1. 3HL002 Prepared by Sally Sturge
Confidentiality
3HL002
Prepared by Sally Sturge

2. Intended learning Outcomes
Following this session you should be able to:
Give examples of the types of sensitive person-identifiable information that is recorded, stored and accessed in the course of providing health care.
Define the term confidentiality and discuss the health professionals duty to maintain confidentiality.
Briefly outline the key aspects of the laws governing patient/service user confidentiality.
Give examples of ways in which confidentiality can be breached in health care.
Give examples of ways in which confidential information can be breached.
Discuss circumstances in which breaching confidentiality may be justified.

3. Activity
What would you be prepared to disclose to a health professional?
Group Survey
What do you think you have learned from this activity?
Teaching points
Health care involves the collection, use and storage of some very sensitive information.
The information we collect should be needed rather than just to satisfy the prurient curiosity of the health care professional.
We need to feel that we can trust health care professionals with this information.
Does a reluctance to disclose show a lack of trust?

4. Confidentiality
A duty of confidence arises when one person discloses information to another (e.g. patient/service user to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence.
It –
a. is a legal obligation;
b. is a requirement established within professional codes of conduct; and
c. must be included within NHS employment contracts as a specific requirement linked to disciplinary procedures.
Department of Health (2003)

5. Beauchamp and Childress (2009)
Confidentiality is present when one person discloses information to another, whether through words or other means, and the person to whom the information is disclosed pledges (implicitly or explicitly) not to divulge that information to a third party without the confider’s permission.

6. HCPC (2012) - Standards of conduct, performance and ethics
You must respect the confidentiality of service users.
You must treat information about service users as confidential and use it only for the purposes they have provided it for. You must not knowingly release any personal or confidential information to anyone who is not entitled to it, and you should check that people who ask for information are entitled to it.
You must only use information about a service user:
to continue to care for that person; or
for purposes where that person has given you permission to use the information or the law allows you to do so.
You must also keep to the conditions of any relevant data-protection laws and always follow best practice for handling confidential information. Best practice is likely to change over time, and you must stay up to date

7. NMC (2015) The Code, Professional standards of practice and behaviour for nurses and midwives
Respect people’s right to privacy and confidentiality
You must respect a person’s right to privacy in all aspects of their care.
Make sure that people are informed about how and why information is used and shared by those who will be providing care.
Respect that a person’s right to privacy and confidentiality continues after they have died.
Share necessary information with other healthcare professionals and agencies only when the interests of patient safety and public protection override the need for confidentiality, and
Share with people, their families and their carers, as far as the law allows, the information they want or need to know about their health, care and ongoing treatment sensitively and in a way they can understand.

8. Legal Standards Human Rights Act 1998 The Data Protection Act 1998
Article 8 of the Human Rights Act establishes a right to ‘respect for private and family life’.
The Data Protection Act 1998
Security measures must be commensurate with the nature of the data and the harm that may be suffered from a breach of security
Section 55 which makes it a criminal offence to obtain or disclose personal data unlawfully
Common Law of Confidentiality
Information given in confidence must not be disclosed without consent unless there is a justifiable reason e.g. a requirement of law or there is an overriding public interest to do so (NHS England (2014)

9. Activity
Group 1
Think and make a note of the ways in which there could be a breach in the confidentiality of person-identifiable information.
Group 2
Think and make a note of the ways you can protect person-identifiable information and prevent breaches in confidentiality.

10. Examples of Confidentiality Breaches
Posting person-identifiable information on social network sites.
Accessing the medical records of colleagues or friends.
Person-identifiable information is lost, left or stolen.
Discussing person-identifiable information with people not professionally involved with patient/service user care.
Disclosure of person-identifiable information to the media where there is no public interest
Administrative error
Sharing information with the patient’s family or friends against their wishes

11. Breaches in Confidentiality
HCPC - Hearings and decisions
Social worker suspended for serious breach of confidentiality
NMC Hearings and outcomes
Secret filming nurse struck off
"Although the conditions on the ward were dreadful, it was not necessary to breach confidentiality to seek to improve them by the method chosen…the misconduct was "fundamentally incompatible with being a nurse". NMC

12. Caldicott principles
Concerns about the inadequate value the NHS and other statutory bodies were placing on the issue of confidentiality.
the appointment of a senior person in each NHS organisation to be responsible for safeguarding the confidentiality of patient information (Caldicott Guardian).
6 general principles that health and social care organisations should adopt when reviewing their use of client information
Justify the purpose
Do not use personally identifiable information unless it is absolutely necessary
Use the minimum personally identifiable information
Access to personally identifiable information should be on a strict need-to-know basis
Everyone should be aware of their responsibilities
Understand and comply with the law

13. Confidentiality Do’s (NHS England (2014)
Do safeguard the confidentiality of all person-identifiable or confidential information that you come into contact with.
Do clear your desk at the end of each day, keep records containing person-identifiable or confidential information in recognised locked filing and storage places
Do switch or log off computers
Do ensure that you cannot be overheard when discussing confidential matters.
Do challenge and verify where necessary the identity of any person who is making a request for confidential information and ensure they have a need to know.
Do share only the minimum information necessary.
Do transfer person-identifiable or confidential information securely when necessary i.e. use an nhs.net account to send confidential information to another nhs.net account.
Do seek advice if you need to share patient/person-identifiable information without the consent of the patient/identifiable person and record the decision and any action taken.
Do report any actual or suspected breaches of confidentiality.
Do participate in induction, training and awareness raising sessions on confidentiality issues.

14. Confidentiality Don’ts (NHS England (2014)
Don’t share passwords or leave them lying around for others to see.
Don’t share information without the consent of the person to which the information relates, unless there are statutory grounds to do so.
Don’t use person-identifiable information unless absolutely necessary, anonymise the information where possible.
Don’t collect, hold or process more information than you need, and do not keep it for longer than necessary.

15. Breaches in Confidentiality
The right to confidentiality is not absolute.
Disclosure of person-identifiable information under the Data Protection Act (1998) is justified where
It is exercised in the public interest”
It is connected with the “administration of justice” (activities of the criminal justice system)
There are “vital interests” (matters of life and death).

16. What should THE NURSE DO in this situation?
A young man arrives at the emergency department with facial injuries. He tells you that the injuries were incurred during a violent fight with another person, and that the other person was lying on the ground not moving when the patient left the scene. The patient says that he wishes you to treat his injuries and respect the confidentiality of what he has just told you.

17. What should THE SOCIAL WORKER DO in this situation?
A Social Worker is on a home visit to a patient who is the early stages of Alzheimer’s Disease. He learns that the patient is continuing to drive his car on short journeys to the shops.

18. What should THE PSYCHOLOGIST DO in this situation?
A psychologist works within a community mental health team. The service user tells her during a therapy session that he was raped when he was 16 by ‘Phil Mitchell’ and that if he could he would kill him. He also expresses a number of other delusional ideas regarding the TV ‘soap’ EastEnders. The service user does not want this information to go any further.

19. What should THE RECEPTIONIST DO in this situation?
A receptionist at a GP surgery sees a patient leave the building and get into a car. On driving from the car park, the patient's car collides with and damages another patient's car. The driver does not stop, believing that nobody has seen the incident and instead drives away without leaving their details. Through her role at the surgery, the receptionist knows the identity of the patient.

20. SUMMARY Following this session you should be now able to:
Give examples of the types of sensitive person-identifiable information that is recorded, stored and accessed in the course of providing health care.
Define the term confidentiality and discuss the health professionals duty to maintain confidentiality.
Briefly outline the key aspects of the laws governing patient/service user confidentiality.
Give examples of ways in which confidentiality can be breached in health care.
Give examples of ways in which confidential information can be breached.
Discuss circumstances in which breaching confidentiality may be justified.

21. References
Beauchamp, T.L. and Childress, J.F. (2009) Principles of biomedical ethics (6th ed.) Oxford: University Press, New York.
Data Protection Act (1998) [On-line]. [Accessed 22nd September 2015]. Available at:
Department of Health (1997) The Caldicott Committee: Report on the
Review of Patient-identifiable Information. London: HMSO.
Health and Social Care Information Centre (2013) A guide to confidentiality in health and social care [On-line]. [Accessed 22nd September 2015]. Available at: <
Health Care Professions Council (2012) HCPC (2012) - Standards of conduct, performance and ethics, London: HCPC.
Nursing and Midwifery Council (2015) The Code, Professional standards of practice and behaviour for nurses and midwives, London: NMC