Privacy, confidentiality, and access to health-care records




Confidentiality has long been emphasised in nursing practice. The Nightingale oath provided that:
Confidentiality is still a fundamental part of nursing today. But as health care has grown in sophistication and complexity, so the boundaries of confidentiality have become increasingly difficult to define. Instead of receiving treatment all their life from one family doctor, today patients are usually cared for in a group practice. During their time with that practice they may be seen by many different doctors and nurses. If patients are cared for in hospital the number of persons treating them will be considerably larger. The difficulty in maintaining confidentiality was graphically illustrated by Marc Siegler, a US physician and academic (Siegler 1982). One of Siegler’s patients threatened to leave hospital if he was not told just how many people did have access to his medical records. Siegler went away and came back with a figure of some 75 people – doctors, nurses, etc. – who had legitimate access to his medical records; that did not include, of course, those who might have obtained unauthorised access. This patient was receiving relatively straightforward treatment. It is perhaps no wonder that, after being told this, the patient retorted, ‘Perhaps you could explain just what you mean by confidentiality?’ Maintaining confidentiality may also be particularly problematic as health-care professionals may work caring for patients alongside other professionals drawn from, for example, social work, housing and education. Today, as will be seen below, confidentiality in health-care practice is increasingly rooted in human rights and in particular Article 8 of the European Convention on Human Rights (ECHR, McHale & Gallagher 2004). This safeguards the right to privacy of home and of family life. One aspect of privacy is that of ‘informational privacy’ – the ability of the individual to control access to his/her own personal health information.



GENERAL OBLIGATIONS

The nurse has an obligation to keep patient information confidential. This obligation covers both information disclosed to her/him directly and information that s/he obtains from other health-care professionals when treating the patient. The obligation of confidentiality is contained in the nurse’s professional ethical code. The Nursing and Midwifery Code (Nursing and Midwifery Council 2004) provides that

“You must treat information about patients and clients as confidential and use it only for the purposes for which it was given. As it is impractical to obtain consent every time you need to share information with others, you should ensure that patients and clients understand that some information may be made available to other members of the team involved in the delivery of care. You must guard against breaches of confidentiality by protecting information from improper disclosure at all times. (para 5.1)
Second, the nurse’s contract of employment requires her/him to keep patient information confidential. Unauthorised disclosure may lead the nurse to be disciplined by his/her professional body or to be dismissed by the employer. Guidance on confidentiality within the NHS has been provided by the Department of Health in their document Confidentiality: NHS Code of Practice, which was published in 2003 (Department of Health 2003). Third, where information has been disclosed in breach of an obligation of confidence, legal proceedings may follow, such as an injunction being obtained to stop further publication of the confidential information. For example, in X v. Y ([1988] 2 All ER 648) the medical records of two general practitioners who had developed AIDS were disclosed in a national newspaper. The court issued an injunction to stop further publication of the records. To bring legal proceedings for breach of confidence the patient must show that a duty of confidence, either express or implied, has arisen, that the information was given in confidence and that disclosure was made in breach of that duty (Att. Gen v. Guardian Newspaper (No 2) [1988] 3 All ER 545). A duty of confidence would be implied in a situation in which a patient discloses information to a nurse because of his/her status as a nurse.

Health-care confidentiality is today also reinforced through the application of the Human Rights Act 1998 and in particular Article 8 – the right to privacy of home and family life. The European Court of Human Rights has already confirmed that it protects health-care confidentiality. In Z v. Finland ((1997) 25 EHRR 371) a man was prosecuted for rape. At trial his wife’s medical records, which revealed that she was human immunodeficiency virus (HIV)-positive, were disclosed. The European Court of Human Rights held that this was a breach of her right to privacy.

Although the English courts have rejected claims for a separate ‘privacy tort’ (Wainwright v. Home Office [2003] UKHL 53), nonetheless, the courts have been rooting protection for health-care confidentiality in the right to privacy. In Campbell v. MGN ([2004] 2 AC 457 (HL)) the model Naomi Campbell brought an action for damages regarding the publication of an article in the Daily Mirror that stated that she had been receiving treatment for drug addiction. Campbell claimed that, although there was justification in publication of information that corrected statements she had made in public about her drug addiction, which were false, the publication of an article that detailed information regarding her treatment for drug addiction and an additional photograph constituted an invasion of privacy. While this was not a health-professional–patient breach of confidence, the case does have important implications for the relationship between confidentiality and privacy. In the House of Lords their Lordships confirmed that the action for breach of confidence encompasses protection for personal privacy under Article 8 of the ECHR. The courts will consider whether a person has a reasonable expectation of personal privacy in all the circumstances. In addition, they will examine whether the issue is something that is obviously private or whether the disclosure could be seen as ‘highly offensive to a reasonable person’.

The nurse is thus obliged in both law and professional practice to keep the patient’s confidence. But this obligation is not regarded as absolute – in some situations the nurse may legitimately break confidence, as we shall see below. In addition, the nurse may be required to break confidentiality by court order or by specific statutory provision. These issues will be examined further below.


CHILDREN AND CONFIDENTIALITY

What right does a child patient have to confidentiality? It is ludicrous to suggest that a nurse shouldn’t discuss a toddler’s illness with the child’s mother. But, children grow and begin to express the wish to control aspects of their own lives. If a 14-year-old girl approaches a school nurse and asks for advice regarding contraceptive treatment, what should the nurse do?


Mrs Axon, a mother of teenage daughters, applied for judicial review challenging the Guidance. She argued that there was no duty to maintain confidentiality in this situation unless there were exceptional circumstances such that disclosure of the information would harm the health of the child. Her claim was unsuccessful. Silber J. followed the judgment in Gillick and upheld the guidelines. He noted the importance of safeguarding the human right of privacy under the ECHR and also noted the United Nations Convention on the Rights of the Child. He rejected the claim that the parental rights of privacy were infringed in this case but then went on to say that, even if they were, such infringement was justifiable under Article 8(2) on the public policy basis, ensuring that adolescents seeking advice and treatment regarding sexually transmitted diseases, abortion and contraception.

While the Gillick case was primarily concerned with consent to treatment, nevertheless it appears to be the case that this approach would be followed in relation to confidentiality (Montgomery 1987, Grubb & Pearl 1986). In the case of a Gillick-competent child, a health professional should not usually disclose information to a third party without that child’s consent. This does give rise to some difficult issues as to whether a child has sufficient competence to consent (Ch. 6). Where the child patient is very young, disclosure of information to the parents may be an integral part of the child’s care. Nevertheless, the nurse should think carefully before s/he decides to disclose a child’s medical information without the child’s consent.


THE ADULT LACKING MENTAL CAPACITY

Following the House of Lords decision in Re F ([1990] 2 AC 1), it remained uncertain as to whether and to what extent an obligation of confidentiality arose in the context of an adult who lacked capacity. However this matter has now been resolved in the case of R (on the application of S) v. Plymouth City Council ([2002] EWCA Civ 388). S was a 26-year-old adult who lacked mental capacity. His mother wanted access to his medical records in her capacity as nearest relative under the Mental Health Act 1983 but was refused access because the Local Authority took the view that disclosure would constitute breach of confidence. Hale L.J. held that:

“Article 8 also confers a right to respect for private life. Adults such as C have that right as much as anyone else. Indeed, many would think them more at risk, and therefore more worthy of respect by the authorities if, because of their mental disabilities, they are unable to protect it for themselves.
Here on the facts of the case she allowed his mother access to the medical records – confirming that what was being asked for was limited access by his mother rather than general disclosure to the world at large.



The obligation of confidentiality continues after the patient’s death. When Lord Moran, the physician of Winston Churchill, published a book that discussed the decline of the great war leader (Churchillthe struggle for survival) he was roundly condemned by his contemporaries. The Nursing and Midwifery Council (NMC) document Confidentiality states that ‘The death of a patient/client does not give registrants the right to break confidentiality’ (Nursing and Midwifery Council 2006). But while maintenance of confidentiality after death may be part of the professional’s ethical obligation, it is less certain whether legal proceedings could be brought in such circum-stances. An action for libel and slander cannot be brought after the death of the person who has been defamed. It has been suggested that a court might reject a claim of breach of confidence brought after the patient’s death on the basis that the obligation only existed during that patient’s lifetime (Kennedy & Grubb 1994). Recent controversy over the protection of health-care confidentiality arose in France with the publication in January 1996, after his death, of a book by a physician to President Mitterand of France that con-tained information about Mitterand’s treatment for cancer that had been withheld from the French public (see further Dorozynski 1996, Mason & Laurie 2006). Initially, further publication was stopped by the French courts but this ban was lifted by the European Court of Human Rights, who held France to be in violation of Article 10 because the injunction was disproportionate to the aim and no longer complied with a ‘pressing social need’ (Plon (Societé) v. France Application No 58148/00 18 May 2004).


GROUNDS FOR DISCLOSURE

Patient care would be impossible unless some disclosure of information was made. Certain recognised exceptions do exist. Nevertheless, the nurse should be aware that all disclosures should be carefully justified.


Disclosing with consent

Disclosure is both lawful and complies with professional ethical codes if the patient has given consent to the information being passed on. Such consent must be freely and fully given. However, in practice this may not always be the case. As Mason & Laurie (2006) comment: ‘What patient at a teaching hospital out-patients department is likely to refuse when the consultant asks “You don’t mind these young doctors being present, do you?” – the pressures are virtually irresistible and truly autonomous consent is impossible.’

It can be argued that when a patient enters hospital s/he impliedly consents to such information as is necessary for his/her treatment being passed to other health-care practitioners. But consent to disclosure should not always be presumed. The nurse must ensure that from the onset of care the patient is aware that some information may be disclosed to third parties who are involved in his/her care. Department of Health guidance states that:

“Where patients have been informed of (a) the use and sharing of their information associated with their health care; and (b) the choices that they have and the implications of choosing to limit how information may be used or shared then explicit consent is not usually needed for information disclosures needed to provide that health care. Even so, opportunities to check that patients understand what may happen and are content should be taken.

If the patient objects, the need to respect the patient’s wishes may mean that it is not possible to offer certain treatment choices (Department of Health 2003, para 15). Where disclosure is necessary then information should be disclosed on a ‘need to know’ basis.


Public interest exception

The courts have held that in some situations disclosure of confidential information is justifiable in the public interest. The NMC code also recognises a public interest exception.




5.3 If you are required to disclose information outside the team that will have personal consequences for patients or clients, you must obtain their consent. If the patient or client withholds consent, or if consent cannot be obtained for whatever reason, disclosures may be made only where:


• they can be justified in the public interest (usually where disclosure is essential to protect the patient or client or someone else from the risk of significant harm)


• they are required by law or by order of a court.

What amounts to disclosure in the public interest by a health-care professional was examined by the courts in W v. Egdell ([1990] ChD 359). A breach of confidence action was brought against a psychiatrist. He had been commissioned by W’s solicitors to make a medical report on W’s fitness for discharge from the secure hospital where he had been detained after he was convicted of manslaughter 8 years previously. The report was highly unfavourable to W and W’s solicitors withdrew their application to a Mental Health Review Tribunal. Dr Egdell told the solicitors that he believed that a copy of the report should be put on W’s hospital file. The solicitors disagreed. Dr Egdell himself sent a copy to the hospital. This fact emerged at a subsequent Mental Health Review Tribunal hearing and an action for breach of confidence was brought against Dr Egdell by W.

The case was first heard in the High Court. Scott J. rejected the claim that Dr Edgell was wrong to have disclosed the information. He noted that W was not an ordinary member of the public. In his opinion the doctor owed a duty not only to W but also to the public. This required him to place before the proper authorities the result of his examination of W. He placed weight upon the fact that while in detention W had been seen by a number of psychiatrists. Each of these owed him a duty of confidence such that they could not, for example, sell the information to a newspaper but, at the same time, the reports compiled about W were on file and were available to the Home Office. In the view of Scott J. the fact that these reports were on file had not inhibited W in his dealings with these psychiatrists. He did not believe that the report of Dr Egdell should be treated any differently.

W appealed to the Court of Appeal, where his appeal was rejected. Sir Stephen Brown was broadly in agreement with the first instance decision. Disclosure of the information was in the public interest in ensuring the safety of the public as a whole. The effect of suppressing the material contained in the report would have been to deprive both the hospital and the Secretary of State of vital information. The other judge to deliver a full judgment in this case, Bingham J., was more cautious. He stressed that a patient, such as W, who was held under a restriction order had a very great need for recourse to a professional advisor who was independent and discreet. The confidentiality of such patients should only be broken if needed on the basis of the doctor’s duty to society. On the facts of this particular case, Bingham J. held that disclosure had been justified. The decisive facts were that:

“Where a man has committed multiple killings under the disability of serious mental illness, decisions which may lead directly or indirectly to his release from hospital should not be made unless a responsible authority is able to make an informed judgment that the risk of repetition is so small as to be acceptable.
W v. Egdell clearly illustrates that confidentiality in law is far from an absolute obligation. In each case the court will balance the public interest in ensuring confidentiality against the public interest in disclosure. In determining public interest the courts will make reference to the guidelines set out by the health-care professionals.

It is fairly certain that disclosure of the fact that your patient has a mental illness that makes him a potential danger to the community to the appro-priate authorities will be held to be in the public interest. Similarly, if a nurse was told of child abuse and s/he disclosed this information to an agency such as the National Society for the Prevention of Cruelty to Children it is likely that a court would hold that the disclosure was in the public interest. Nevertheless, there are other situations in which it is not clear whether the public interest justifies disclosure. A nurse who discovers that a patient has committed shoplifting offences should hesitate long before disclosing that fact. Again, the nurse may face a dilemma if a patient tells her/him that he knows the identity of the person who stabbed him but does not want the nurse to give this information to the police because he is frightened of retaliation from a gang of thugs. In such a situation the nurse should attempt to persuade the patient to approach the police himself.




Safeguarding confidentiality may also conflict with another public interest – that of freedom of the press. We noted above in X v. Y that here the court protected patient confidentiality over freedom of expression in the context of health professionals who were HIV-positive. This case was decided before the Human Rights Act was passed. This issue again came before the courts after the Human Rights Act 1998 came into force in the case of H (a health worker) v. Associated Newspapers Ltd ([2002] EWCA Civ 195). This case concerned A, a National Health Service (NHS) professional. He was diagnosed as HIV-positive. Department of Health guidelines provided that, where patients had undergone procedures in relation to which there was a risk of infection, they should be notified that they had been treated by a worker who was HIV-positive and they should be offered counselling. The Health Authority wanted to undertake a ‘look-back’ study and as part of this H was asked to give the Health Authority details of both his NHS and his private patients. He alleged that the first look-back study was unlawful on the basis of clinical confidentiality. In addition he also asked if the Health Authority could be stopped from using information that he had previously supplied. The Mail on Sunday newspaper was informed of the case and wanted to publish details that would have identified both H and the Health Authority in question. In reaching their conclusion the Court of Appeal considered Article 8 – the right to privacy and Article 10 – the right to freedom of expression. They held that there was a strong public interest in maintaining confidentiality of the personal medical information of the health professional. They also held that the name of the Health Authority should not be disclosed as this could lead to the identification of the health professional. However they allowed disclosure of his speciality – information that in their view should be made available for public debate. In Campbell v. MGN, discussed above, while the Court recognised that there was an interest here in publishing the information about Naomi Campbell in the light of the fact that in the past she had previously lied about her drug addiction, nonetheless the information published about the therapy that she was undergoing and the photographs published were not in the public interest.


Disclosure in the context of disciplinary proceedings

The public interest can also justify the disclosure of information in the context of disciplinary proceedings. This issue arose in the case of A Health Authority v. X ([2001] 2 FCR 634), which concerned a Health Authority investigation of a GP’s practice because it was claimed that the practice had broken its terms of service. Application was made by the Health Authority for the disclosure of patient records. The Court of Appeal held that disclosure would be justifiable but also agreed with the judge at first instance by imposing restrictions on the scope of disclosure of the records such that if disclosed they should be treated as confidential and in addition any further disclosure of the information must be subject to safeguards requiring confidentiality and prohibiting unauthorised disclosure.



Police enquiries





A police constable comes into hospital reception. He wants to ask questions of the ward sister and to search through a particular patient’s medical records. Can he do this?
First, if the ward sister is asked questions she is under no obligation to answer them. In English law there is no general obligation placed upon any citizen to answer questions put to them by the police (Rice v. Connolly [1966] 2 QB 416), although if a defendant keeps silent there is a possibility that an adverse inference may be drawn regarding the decision to keep silent (Criminal Justice Act 1994). There are also some exceptional situations in which disclosure is required by statute. For example, under the Terrorism Act 2000, a person can be prosecuted if s/he withholds information relating to acts of terrorism (S19, 20).

Second, the police have no automatic right to demand access to a patient’s records. Access to medical records by police conducting enquiries is regu-lated by statute. Usually, before the police may examine a patient’s medical records they must obtain a warrant under the Police and Criminal Evidence Act 1984 (PACE) (s9–s11 and schedule 1). Before a police constable can gain access to premises such as a doctor’s surgery or a hospital in order to search for information such as medical records/samples of human tissue, or tissue fluid taken for the purpose of diagnosis/medical treatment or held in confidence, s/he must apply to a circuit judge for a warrant. The police must show that there is a reasonable belief that the information needed is contained on the premises and that prior to the 1984 Act a statute existed under which the police could have obtained the information. There is, however, no duty upon the police when applying for a warrant to inform the person whose confidential information is sought about the application. Only the person who is holding the information – in the case of hospital medical records an administrator – must be told. It is submitted that this is undesirable and that the patient should, wherever possible, have a voice at the hearing. It appears that the courts have been prepared to scrutinise carefully applications for medical records. For example, in R v. Cardiff Crown Court ex parte Kellam ((1993) 16 BMLR 76), the court refused to allow police who were investigating a murder of a mental patient to obtain access to records of admission, discharge and leave of patients at the hospital.



Civil law proceedings

If a patient is injured as a result of what s/he claims is negligent treatment, s/he will need to obtain evidence in the form of, for example, medical reports to establish a case. The patient’s lawyers will ask for access to the records. If this is refused, then an application must be made to the court under the Administration of Justice Act 1970 for disclosure of documents. Section 32 makes particular reference to records that are sought in a personal injury action. Here, the court can order that reports are made available to the applicant, to his/her legal advisor or, if the applicant does not have a legal advisor, to his/her medical advisors (s33 and s34 Supreme Court Act 1981). As has been commented (Mason & Laurie 2006, p. 284):

“the court can deal with problems of confidentiality relating to irrelevant conditions – such as a past history of a sexually transmitted disease – by limiting disclosure to the other side’s medical advisors who must respect confidentiality save where litigation is affected.
In addition, disclosure of expert reports should be made at the prehearing stage (Naylor v. Preston AHA [1987] 2 All ER 353). (See Ch. 1 in relation to the encouragement given to broader disclosure and agreement between experts prior to trial following the Woolf report.) There are, however, exceptions to the general requirements of disclosure. For example, communications between a plaintiff and his/her lawyer are usually not required to be disclosed. Such communications are covered by what is known as ‘legal professional privilege’ (for discussion of the operation of the trial process see Ch. 10). In very limited situations, information may be withheld because it is not in the public interest to disclose that information (Re HIV Haemophiliac Litigation [1990] NLJR 1349).

Only gold members can continue reading. Log In or Register to continue

Stay updated, free articles. Join our Telegram channel

Aug 7, 2016 | Posted by in NURSING | Comments Off on Privacy, confidentiality, and access to health-care records

Full access? Get Clinical Tree

Get Clinical Tree app for offline access