1. Confidentiality Professional obligation – moral duty Hippocratic oath
Whatever I see or hear, professionally or privately, which ought not to be divulged, I will keep secret and tell no one.
Geneva Declaration
I WILL RESPECT the secrets which are confided in me, even after the patient has died
Professional guidelines
Codes of Ethics; GMC & BMA guidelines
The World Medical Association Declaration of Geneva (1948)
GMC Duties of a Doctor Confidentiality: Protecting and Providing Information (2000)

2. Confidentiality Ethical aspects Deontological – autonomy Utilitarian
patient should control information about themselves
Utilitarian
Keeping confidences maximises happiness (utility)
Virtue ethics
faithfulness, maintain trust
The World Medical Association Declaration of Geneva (1948)
GMC Duties of a Doctor Confidentiality: Protecting and Providing Information (2000)

3. Confidentiality Justification for keeping confidences
privacy argument - ‘rights’- based argument
Universal Declaration of Human Rights
European Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR)
efficiency argument – public health -based
healthcare system requires patients to be open and honest
trust argument - fiduciary relationship
nature of relationship out of which confidentiality arise
autonomy argument
control over personal information
Privacy argument – individual should be able to control what information is broadcast in the public arena
Universal Declaration of Human Rights 1948 (United Nations)
Article 12.
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
European Convention for the Protection of Human Rights and Fundamental Freedoms (Council of Europe 1950)
Article 8 – Right to respect for private and family life
1 Everyone has the right to respect for his private and family life, his home and his correspondence.
2 There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.

4. Confidentiality Nature of legal duty General rights
Article 8 European Convention on Human Rights
Contract (tort)
private patients – implied term
Contract (employment)
NHS terms and conditions of service
Equity (tort of breach of confidence)
public policy
Negligence (tort)
professional standards (damage must be shown)
Statute law
various acts/regulations
Data Protection

5. Confidentiality Nature of legal duty
Duty of confidence common law/equity
no right to privacy explicitly recognised in English law: privacy versus protecting confidence
specific equitable obligation developed by the courts
“ … a duty of confidence arises where confidential information comes to the knowledge of a person in circumstances where he has notice, or is held to have agreed, that the information is confidential with the effect that it would be just in all the circumstances that he should be precluded from disclosing the information to others.”
Lord Goff AG v Guardian Newspapers (No 2) (1988)
Protecting confidence an aspect of privacy but not the same:
protection of confidence – protecting unauthorised disclosure of personal information
privacy – beyond unauthorised disclosure so as to include other unauthorised or improper use of information (law deals with misuse of personal information via Data Protection Act)
Right to privacy
Human Rights Act 1998 – Article 8 European Convention on Human Rights
Currently no tort of invasion of privacy in English law
But
Argument that something close to a law of privacy is being introduced into English law through recent cases involving celebrities?
See : Douglas v Hello
Campbell v MGN (2004)(Court introduced a test of ‘risk of harm to the person’ from publication)
See also cases: Mary Bell; James Bulger killers; Maxime Carr – privacy protected by court injunctions

6. Confidentiality Duty of confidence 3 pronged test
information confidential in nature
information imparted in circumstances that impose/confer obligation on confident to respect confidentiality*
confider must show cause for invoking help of court (e.g. detriment or public interest reason)
Coco v AN Clarke (Engineers) Ltd (1969) RPC 41
AG v Guardian Newspapers (No 2) (1988) 3 All ER 545
X v Y (1988) 2 All ER 648
R v Department of Health, ex parte Source Informatics Ltd (1999)
* Scope of duty
• where information obtained directly from the patient (or by his own examination/observation) - clearly obligation of confidence attaches to this information
• where information obtained by third party:
- in professional capacity/third party aware of practitioner-patient relationship – professional obligation of confidence
- in situation where third party is unaware of relationship? – professional obligation likely - patient’s trust in a doctor not revealing any clinical information without permission extends to all information however received
Important legal case:
R v Department of Health, ex parte Source Informatics Ltd (1999): the Court of Appeal was asked to rule on the legality of disclosing data that were rendered anonymously to a data collecting company that wished to sell it to pharmaceutical companies to assist in the marketing of their products.
The data collecting company had approached GPs and pharmacists to obtain patient treatment information. Pharmacists were asked to provide details of the general practitioners prescribing habits, with all data stripped of patient identifiers before being passed on. The Department of Health advised that the patient would not have entrusted the information to either the GP or the pharmacist to give to the data company and that this practice was a breach of patient confidentiality. Further, it maintained that disclosure of dispensing information to data companies could not be argued to be in the public interest. The judge accepted that there would be a breach of confidence if the company were given access to the confidential information given by the patient to the pharmacist. The case went to a Court of Appeal where the first ruling was overturned.
The Court of Appeal held that there could be no breach of confidentiality because the concern of the law here is to protect the confider’s personal privacy and that patient’s privacy was not under threat because there was no realistic possibility that a patient’s identity could be revealed. Therefore, the breach of confidence does not extend to disclosure of personal information that has been rendered anonymous.

7. Confidentiality Doctor–patient relationship Duty of confidence
explicitly recognised as one of the category of relationships protected by the equitable remedy of breach of confidence
“ … in common with other professional men, for instance a priest …the doctor is under a duty not to disclose [voluntarily], without the consent of his patient, information which he, the doctor, has gained in his professional capacity” Boreham J Hunter v Mann (1974) QB 767
X v Y (1988) 2 All ER 648
W v Edgell (1990) 1 All ER 835
R v Department of Health, ex parte Source Informatics Ltd (1999)

8. Confidentiality Statutory recognition
Duty of Confidence
Statutory recognition
National Health Service (Venereal Diseases) Regulations 1974
Abortion Regulations 1991
Human Fertilisation and Embryology Act 1991
Certain statutory provisions require particular types of health information to be kept confidential, notably those areas of healthcare regarded as being particularly sensitive in nature, e.g. fertility treatment , treatment for venereal disease, or AIDS.

9. Confidentiality Special cases Duty of Confidence children
with capacity– obligation of confidence
without capacity– law requires ‘best interests’ approach
incompetent adults
law requires ‘best interests’ approach
deceased persons
Law less certain concerning some groups:
The legal position The 1985 House of Lords' ruling in the Gillick (Gillick v Wisbech and W Norfolk AHA [1985], 3 All ER 402 HL) case established the current legal position in England and Wales that people under 16 who are able fully to understand what is proposed and its implications are competent to consent to medical treatment regardless of age (Scottish law goes further to recognise certain rights to self-determination of young people. The Age of Legal Capacity (Scotland) Act 1991 assigns various legal rights to people over the age of 12 but, as in England and Wales there is no minimum age for legal capacity to consent to medical treatment). Thus, people under 16 are legally able to consent on their own behalf to any surgical, medical or dental procedure or treatment if, in the doctor's opinion, they are capable of understanding the nature and possible consequences of the procedure. Clearly, the more serious the medical procedure proposed, a correspondingly better grasp of the implications is required.
Children:
GMC guidelines: Confidentiality: Protecting and Providing Information (2000)
recognises ethical obligation of confidence owed to a child (or incompetent adult) and justification for disclosure when in ‘best interests’
Children under 16 years have no statutory right to consent to treatment (Family Law Reform Act 1969 s 8 entitles children aged 16 to 18 years to give valid consent to medical/dental treatment without the involvement of parent or guardian – i.e assumed to be competent unless there are specific grounds for doubting this).
No minimum age for legal capacity to consent to medical treatment. Gillick v West Norfolk and Wisbech AHA (1985) 3 All ER 402 – recognised that a child under 16 may be competent to consent dependent upon an assessment of the child’s maturity (test for ‘Gillick competent’ child under 16 years - based on being able to fully understand what is proposed and its implications); confidentiality between doctors and children under 16 requesting contraception was upheld applicable to disclosure of personal health information by analogy?
(In Scotland the Age of Legal Capacity (Scotland) Act 1991 gives various legal rights to ‘mature’ children under 16 years including right to confidentiality and right to give consent to release medical notes).
(Note: School sent girl home to have secret abortion (Daily Telegraph 13/05/2004) - girl aged 14 was sent to hospital for an abortion without the knowledge of her mother, on the advice of a health visitor at her school.
Young children and adults without capacity to consent to treatment – general law requires a best interests approach – likely to be reflected in the law of confidence – very strong presumption in favour of disclosure to parents, etc.
Deceased:
Professional ethical codes/guidelines require confidentiality of patient information after the patient’s death.

10. Confidentiality Breach of confidence:
• equitable remedy in tort of breach of confidence
- injunction/damages
• criminal sanctions for breach of statutory provisions
Justifications for breaching confidentiality:
Consent
Public interest
freedom of the press
danger to health or safety of public or a third party
teaching, research and clinical audit
Statutory requirements
Court proceedings
Remedies
Injunction – only useful when possibility of breach is known in advance
Obligation of confidentiality is not absolute – situations where law allows breach of confidentiality and situations where the law obliges breach of confidentiality
Professional regulation
Express and implied consent – disclosure minimum necessary/ ‘ need to know’ basis
Without consent: cf. ‘best interests’ of patient – medical best interests/physical or sexual abuse/lack of capacity
Public Interest Disclosures
A balancing exercise – interest in medical confidentiality both a private interest of the patient and also a public concern – need to balance these two interests
The public interest in preserving confidences may be outweighed by some countervailing public interest that favours disclosure
Freedom of the press (Article 10 European Convention on Human Rights)
- need to balance interest in free speech against interest that health records remain confidential and employees not disclosing confidential information
Health and Safety of Public:
W v Egdell (1990) 1 All ER 835
concerned a dangerous psychiatric patient who created a risk to the safety of the public – examining psychiatrist disclosed the report he had made on behalf of the patient who was seeking release or less restrictive confinement
Court held that confidence may be breached in the public interest but recognised factors that limit extent to which information may be disclosed:
disclosure should only made to those to whom it is necessary to tell so as to protect the public;
risk must be ‘real’ to justify disclosure;
danger of physical harm to the public.
Disclosure to protect a third party – American case Tarasoff (1976) – serious risk to an identifiable person
Danger to a third party
Research:
There is no clear legal authority for disclosure of confidential health information for medical audit or research. However, it may be justified in the public interest, in the absence of the patient’s consent. In general, the normal principles discussed above should apply. In other words, the patient or client should know who is asking for access to their records, and for what purpose, and they should be afforded the opportunity to deny access if they wish. Note: role of research ethics committees
Duty of confidence does not extend to anonymised personal information
Source informatics (1999)
Disclosure within medical teams
Statutory requirements:
In certain situations statues expressly require that patient confidentiality should be broken (to specific authorities only) e.g. where information is required in the investigation of a crime (Police and Criminal Evidence Act 1984) or on public health grounds (Public Health (Control of Disease) Act 1984 – notifiable diseases such as cholera; plague; typhus) or when under a court order.
These are contained mainly in the Abortion Regulations 1991, the Public Health (Control of Disease) Act 1984, and the Police and Criminal Evidence Act 1984 and further. There are now a number of statutory provisions that
require disclosure of information to a public body
(and/or confirm the strict nature of the duty of
confidentiality).They include the following:
Public Health (Control of Diseases) Act 1984
(supplemented by the Public Health (Infectious Diseases)
Regulations 1988) requires the notification of certain
diseases to the local authority.They include: cholera;
plague; small pox; typhus; acute meningitis; relapsing
fever; TB; whooping cough; and food poisoning etc.For
this purpose,AIDS is not a notifiable disease.
National Health Service (Venereal Diseases)
Regulations 1974 require every health authority to take
all necessary steps to secure information that could
identify an individual who has or is receiving treatment
for any sexually transmitted disease. This information
should not be disclosed except for the purpose of
communicating the information to a doctor or someone
working under his direction in connection with the
treatment of persons suffering from the disease or the
prevention of its spread.
Police and Criminal Evidence Act 1984 permits specific
access in a criminal investigation to what is called
excluded material.Section 11 defines excluded material
as, for example,“human tissue or tissue fluid which has
been taken for the purposes of diagnosis or medical
treatment and which a person holds in confidence”.
Section 12 permits access to personal records,which relate
to an individual’s physical or mental health.However, an
order for the seizure of personal records can only be made
in limited circumstances,and only by a circuit judge (not
with a magistrate’s warrant).The order gives the right to
enter premises and search for the personal records.
Prevention of Terrorism (Temporary Provisions) Act
1989 requires anyone to disclose to the police, as soon
as possible, any information that they may have that
may help prevent an act of terrorism connected with
Northern Ireland, or assist in apprehending or
prosecuting such terrorists.
Misuse of Drugs (Notification of and Supply of
Addicts) Regulations 1973 impose an obligation on
doctors treating drug addicts to send the Chief
Medical Officer at the Home Office details of people
who they consider, or suspect are addicted to certain
controlled drugs
Road Traffic Act 1988 obliges anyone, including health
care professionals, to provide the police, on request,with
any information that might identify a driver who is
alleged to have committed a traffic offence.
Note: There is no obligation on health professionals to
disclose confidential information in order to assist the
police with the investigation of crimes (Sykes v DPP
[1962] AC 528).You do not “obstruct”police investigations
by refusing to answer their questions,provided that you
have “lawful excuse”.Confidentiality would constitute a
“lawful excuse”(Rice v Connelly [1966] 2 All ER 649).
Abortion Act 1967 requires doctors to give the Chief
Medical Officer notice of pregnancy terminations,
including the name and address of the woman concerned.
Health and Safety at Work Act 1974 and Reporting of
Injuries,Diseases and Dangerous Occurrences Regulations
1995 require the reporting of dangerous occurrences to the
local authority or Health and Safety Executive.These
incidents are, for example: events that could have led to
serious injury which was averted; major accidents such as
fractures,amputation, loss of consciousness and so on;
minor accidents causing incapacity for more than three
days; and industrially linked diseases such as hepatitis
contracted while working with human blood products.
Occupational health professionals should resist any request
by the employer that they take responsibility for reporting
accidents and disease, as this may give rise to a conflict of
interest between the professional’s relationship with the
employer and that with the patient/employee.
We have already said that health professionals are under
no obligation to disclose confidential information to
assist the police in a criminal investigation. There are
some statutory exceptions, and the BMA has also
suggested that doctors should consider informing the
police only:
✦ where the offence is grave
✦ the prevention or detection of the crime will be
seriously delayed or prejudiced if they do not do so
✦ the information will only be used in the detection
and prosecution of the alleged offender (Philosophy
and practice of medical ethics 1988, 23 – 4).
The Department of Health gives similar advice on
disclosing information to the police.You can find this
advice in the Code of Practice on Confidentiality (2003).

11. Exceptions to Obligation for Confidentiality
patient threatens harm to self
patient threatens harm to others
when required by law:
communicable disease
occupational diseases
suspected abuse

12. Confidentiality in the NHS
professional ethical codes
professional guidelines
NHS guidelines
contract of employment
Caldicott Guardians
Statutes relating to patient information in health records
Data Protection Act 1998
Access to Medical Reports 1988
Access to Health records Act 1990
Access to Personal Files Act 1987
Various statutes provide patients with legal right to see their health records:
Data Protection Act 1998
Access to Medical Reports Act 1988
patients provided with restricted right of access to medical reports supplied by a medical practitioner concerning employment/insurance purposes
Access to Health Records Act 1990
replaced by Data Protection Act 1998 except in relation to records of deceased persons – executor or administrator of a deceased person’s estate can apply under this act for access to health records
Access to Personal Files Act 1987
provides restricted right of access to personal social services files
Note: Case law, in relation to NHS patients R v Mid Glamorgan FHSA ex part Martin [1995] 1 All ER 356),
states that legal ownership of health records resides in the organisation (e.g.trust) owning the paper, IT
and so on, on which the health information is stored

13. Confidentiality in the NHS
Caldicott Committee’s Report on the Review of Patient-Identifiable Information, published in December 1997.
Health Service Circular (HSC 1999/012) appointment of Guardians:
an existing member of the management board of the organisation
a senior health professional
an individual with responsibility for promoting clinical governance
HSC 2000/009: Data Protection Act 1998: protection and use of patient information
The NHS Confidentiality Code of Practice
Guidelines on the use and protection of patient information, November 2003.
Health Service Circular (HSC 1999/012) advising on the requirement to appoint Guardians, and outlining the Guardian role and responsibilities in brief, was issued on 22 January 1999: the Guardian should be, in order of priority:
An existing member of the management board of the organisation;
A senior health professional;
An individual with responsibility for promoting clinical governance;
HSC 2000/009: Data Protection Act 1998: protection and use of patient information
This circular highlights the main implications for the NHS of the Data Protection Act 1998 and associated Orders and regulations and the consequent action NHS bodies should take in order to comply with the Act.

14. Caldicott Principles
Caldicott Committee recommended that every flow of patient-identifiable information should be regularly justified and routinely tested against the principles developed in the Caldicott Report.
Principle 1 - Justify the purpose(s) for using confidential information
Principle 2 - Only use it when absolutely necessary
Principle 3 - Use the minimum that is required
Principle 4 - Access should be on a strict need-to-know basis
Principle 5 - Everyone must understand his or her responsibilities
Principle 6 - Understand and comply with the law
The Caldicott Principles The Caldicott Principles as laid down by the NHS Executive must also be followed by the Trust:
Principle 1 - Justify the purpose(s) Every proposed use or transfer of patient-identifiable information within or from an organisation should be clearly defined and scrutinised, with continuing uses regularly reviewed by an appropriate guardian. Principle 2 - Don't use patient-identifiable information unless it is absolutely necessary Patient-identifiable information items should not be used unless there is no alternative.
Principle 3 - Use the minimum necessary patient-identifiable information Where use of patient-identifiable information is considered to be essential, each individual item of information should be justified with the aim of reducing identifiability. Principle 4 - Access to patient-identifiable information should be on a strict need to know basis Only those individuals who need access to patient-identifiable information should have access to it, and they should only have access to the information items that they need to see. Principle 5 - Everyone should be aware of their responsibilities Action should be taken to ensure that those handling patient-identifiable information - both clinical and non-clinical staff - are aware of their responsibilities and obligations to respect patient confidentiality.
Principle 6 - Understand and comply with the law Every use of patient-identifiable information must be lawful. Someone in each organisation should be responsible for ensuring that the organisation complies with legal requirements.

15. Confidentiality in the NHS
Breach of Confidence – possible consequences
• complaint to the Information Commissioner for breach of the Data Protection Act 1998
• professional disciplinary proceedings (misconduct)
• employer disciplinary proceeding (breach of contract of employment)
• civil court action in tort of breach of confidence
• criminal court action where breach of statute

16. Difficulties with maintaining confidentiality in the NHS
professional ‘need to know’
other doctors, nurses, allied professions, students, etc.
non-professional ‘need to know’
ward clerical/administrative staff, hospital staff, Trust, NHS agencies, etc.
communication risks
verbal discussions computer/electronic health records
fax/photocopy machine ‘celebrity/newsworthy’ patients
telephone/answer machine bureaucracy
Changing medical practice
many more professionals involved in healthcare – greater need for sharing of information
non-medical/administrative staff involved
movement of patients between hospitals/trusts and within the EU countries

17. Special Problems in Confidentiality
children
adolescents
psychiatric patients
incompetent patients
HIV status
‘celebrity’ patients
professional colleagues
genetic information