Medical records: Disclosing confidential clinical information

Although our courts remain reluctant to create any general right to privacy, whether under common law or even by virtue of statutes such as the Human Rights Act 1998, one important aspect of privacy is recognised in common law - that of the confidentiality of medical information.

‘In common with other professional men for instance a priest… the doctor is under a duty not to disclose [voluntarily], without the consent of his patient, information which he, the doctor, has gained in his professional capacity, save… in very exceptional circumstances… [for] example… the murderer still manic, who would be a menace to society…The law will enforce that duty.’ (Hunter v. Mann[1974])

The main purpose of the courts in recognising clinical confidentiality in common law is not primarily for the protection of any one individual patient’s right to privacy, but for the good of society as a whole: if clinicians were not required to keep confidence people would be reluctant to provide them with personal information about their physical and mental health. In the case of psychiatric patients, a proportion of whom might also be dangerous, this public interest is arguably even greater. The proper assessment of the mental state of such patients and their treatment and supervision requires full cooperation by the patient in informing the clinician of their behaviour and thoughts. Patients should be free of the fear that they will be harmed by disclosure of clinical information as a result of engaging with a doctor.

However, as is clear from the above quotation, the duty of confidence is not absolute. This paper will consider the circumstances in which confidential clinical information can be disclosed and the extent of patients’ rights of access to their own medical records.

What clinical information is confidential?

Generally a doctor should consider all patient information received as part of their professional duties to be confidential. There will be an exception if the information is already clearly in the public domain. Also, where information has been confidential but has become public knowledge, and no further harm can be done by further publication, such duty of confidence as remains is unlikely to be enforced (Attorney-General v. Guardian Newspapers (No 2) [1990]). Anonymisation of information does not necessarily avoid the obligation of confidentiality if by the nature of the information it remains possible to identify the patient.

Patients’ rights of access to their own medical records

The Court of Appeal has confirmed that common law does not give an unconditional right of access to one’s own medical records. In the case of R v. Mid Glamorgan FHSA ex parte Martin [1995], a patient with a long mental health history was refused access to his clinical records on the grounds that disclosure would be detrimental to him. The records, which were all created before 1991, pre-dated the various statutory rights of access discussed below. The court found that a Health Authority had a general duty to act at all times in the patient’s best interests and thus could deny access to the patient where it was in the patient’s best interests to do so.

The Data Protection Act 1998 currently provides individuals with a statutory right of access to their ‘personal data’. This includes information about their physical and mental health. However, the common law position in ex parte Martin (above) is now echoed in the statutory provisions. The Data Protection (Subject Access Modification)(Health) Order 2000 (SI 20000/413) exempts health records from the general right of access where such access would be ‘likely to cause serious harm to the physical or mental health or condition of the data subject or any other person’. Where a patient requests access to their own records under the DPA and the person controlling the records is not a health professional (e.g. a Trust Administrator), there is an obligation to consult the person most recently responsible for the clinical care of a patient and confirm that there is no risk of harm before releasing the records to the patient.

The Access to Medical Reports Act 1988 gives an individual the right to see medical reports prepared for insurance and employment purposes by a doctor who has had clinical care of them. The subject is entitled to request to see the report before it is supplied to the insurer/employer (Section 4). In the face of such a request, the doctor must not supply the report before the subject has had opportunity to see it and request any amendments to it. Access to the report can be refused where, in the doctor’s opinion, disclosure would cause serious harm to the subject or others (Section 7).

The Access to Health Records Act 1990, which formerly gave patients a statutory right to see those manual medical records not previously covered by the Data Protection Act 1994, has largely been repealed and the statutory right to records is now governed by the Data Protection Act 1998. Section 3(f) of the Access to Health Records Act 1990, however, remains in force and gives third parties rights of access to the medical records of a deceased patient.

Disclosure of confidential clinical information

Generally disclosure of confidential clinical material to someone other than the patient will be an actionable breach of confidence. There are, however, three circumstances when clinicians can release confidential clinical information:

1. (1) when the patient has given their consent;

2. (2) when the law requires disclosure (either under statute or a court order);

3. (3) when there is a public interest in disclosure.

The patient has consented

Although the duty of confidence exists for the public good, in any specific case the confidentiality is that of the individual patient and is owed to the patient, not society as a whole. Thus, only the patient can sue for breach of confidence and a patient’s consent to disclosure of information will release the clinician from their obligation of confidentiality. To give proper consent to disclosure, the patient must be informed of the nature of the information to be revealed, to whom it will be revealed, the purpose for which the information will be used and the potential consequences. Patients can consent only to limited disclosure for a limited purpose (such as disclosure limited only to physical health issues and excluding mental health issues) and any limits on the consent must be respected (see also the General Medical Council [GMC] guidance ‘Seeking patients’ consent: the ethical considerations’ at www.gmc-uk.org/standards).

In law, a person’s verbal consent to disclosure is just as valid as written consent. However, in practice, a clinician would always be wise to ask for a written record of the consent as this could be valuable evidence should a dispute later arise. Where a third party (such as a solicitor, employee or insurance company) requests disclosure and purports to make this request on behalf of the patient, the clinician should satisfy him/herself that the patient has in fact consented. In such circumstances obtaining written consent that clearly sets out the extent of disclosure being agreed to by the patient is advisable.

Where a patient is incapable of giving consent then any disclosure which is in their best interests would be permissible. However, where practicable, it would be good practice to inform the incapable patient of the disclosure. Any doctor disclosing confidential information about an incapable patient (and particularly in the face of objections) would be well-advised to make a comprehensive note of the factors which have led the doctor to conclude that: (a) the patient lacked capacity to consent to or refuse disclosure; and (b) such disclosure is in the patient’s best interests. This not only provides good evidence if there is some later dispute, but could also focus the initial decision-making process.

Disclosure is required by law

Statute law

Various statutes and statutory instruments require doctors to reveal information, which would otherwise be considered confidential. Indeed criminal sanctions might arise from non-disclosure, for example the reporting of notifiable diseases (Public Health Control of Diseases Act 1984) or notification of terminations of pregnancy (Abortion Regulations, 1991) (SI 1991/499).

However, there is no statute law that requires provision of confidential information to the police or to courts, even where the matter in issue is a serious crime. Further by virtue of the Police and Criminal Evidence Act 1984 (PACE) PACE Sections 8 and 9 and schedule 1 (see R v. Central Criminal Court ex parte Brown (1992) TLR Sept 7th) in the absence of agreement by those holding the records the police have no powers to seize or have access to ‘documentary and other records… relating to a person’s physical and mental health’ (Section 12 PACE, unless it is necessary to prevent relevant records being destroyed (Section 19 PACE)).

Clearly should a clinician receive confidential information which they believe is relevant to the prevention or detection of serious crime, they should consider the extent to which it is in the public interest for them to breach their obligation of confidence and inform police or other relevant authorities. Such discretionary disclosure to third parties is addressed in more detail below.

Court orders

Civil and criminal courts have powers to make orders requiring a doctor or holder of health records to disclose confidential information for the purposes of litigation. No sanctions would follow for any breach of confidence in compliance with such an order. Usually (as discussed below) such orders are made following a third party having requested the information and the court having determined that there is an overriding public interest in the disclosure.

A public interest in disclosure

As the duty of confidentiality is not absolute, there might be circumstances where the public interest in maintaining confidentiality is outweighed by the public interest in disclosing specific information. Such circumstances may include where disclosure is necessary to avert a real risk of a danger of death or serious harm to others or for the prevention or detection of serious crime. Even then such disclosure is permissible only if made to someone with a proper interest in receiving the information.

The operation of the competing public interests is demonstrated in the case of W v. Edgell [1990]. Dr Edgell, a psychiatrist, had prepared a report for a Mental Health Tribunal on behalf of a detained patient (W). The report did not support W’s application and, unsurprisingly, W did not disclose it at the tribunal. Dr Edgell’s report contained information from W relevant to his dangerousness, which Dr Edgell believed should be known to the team treating W. Dr Edgell provided the report to W’s responsible medical officer without W’s consent. The Court of Appeal dismissed W’s claim for breach of confidence finding that, although only the most compelling circumstances would justify a doctor doing something against the patient’s interests, the public interest in maintaining confidence must be weighted against the competing public interest in protecting others from crime. In W’s case, the disclosure had been properly made. The court further noted that Dr Edgell had acted in accordance with the relevant GMC guidance.

Indeed, it would be unusual for a court to find against a clinician who followed GMC guidance and specialist lawyers take the view that ‘the guidelines provide a very good, practical guide as to what the courts are likely to find acceptable. Sometimes they demand more of the doctors than the courts are likely to do, but for most practical purposes they are likely to be co-extensive with the law. It is therefore suggested that the GMC guidelines are used as a manual of the law of confidentiality’ (Foster & Peacock, 2000). The most recent version of the GMC guidance can be accessed at www.gmc-uk.org/standards. (Additionally Department of Health Guidance including ‘The protection and use of patient information’. HSG (96) 18/LASS L (95) 5 is available at www.doh.gov.uk/ipu/confiden). The Royal College of Psychiatrists’ guidance can also be found at www.rcpsych.ac.uk/publications/cr/cr85.htm.

A duty to disclose?

In the USA the renowned case of Tarasoff v. Regents of the University of California [1976] established that:

‘when a doctor determines, or should determine that a warning is essential to avert danger arising from medical or psychological condition of his patient, he incurs a legal obligation to give that warning’.

In England and Wales, no such positive obligation has been established, although in some circumstances a doctor could be found liable in negligence when a failure to disclose confidential information causes or permits further injury or damage to an individual.

In the recent case of C v. Dr Cairns [2003] a general practitioner (GP) was informed by the mother of a 12-year-old girl that her husband had had sexual intercourse with the child. The GP was asked to, and did, keep this information confidential, the mother having assured him that the act only happened once and that she would ensure the abuse would not be repeated. Unknown to the GP the abuse did recur and escalated. When adult, the daughter sued the GP for negligence. Her claim failed largely because the incidence occurred in 1975. The court found there had been no breach of duty of care by the GP as, in 1975, the understanding of child sexual abuse was such that many responsible GPs would have acted similarly and not have sought to involve others. The judge accepted that in 1975, doctor-patient confidentiality was given more weight than it is today. There was then little useful guidance from professional bodies and confidentiality would have been breached only in the rarest of circumstances. It seems improbable that this case would have had the same outcome had the events occurred in 1995, and particularly in the light of current GMC guidelines.

Third parties’ requests for disclosure of confidential medical records

The duty to maintain confidentiality extends to a positive obligation to assert confidentiality in response to any request for information. As was recently set out by the Court of Appeal

‘Dr X’s duty… like that of any other professional or other person who owes a duty of confidentiality to his patient or client is to assert that confidentiality in answer to any claims by a third party for disclosure’ (A Health Authority v. X and Others [2002]).

Even where requests are made by the Police or Crown Prosecution Service (CPS), doctors remain under this obligation to assert confidentiality and should refuse access save in as far as it is in the public interest to disclose material.

Criminal litigation

Often disclosure of medical records of the alleged victim of, or witness to, a crime is requested by the alleged perpetrator’s defence lawyers, and occasionally by the CPS or prosecution team.

Initial refusal by the clinician or hospital authorities to release such records will usually be met by a witness summons being issued by the court (under the Criminal Procedure (Attendance of Witnesses) Act 1965 in the Crown Court). These summonses are frequently drafted in very broad terms requiring the doctor to attend court and produce ‘the medical records in relation to Ms X’. Despite the existence of a witness summons, if the patient does not consent to disclosure, the doctor remains obliged to refuse disclosure on the grounds of confidentiality. The summons only requires attendance at Court with the records. The doctor must not disclose records to the legal advisers of either the prosecution or the defence until the court has decided whether and which records should be disclosed (R v. Westacott [1994]).

The defence legal team are only entitled to have access to confidential material that is relevant to the matters in issue in the criminal trial. They are not entitled to trawl through a patient/victim’s entire medical and/or psychiatric history seeking material for cross-examination. The vast majority of a patient’s medical records are not likely to be material or admissible evidence and ought not to be disclosed. Furthermore many patients’ records will contain confidential references to third parties irrelevant to the criminal trial and such information should be redacted.

Generally, the preferable course of action is for the doctor/Trust to be legally represented when attending court in answer to the summons. The barrister can then make representations to the Court on the doctor’s behalf about whether any part of the medical records contain potentially relevant and admissible material. The judge will then consider the records in private in the light of those representations and make an order as to what, if anything, should be disclosed (Re H(L) [1997]).

Civil actions

In civil actions it is invariably the Claimant’s medical records which are relevant to the issues and the Claimant will usually have already given consent to disclosure. In some circumstances a court may order the reluctant Claimant to sign a form of authority consenting to disclosure of their medical records (Bennett v. Compass Group UK and Ireland Ltd [2002]). Civil courts may set limits on the use and dissemination of any clinical material disclosed in the course of litigation (under the Civil Procedure Rules 2000, Part 31).

Additionally civil courts have powers to order disclosure of documents by parties and by non-parties. Before requiring a non-party to disclose documents the Court will have to be satisfied that the documents would support the case of the applicant or adversely affect the case of another party. As with criminal courts where clinical information is disclosed in response to a court order any breach of confidence arising will not be actionable.

Conclusion

Although civil actions for breach of confidence are rare, the issue can be a minefield for the unwary. Patients need not show that they have sustained any damage from unwarranted disclosure to succeed in a civil action and disclosure may also be considered serious professional misconduct by the GMC. Thus, those who are about to reveal confidential information should carefully consider their grounds for doing so and be clear that there is either consent, lawful authority or some public interest justification.