obtaining written consent that clearly sets out the extent of disclosure being agreed to by the patient is advisable.
Where a patient is incapable of giving consent then any disclosure which is in their best interests would be permissible. However, where practicable, it would be good practice to inform the incapable patient of the disclosure. Any doctor disclosing confidential information about an incapable patient (and particularly in the face of objections) would be well-advised to make a comprehensive note of the factors which have led the doctor to conclude that: (a) the patient lacked capacity to consent to or refuse disclosure; and (b) such disclosure is in the patient’s best interests. This not only provides good evidence if there is some later dispute, but could also focus the initial decision-making process.
Disclosure is required by law
Statute law
Various statutes and statutory instruments require doctors to reveal information, which would otherwise be considered confidential. Indeed criminal sanctions might arise from non-disclosure, for example the reporting of notifiable diseases (Public Health Control of Diseases Act 1984) or notification of terminations of pregnancy (Abortion Regulations, 1991) (SI 1991/499).
However, there is no statute law that requires provision of confidential information to the police or to courts, even where the matter in issue is a serious crime. Further by virtue of the Police and Criminal Evidence Act 1984 (PACE) PACE Sections 8 and 9 and schedule 1 (see R v. Central Criminal Court ex parte Brown (1992) TLR Sept 7th) in the absence of agreement by those holding the records the police have no powers to seizeor have access to ‘documentary and other records... relating to a person’s physical and mental health’ (Section 12 PACE, unless it is necessary to prevent relevant records being destroyed (Section 19 PACE)).
Clearly should a clinician receive confidential information which they believe is relevant to the prevention or detection of serious crime, they should consider the extent to which it is in the public interest for them to breach their obligation of confidence and inform police or other relevant authorities. Such discretionary disclosure to third parties is addressed in more detail below.
Court orders
Civil and criminal courts have powers to make orders requiring a doctor or holder of health records to disclose confidential information for the purposes of litigation. No sanctions would follow for any breach of confidence in compliance with such an order. Usually (as discussed below) such orders are made following a third party having requested the information and the court having determined that there is an overriding publicinterest in the disclosure.
A public interest in disclosure
As the duty of confidentiality is not absolute, there might be circumstances where the public interest in maintaining confidentiality is outweighed by the public interest in disclosing specific information. Such circumstances may include where disclosure is necessary to avert a real risk of a danger of death or serious harm to others or for the prevention or detection of serious crime. Even then such disclosure is permissible only if made to someone with a proper interest in receiving the information.
The operation of the competing public interests is demonstrated
in the case of W
v. Edgell [
1990]. Dr Edgell, a psychiatrist,
had prepared a report for a Mental Health Tribunal on behalf
of a detained patient (W). The report did not support W’s
application and, unsurprisingly, W did not disclose it at the
tribunal. Dr Edgell’s report contained information from
W relevant to his dangerousness, which Dr Edgell believed should
be known to the team treating W. Dr Edgell provided the report
to W’s responsible medical officer without W’s consent.
The Court of Appeal dismissed W’s claim for breach of
confidence finding that, although only the most compelling
circumstances would justify a doctor doing something against
the patient’s interests, the public interest in maintaining
confidence must be weighted against the competing public interest
in protecting others from crime. In W’s case, the disclosure
had been properly made. The court further noted that Dr Edgell
had acted in accordance with the relevant GMC guidance.
Indeed, it would be unusual for a court to find against a clinician
who followed GMC guidance and specialist lawyers take the view
that ‘the guidelines provide a very good, practical guide
as to what the courts are likely to find acceptable. Sometimes
they demand more of the doctors than the courts are likely
to do, but for most practical purposes they are likely to be
co-extensive with the law. It is therefore suggested that the
GMC guidelines are used as a manual of the law of confidentiality’
(
Foster & Peacock, 2000). The most recent version of the
GMC guidance can be accessed at
www.gmc-uk.org/standards. (Additionally
Department of Health Guidance including ‘The protection
and use of patient information’. HSG (96) 18/LASS L (95)
5 is available at
www.doh.gov.uk/ipu/confiden). The Royal
College of Psychiatrists’ guidance can also be found at
www.rcpsych.ac.uk/publications/cr/cr85.htm.
A duty to disclose?
In the USA the renowned case of Tarasoff v. Regents of the University of California [1976] established that:
‘when a doctor determines, or should determine that a warning is essential to avert danger arising from medical orpsychological condition of his patient, he incurs a legal obligation to give that warning’.
In England and Wales, no such positive obligation has been established, although in some circumstances a doctor could be found liable in negligence when a failure to disclose confidential information causes or permits further injury or damage to an individual.
In the recent case of C
v. Dr Cairns [
2003] a general practitioner
(GP) was informed by the mother of a 12-year-old girl that
her husband had had sexual intercourse with the child. The
GP was asked to, and did, keep this information confidential,
the mother having assured him that the act only happened once
and that she would ensure the abuse would not be repeated. Unknown
to the GP the abuse did recur and escalated. When adult, the
daughter sued the GP for negligence. Her claim failed largely
because the incidence occurred in 1975. The court found there
had been no breach of duty of care by the GP as, in 1975, the
understanding of child sexual abuse was such that many responsible
GPs would have acted similarly and not have sought to involve
others. The judge accepted that in 1975, doctor-patient confidentiality
was given more weight than it is today. There was then little
useful guidance from professional bodies and confidentiality
would have been breached only in the rarest of circumstances.
It seems improbable that this case would have had the same
outcome had the events occurred in 1995, and particularly in
the light of current GMC guidelines.
Third parties’ requests for disclosure of confidential medical records
The duty to maintain confidentiality extends to a positive obligation to assert confidentiality in response to any request for information. As was recently set out by the Court of Appeal
‘Dr X’s duty... like that of any other professional or other person who owes a duty of confidentiality to his patient or client is to assert that confidentiality in answer to any claims by a third party for disclosure’ (A Health Authority v. X and Others [2002]).
Even where requests are made by the Police or Crown Prosecution Service (CPS), doctors remain under this obligation to assert confidentiality and should refuse access save in as far as it is in the public interest to disclose material.
Criminal litigation
Often disclosure of medical records of the alleged victim of, or witness to, a crime is requested by the alleged perpetrator’s defence lawyers, and occasionally by the CPS or prosecution team.
Initial refusal by the clinician or hospital authorities to
release such records will usually be met by a witness summons
being issued by the court (under the Criminal Procedure (Attendance
of Witnesses) Act 1965 in the Crown Court). These summonses
are frequently drafted in very broad terms requiring the doctor
to attend court and produce ‘the medical records in relation
to Ms X’. Despite the existence of a witness summons,
if the patient does not consent to disclosure, the doctor remains
obliged to refuse disclosure on the grounds of confidentiality.
The summons only requires attendance at Court with the records.
The doctor must not disclose records to the legal advisers
of either the prosecution or the defence until the court has
decided whether and which records should be disclosed (R
v. Westacott [
1994]).
The defence legal team are only entitled to have access to confidential material that is relevant to the matters in issue in the criminal trial. They are not entitled to trawl through a patient/victim’s entire medical and/or psychiatric history seeking material for cross-examination. The vast majority of a patient’s medical records are not likely to be material or admissible evidence and ought not to be disclosed. Furthermore many patients’ records will contain confidential references to third parties irrelevant to the criminal trial and such information should be redacted.
Generally, the preferable course of action is for the doctor/Trust
to be legally represented when attending court in answer to
the summons. The barrister can then make representations to
the Court on the doctor’s behalf about whether any part
of the medical records contain potentially relevant and admissible
material. The judge will then consider the records in private
in the light of those representations and make an order as to
what, if anything, should be disclosed (Re H(L) [
1997]).
Civil actions
In civil actions it is invariably the Claimant’s medical
records which are relevant to the issues and the Claimant will
usually have already given consent to disclosure. In some circumstances
a court may order the reluctant Claimant to sign a form of
authority consenting to disclosure of their medical records
(Bennett
v. Compass Group UK and Ireland Ltd [
2002]). Civil
courts may set limits on the use and dissemination of any clinical
material disclosed in the course of litigation (under the Civil
Procedure Rules 2000, Part 31).
Additionally civil courts have powers to order disclosure of documents by parties and by non-parties. Before requiring a non-party to disclose documents the Court will have to be satisfied that the documents would support the case of the applicant or adversely affect the case of another party. As with criminal courts where clinical information is disclosed in response to a court order any breach of confidence arising will not beactionable.
Conclusion
Although civil actions for breach of confidence are rare, the issue can be a minefield for the unwary. Patients need not show that they have sustained any damage from unwarranted disclosure to succeed in a civil action and disclosure may also be considered serious professional misconduct by the GMC. Thus, those who are about to reveal confidential information should carefully consider their grounds for doing so and be clear that there is either consent, lawful authority or some public interest justification.
References
- FOSTER, C. & PEACOCK, N. (2000) Clinical Confidentiality. London, Monitor Press.
- A Health Authority v. X and Others [2002] LLRM 139 CA at paras 7 and 25.
- Attorney-General v. Guardian Newspapers (No 2) [1990] 1 AC 109.
- Bennett v. Compass Group UK and Ireland Ltd [2002] EWCA Civ 642.
- C v. Dr Cairns [2003] LLRM 90.
- Hunter v. Mann [1974] QB 767, at 772.
- R v. Mid Glamorgan FHSA ex parte Martin [1995] 1 WLR 110, CA.
- R v. Westacott [1994] Crim LR 545.
- Re H(L) [1997] 1 CrApp R 176 at 178E to G.
- W v. Edgell [1990] 1 All ER 835.