Transcript GROUP WORK 2 - National Information Governance Board for

GROUP WORK 2:
Deciding What to Share
Groups: by the number on your badge

Sharing Scenario cards:
Health/Social Care agency to another
Relatives, friends, carers and
clients/patients
Police & other authorities
Other parties – solicitors, drug
companies, researchers
1
Would we share? Could we share? Should we
anyway?




As a group, discuss and decide whether or not
you WOULD share in these situations
Using the ‘Questions to Ask’ framework, decide
whether you COULD share – legally & ethically
Finally, decide whether you SHOULD share,
even if it was a breach of confidentiality or the
law
Record on any issues or questions for the Q&A
session later.
2
3
Care in the Home

While providing care for your patient you
notice some bruising and she tells you ‘in
confidence’ that her son, who cares for her,
is habitually losing his temper, and one day
did lash out at her but has promised not to
do it again. You know she is also receiving
social care. What should you do?
4
Points in the discussion should include:








The patient has requested you do not share the
information, can you persuade her to consent?
What are the risks – to the patient? To the relative? To
you? Or the risk of delay?
How serious is the injury, how vulnerable is the patient
Encourage the patient to tell her social worker.
Duty to prevent the patient from further abuse –
protection of vulnerable adults (No Secrets initiative)
You cannot give absolute assurances about
confidentiality. Damage to relationship
Person with capacity has the right to make decisions
even if foolish
Support for carer
5
Comment




This scenario is of course very subjective. The decision is whether to
breach the patient’s right to confidentiality.
Depending on the seriousness, it can be argued to be in the patient’s
best interest. This is usually defined as a matter of life and death,
however it should perhaps also relate to issues of serious harm or
distress.
Ideally any other avenue should be explored, such as gaining consent,
or advising the patient to tell their social worker themselves.
If the situation is really serious, then there might just be an argument for
saying that there needs to be a disclosure for the administration of
justice, however that would not necessarily relate to sharing with the
social worker, and maybe the police need to be involved. The ‘No
secrets’ initiative sets out timescales for reporting, where the decision
has been taken to do so, immediately where there is risk of serious
physical harm or serious criminal act (making evidence safe), 24 hours
relating to a specific incident which may be on going or likely to happen
again or within 7 days if there is more general concern. There should be
no delay in reporting serious incidents to Social Services or the Police.
6
An issue of child protection?


A 4 year old child in your day nursery
appears slightly malnourished. The parents
appear to be perfectly loving and caring, but
they are vegan, and you are concerned they
are not replacing dairy products in the child’s
diet sufficiently. You discussed this with them
a few months ago, but nothing appears to
have changed.
What could you do now?
7
Points in the discussion should include:




Communication is key – try to get the parents
to take the child for tests if they disagree with
your opinion that the child is malnourished.
If they disagree, ask for consent to refer the
child yourself.
If they refuse consent you should still refer the
child.
Referral is part of protocol in any case of
neglect, so the family should be appropriately
informed, even if the decision was not to seek
consent.
8
Comments
• Own prejudices/ views on malnourished
• Cultural issues – Ramadan
• Risks if delaying referring to monitor situation
9
Young person’s confession…


A young person (under 18) you are providing care
for, confides in you that they have been abused by a
family member, but begs you to keep it secret as they
are scared about what will happen to them and their
family.
What do you do?
10
Points in the discussion should include:






Communication is key again
Is there a legal duty at this stage?
Police & Criminal Evidence Act – can give a power to
disclose
Human Rights doesn’t necessarily prevent a
disclosure – protection of health & rights
Data Protection – vital interests of the subject –
possibly – medical purposes – possibly
What about consent – what about damage to trust
between you and the child?
11
Comment



Legal duty – possibly not directly as it is not
necessarily a section 47 enquiry, however
professional duty of care would come into
play.
Mental Capacity Act – from 16
Protocols re support for children in these
situations
12
A Mother’s confession…


The mother of a young person (under 18) to
whom you are providing care, confides in you
that they have abused the child, but begs you
to keep it secret as they are scared about
what will happen to them and their family.
What do you do?
13
Points in the discussion should
include:







Is there a legal duty at this stage?
Police & Criminal Evidence Act – can give a power to
disclose
Human Rights doesn’t necessarily prevent a
disclosure – protection of health & rights
Data Protection – vital interests of the subject,
possibly – medical purposes, possibly
What about consent?
CP – precedence over mother
Enough information to judge seriousness
14
Comment

Legal duty – possibly not directly as it is not
necessarily a section 47 enquiry, however
professional duty of care would come into
play.
15
Enough to put you off your food…

On a visit to a child, you notice the mother
seems ill and suspect she has an infectious
disease. The mother works as a chef, does
not want medical advice, wants her
information kept confidential and intends
going to work that evening. What do you do?
16
Points in the discussion should include:





You don’t know for sure she has an infectious
disease
Can you persuade her to seek medical advice?
She may not be your patient – therefore there
is not a statutory duty on you, but there is on
the GP
Human Rights doesn’t necessarily prevent a
disclosure – protection of health & rights
Data Protection – vital interests of the subject,
medical purposes, protecting the public
(substantial public interest)
17
Comment




Legal duty – possibly not directly as it is not
necessarily a section 47 enquiry, however
professional duty of care would come into
play.
Duty of care to third parties
Health and safety at work – possible
disciplinary
Extra precautions to protect from risk
18
Pharmaceutical Company

A large pharmaceutical company have
requested patient information to make an
approach to patients with certain medication
for participation in a clinical trial. What do you
do….?

Further to this, the company have offered to
undertake the search of the database and all
the required activities (mail shots etc) to
contact the patients. What else should you
do…?
19
Points in the discussion should include:






Patients should be made generally aware that records
are used for research/teaching by publicity about use
of records (Fair Processing Notice)
The search of the database should be by someone
who already has access to the records for providing
care.
Retrieval of data should be the minimum required
Approach to the patient must be via the healthcare
organisation (or in partnership)
Need consent or approval under S251 where it can be
shown that seeking consent is not practicable.
Where to get specific advice
20





This is a growing practice, and the second element of offering a service is
often popular, but carries great potential risk. There have been cases
where pharmaceutical employees have made changes to prescriptions so
that their products are favoured. They can view large amounts of other
information not necessarily relevant to their drug.
There is almost a catch 22 situation in this. You cannot get explicit consent
to look at someone’s record to see if you can then approach them to get
consent for participation, as you don’t know who to approach without
looking. Therefore general awareness needs to be raised about the use of
records. Section 251 of the NHS Act 2006 support is there via NIGB to
cover this activity.
However the search should ideally be done by a person who already has
access to the system and the data.
Discussions prior to the activity should identify the minimum data required,
this ideally should only be personal details (name & address) and not any
sensitive items (although by implication the persons medical condition
becomes known and would constitute a breach of confidentiality)
Initial contact should be via the clinical care team. There should be a
covering letter from the GP/Care team saying they are writing on behalf of
researcher and details of study enclosed. The letter should make it clear
that it is entirely up to the patient whether to take part in the study and this
will not affect their usual care or relationship.
21
Researcher ‘Phone Call’


You take a phone call from a
researcher asking for a list of patients
with specific conditions.
What do you do….?
22
Points in the discussion should include:







How do you know they are who they say they are?
Can they confirm ethical committee approval for their
research? (REC approval is not enough)
Ask why they want the information
Refer to line manager if possible
Ask for a written request detailing who they are, what
they want and why.
Lists of patients with particular conditions should not
be disclosed to researchers without prior consent of
the patients or S251 approval
Refer to NHS Research Governance staff
23
Comment

Research is often a bona-fide activity, and many
people appreciate the benefits of it and wish to
be helpful, but it is also a key method for those
wishing to obtain data in an unauthorised
manner to use. Be extremely cautious, any
bona-fide researcher should be able and happy
to give you all the details you require for you or
appropriate line manager to make a decision.

Always best to handle such requests in writing
as further authenticity can be sought.
24
Insurance company requesting
records

You receive a letter from an insurance firm
asking for the medical record of one of your
patients. What do you do….?
25
Points in the discussion should
include:





General application processes should include a
‘consent’ process – but is the patient aware of what
might be released?
Release should only ever be what the patient has
consented to.
Capacity to consent – assessment
May be an option to omit information but clinician
states the record is incomplete – indicate if relevant
Consequences of withholding information –
discussion with patient
26
Comment

Patients not aware of what is in their records
– however they may not think to request to
see a copy of the report – what can you do?

Cannot lie on reports (obviously) – but this
may not be what the patient wants – puts you
in awkward situation, but legally you should
disclose appropriate information related to
what they are applying for.
27
Parents and Adolescents

John aged 14 years old, is being seen by his
GP for care relating to recreational drugs. His
father rings up to find out whether John has
an appointment booked. What would you do
and why?

Is it different if the father asks – ‘can you
remind me what time his appointment is
tomorrow?’
28
Points in the discussion should include:








Is it implicit that John does not want his parents
involved? Perhaps only the GP can judge?
Is John ‘Fraser competent’? (Axon Case parent
wanting information on contraceptive advice given to
child)
Does his father know about the context? (Probably no
way we can know)
Is it in his best interest to share the information?
If you tell the father – might it damage John’s trust in
the practice/NHS forever more?
There is no simple answer
If you say ‘I can’t tell you’ – is that it?
If asked ‘remind me the time’ – it could be ‘fishing…’
why can’t he ask his son?
29
Comment



Children are also owed a duty of confidentiality, but
initially their information is shared with
parents/guardians who are responsible for their care.
As children gain competency, they can make their own
decisions. A child under 16 deemed ‘Fraser competent'
by a doctor in general, can give or withhold consent to
treatment and to disclosure of personal information
including to parents (Gillick and Axon cases).
A child would be regarded as “Fraser competent" if the
doctor concludes that he or she understands the
information provided and the consequences of their
decision. Like capacity it relates to the particular
decision to be made. Sometimes this creates difficulties
where a doctor may perceive a difference in
competency in relation to treatment and disclosure.
30
Safe Sex?


A patient has told you he is HIV positive, and
also tells you that his partner does not know.
He requests you do not tell her.
What do you do?
31
Points in the discussion should include:







Is there a threat to the partner (or others) Duty of care
to third parties (clinical negligence knows risk but fails
to act)
What is the likelihood the partner is already infected?
Can you persuade the patient to tell the partner?
Can you persuade the partner to be tested without
giving the game away?
Is the patient knowingly engaging in unprotected sex?
Data Protection – schedule 3,condition 3 – vital
interests
Human rights/common law – protection of
health/rights/freedoms
32
Comment



In 2003, Mohammad Dica was jailed for 8 years for
transmitting HIV – the first person in 137 years to be
convicted in England of deliberately transmitting a
disease.
Kelly, (Scottish Law) sentenced to five years for
culpable and reckless conduct.
Z v Finland disclosure of wife’s record in criminal
case v husband accused of rape and intentional
transmission of HIV. Wife had objected to disclosure
but records were relevant as the date of her HIV
diagnosis was material as to whether her husband
knew he would be infecting others
33
Please don’t tell

Whilst you are treating a patient, who has full
mental capacity, but is physically very
incapable, they express the wish that you
don’t tell their carer about the recent terminal
diagnosis they have received, despite the fact
the carer may need to know to provide
effective care
34
Points in the discussion should
include:




Patient has given instruction not to disclose, so first
principle should be to respect that if possible
Carers do not have automatic rights to information,
however they need information to provide the
appropriate care – do you think they need to know this
new information?
Does the risk warrant the damage to your relationship
with the patient?
Have you exhausted discussions with the patient to
change their mind?
35
Comment


If the information is not stored in a ‘structured’
filing system then not covered by the Data
Protection Act, however it will be covered by
the common law duty of confidentiality.
Patient has capacity so needs to be
respected and it should be possible to give
information on care without disclosing
terminal diagnosis
36
Keeping daughter in touch via email

Your patient’s daughter lives overseas and
cannot easily visit the patient. She has
requested that she is informed of the
progress of the patient via email. The patient
has full mental capacity, but is quite
physically incapacitated (can’t speak). What
do you do?
37
Points in the discussion should include:






Any email to the relative will go over the Internet and
is therefore inherently unsafe from a confidentiality
perspective
Who should decide? The Patient following
appropriate discussion.
Limit the amount of information transmitted or break
up the information into separate emails
Are there other methods of communication? Fax,
letter?
Could leave out references to identity of patient
Can patient be supported to communicate?
38





Email over the Internet is likened to sending confidential information on
a postcard – many people can read it. Without encryption it is
inherently unsafe.
However the patient should decide whether they are happy with this
risk being taken. There is a medium risk of confidentiality breach, but a
low risk of resultant harm from that. Provided the patient has decided
from a basis of full knowledge then this can be done. Ideally the
patient would sign the consent.
Ideally still limit the information transmitted, it may not be necessary to
name the patient, or give full clinical details etc
Other methods could be used, but are they any more/less secure?
Faxes are more difficult to intercept en-route, but also perhaps in many
circumstances more subject to unauthorised access at the other end
(imagine it being a work fax and the relative not in for the day,
colleagues would undoubtedly see it, whereas an email sent to the
individual they may not). Letters also get lost, but otherwise if properly
addressed can be quite secure, however of course they are not timely.
Fax and post also carry a potentially high ‘unit cost’ for sending,
especially overseas, whereas an email does not.
39
Rape investigation record request

The police require access to a patient’s
medical record. The patient has committed
suicide. The patient has previously signed a
consent form for the Police, stating that they
can access any information about him from
1993 onwards, and details of his accident.
The Police now want access to the entire
record (inc prior to ’93) to help investigate a
number of rapes in the area over the previous
years. What do you do?
40
Points in the discussion should include:






Patient is dead, therefore not covered by DP Act, but
by Access to Health Records act.
Does common law of confidentiality apply with
respect to relatives of deceased?
Can disclose from ’93 onwards, provided consent is
valid (were they mentally stable, not coerced etc)
Should still only release relevant information – may
need to ask for more detail of Police requirements
Public interest may outweigh patient’s rights (Serious
crime investigation)
If still not sure – Police will probably get a court order
41
Comment





Common law of confidentiality applies in this case, as worst case
scenario is that the release of the information slurs the name of the
deceased and causes undue harm/distress to family & friends.
What evidence is there that the consent signed in 93 (which itself is
probably an unusual event) is valid? Was the patient informed of likely
disclosures? Where they capable of making the decision? Were they
coerced in anyway? What period of time elapsed between ’93 and the
death? Could they have changed their mind, but not expressed their
wishes? Would that matter? Does any of the information from ’93
onward look like it was provided on the implied basis it would not be
shared, despite this almost blanket consent being in place? Would the
patient remember their earlier consent in these circumstances? (not
always!)
There is a significant public interest, and provided disclosure is
controlled then ideally it should take place.
Final position maybe a court order, if so this has to be obeyed.
Case law – Bluck v Information Commissioner Lewis v Redfern enquiry
third party information would still be confidential and should be
removed before disclosure
42
A firearm in the family home

A woman reports to you that her
husband has been brandishing his gun
about to control his family. Should you
inform the Police?
43
Points in the discussion should include:






What is the intent?
What is the threat to the family or staff?
Note the situation for other staff – health & safety
compliance
Common Law & Human rights allow breach of
confidentiality/privacy in the robust public interest or
public safety – the family are members of the public
Data Protection allows sharing of personal info
(name & address in this case) in cases of public
interest.
You may want to suggest the wife contacts the police
herself, but you may not know if she has.
44
Comment

Duty of care/protection to members of the
family – possibly child protection etc
45
‘Road Traffic Accident’

Following an accident, the Police have called
asking for the contact details of a passenger
who was in one of the cars involved, as they
wish to check the driver’s story. Can we give
them the details? What should we consider?
46
Points in the discussion should include:




Is the Passenger ‘allegedly guilty of an offence under
the Road Traffic Act’ (probably not – but if yes then
there may be a duty to disclose)
Data Protection (personal info only – not sensitive) –
may allow sharing for ‘legitimate interests of recipient
– provided it does not harm the individual’.
Can we gain consent of the passenger (ideal course
of action)
Common law/Human Rights – how robust is the
‘public interest’?
47
Comments

GMC guidance on disclosure to DVLA
48
Dangerous Driving

Your patient has a medical condition that
makes them a danger on the roads, yet they
insist they are safe to drive. What do you do?

Alternatively you suspect a patient is
exceedingly drunk but wants to drive home –
are you allowed to call the Police?
49
Points in the discussion include:







Is the patient capable of understanding the diagnosis or
situation?
Persuade them to tell DVLA
Suggesting a second opinion for them
(Limited) Disclosure to DVLA medical adviser?
Try to inform patient of the decision to do so
DVLA make decision about ‘medically unfit’
If they are a danger to the public (drunk) and you see them
drive off, then if you are sufficiently concerned, the public
interest justification from common law, Human Rights and
Data Protection could apply, to support calling the Police.
50
Comment

Patient is legally responsible for telling the
DVLA – however disclosure of sensitive data
without consent can happen under the Data
Protection Act, if it is ‘in the subject’s or
another person’s best interest’ (usually matters
of life & death), which this could well be.
51
Police request to A&E

A patient has been treated for hand lacerations, that
he claimed was an accident with a bread knife. A
police officer has arrived in A&E asking if there are
any patients with a similar type of wound. What
steps should be taken by the department & its staff?

Conversely, what if you suspect a patient, should you
report it to the police?
52
Points in the discussion should include:







The Policeman should not be told anything without
discussion taking place away from them
Further information is required – is the Officer looking for
victim or criminal?
Can it be discussed with the Patient?
Senior clinician involved in the treatment of the patient
has to make the decision about what to do
Decision based on judging facts where possible
If involvement is unclear, encouragement should be for
the Police to pursue other lines of enquiry
If the belief is that the patient was involved, then inform
the Police
53
Comment






If appropriate there is a legal basis for sharing the information
within the Data Protection Act and its relation to the Criminal
Justice Act.
The requirements of the Officer should be further defined
What will be the impact of discussion with the Patient? What if
they are a victim? (May not want police involvement) What if they
are the perpetrator? (May abscond)
Decision should not be made by ‘junior’ staff, they should
exercise caution over everything they say and pass responsibility
up the chain of command.
Where the clinician has noted the injury and is suspicious, only
when the grounds for suspicion are so great should information
be passed (potentially under the Police & Criminal Evidence act
as noted before). There may well be other circumstances leading
to greater suspicion, such as news reports etc.
Always document actions & reasons.
54