Policy on the disclosure of patient information

The Caldicott Principles allow for the secure transfer of sensitive information across other agencies, for example Social Services, Education, Police and Judicial System. The seven Caldicott Principles relating to the use of patient identifiable information are:

Justify the purpose(s) of using confidential information
Only use it when absolutely necessary
Use the minimum that is required
Access should be on a strict need-to-know basis
Everyone must understand his or her responsibilities
Understand and comply with the law
The duty to share information can be as important as the duty to protect patient confidentiality

Disclosure means the giving of information. Disclosure is only lawful and ethical if the individual has given consent to the information being passed on. Such consent must be freely and fully given. Consent to disclosure of confidential information may be:

explicit
implied
required by law or
capable of justification by reason of the public interest

Disclosure with consent:

Explicit consent is obtained when the person in the care of a Healthcare Professional agrees to disclosure having been informed of the reason for that disclosure and with whom the information may or will be shared. Explicit consent can be written or spoken. Implied consent is obtained when it is assumed that the person in the care of a Healthcare Professional understands that their information may be shared within the healthcare team. Healthcare Professionals should make the people in their care aware of this routine sharing of information, and clearly record any objections.

Disclosure without consent:

The term ‘public interest’ describes the exceptional circumstances that justify overruling the right of an individual to confidentiality in order to serve a broader social concern. Under common law, staff are permitted to disclose personal information in order to prevent and support detection, investigation and punishment of serious crime and/or to prevent abuse or serious harm to others. Each case must be judged on its merits. Examples could include disclosing information in relation to crimes against the person e.g. rape, child abuse, murder, kidnapping, or as a result of injuries sustained from knife or gunshot wounds. These decisions are complex and must take account of both the public interest in ensuring confidentiality against the public interest in disclosure. Disclosures should be proportionate and limited to relevant details.

Disclosure to third parties:

This is where information is shared with other people and/or organisations not directly involved in a person’s care. Healthcare Professionals must ensure that the people in their care are aware that information about them may be disclosed to third parties involved in their care. People in the care of a Healthcare Professional generally have a right to object to the use and disclosure of confidential information. They need to be made aware of this right and understand its implications. Information that can identify individual people in the care of a Healthcare Professional must not be used or disclosed for purposes other than healthcare without the individuals’ explicit consent, some other legal basis, or where there is a wider public interest.

Children and young people under 18 years:

If a young person is able to understand the implications of the disclosure, they are able to give their consent, regardless of age. In practical terms, consideration should be given to whether any child aged 12 and over may be competent to give consent. If a child is not competent to give consent, someone with parental responsibility may consent to disclosure on behalf of the child.

Mothers have automatic parental responsibility, as will the father if they were married at the time of the child’s birth. For children whose births were registered after 15 April 2002 in Northern Ireland, the father has parental responsibility if he is named on the child’s birth certificate. There are also other circumstances in which fathers may gain parental responsibility – for full details see the MPS factsheet on Parental Responsibility.

Patients lacking capacity:

Adults are assumed to have capacity unless they have an impairment affecting their mind (eg, dementia), which means they are unable to make a specific decision at a particular time. There is also a requirement to ensure all practical steps have been taken to help the individual make a decision. If a patient lacks capacity, you should act in their best interests when deciding whether to disclose the information.

Useful Links:

Control of Data Processing Act NI (2016) Health and Social Care (Control of Data Processing) Act (Northern Ireland) 2016 (legislation.gov.uk)

Data Protection Act (1998) Data Protection Act 1998 (legislation.gov.uk)

Caldicott Principals (2013) The Caldicott Principles - GOV.UK (www.gov.uk)