Confidentiality policy

As a healthcare professional, you owe a duty of confidentiality to all those who are receiving care. This includes making sure that they are informed about their care and that information about them is shared appropriately. To achieve this, you must:

respect a person’s right to privacy in all aspects of their care;
make sure that people are informed about how and why information is used and shared by those who will be providing care;
respect that a person’s right to privacy and confidentiality continues after they have died;
share necessary information with other healthcare professionals and agencies only when the interests of patient safety and public protection override the need for confidentiality, and;
share with people, their families and their carers, as far as the law allows, the information they want or need to know about their health, care and ongoing treatment sensitively and in a way they can understand.

A duty of confidence arises when one person discloses information to another in circumstances where it is reasonable to expect that the information will be held in confidence. This duty of confidence is derived from:

common law – the decisions of the Courts
statute law which is passed by Parliament.

The common law of confidentiality reflects that people have a right to expect that information given to a healthcare professional is only used for the purpose for which it was given and will not be disclosed without permission. This covers situations where information is disclosed directly to the healthcare professional and also to information that the healthcare professional obtains from others. One aspect of privacy is that individuals have the right to control access to their own personal health information.

It is not acceptable for healthcare professionals to:

discuss matters related to the people in their care outside the clinical setting
discuss a case with colleagues in public where they may be overheard
leave records unattended where they may be read by unauthorised persons.

All healthcare professionals need to be aware of the following pieces of legislation relating to confidentiality:

The Data Protection Act 1998: This Act governs the processing of information that identifies living individuals. Processing includes holding, obtaining, recording, using and disclosing of information and the Act applies to all forms of media, including paper and electronic.

The Human Fertilisation and Embryology Act 1990: Regulates the provision of new reproductive technology services and places a statutory ban upon the disclosure of information concerning gamete donors and people receiving treatment under the Act. Unauthorised disclosure of such information by healthcare professionals and others has been made a criminal offence.

The National Health Service Venereal Disease Regulations (SI 1974 No.29): This states that health authorities should take all necessary steps to ensure that identifiable information relating to persons being treated for sexually transmitted diseases should not be disclosed.

The Mental Capacity Act (2005): This provides a legal framework to empower and protect people who may lack capacity to make some decisions for themselves. The assessor of an “individual’s capacity to make a decision will usually be the person who is directly concerned with the individual at the time the decision needs to be made” this means that different health and social care workers will be involved in different capacity decisions at different times.

The Freedom of Information Act 2000 and Freedom of Information (Scotland) Act 2002: These Acts grant people rights of access to information that is not covered by the Data Protection Act 1998, e.g. information which does not contain a person’s identifiable details.

The Computer Misuse Act 1990: This Act secures computer programmes and data against unauthorised access or alteration. Authorised users have permission to use certain programmes and data. If the users go beyond what is permitted, this is a criminal offence.

Confidentiality after death

The duty of confidentiality does continue after death of an individual to whom that duty is owed.

Information disclosure to the police

There is no obligation placed upon any citizen to answer questions put to them by the police. However, there are some exceptional situations in which disclosure is required by statute. These include:

the duty to report notifiable diseases in accordance with the Public Health Act 1984
the duty to inform the Police, when asked, of the name and address of drivers who are allegedly guilty of an offence contrary to the Road Traffic Act 1998
the duty not to withhold information relating to the commission of acts of terrorism contrary to the Terrorism Act 2000
the duty to report relevant infectious diseases in accordance with the Public Health (Infectious Diseases) Regulations 1998.

Police access to medical records

The police have no automatic right to demand access to a person’s medical records. Usually, before the police may examine a person’s records they must obtain a warrant under the Police and Criminal Evidence Act 1984. Before a police constable can gain access to a hospital, for example, in order to search for information such as medical records or samples of human tissue, he or she must apply to a circuit judge for a warrant. The police have no duty to inform the person whose confidential information is sought, but must inform the person holding that information.

Risk or breach of confidentiality

If a healthcare professional identifies a risk or breach of confidentiality they must raise their concerns with someone in authority if they are unable to take affirmative action to correct the problem and record that they have done so. A risk or breach of confidentiality may be due to individual behaviour or as a result of organisational systems or procedures. The Code states “You must act without delay if you believe that you, a colleague or anyone else may be putting someone at risk”. Healthcare professionals have a professional duty to take action to ensure the people in their care are protected and failure to take such action could amount to professional misconduct on their part.