Confidentiality guidance: Legal annex

1. 1. Various bodies regulating healthcare providers and professionals have statutory powers to require the disclosure of information, including personal information about patients. The following represents only a selection of these bodies, a summary of their most relevant powers, and reference to codes they publish about how they use their powers.
2. 2. There are a large number of other Acts that provide for some form of access to information, which may include personal information about patients, for purposes as diverse as the prevention of terrorism and the investigation of road or rail accidents.
3. 3. If you are unsure about the legal basis for a request for information, you should ask for clarification from the person making the request and, if necessary, seek independent legal advice.

Regulation of healthcare providers and professionals

1. 4. The Care Quality Commission has powers of inspection, entry and to require documents and information under the Health and Social Care Act 2008. Sections 76 to 79 govern the Commission’s use and disclosure of confidential personal information. Section 80 requires it to consult on and publish a code of practice on how it obtains, handles, uses and discloses confidential personal information.
2. 5. Healthcare Inspectorate Wales has powers under the Health and Social Care (Community Health and Standards) Act 2003 to access patients’personal information.
3. 6. The Scottish Care Commission has similar powers in relation to registered independent healthcare providers under section 25 of the Regulation of Care (Scotland) Act 2001.
4. 7. The Regulation and Quality Improvement Authority has powers under sections 41 and 42 of the Health and Personal Social Services (Quality, Improvement and Regulation) Northern Ireland) Order 2003 to enter establishments and agencies and Health and Social Services bodies or providers’ premises and inspect and take copies of records, subject to the protection of confidential information provided for in section 43.
5. 8. The NHS Counter Fraud Service has powers under the NHS Act 2006 and NHS (Wales) Act 2006 to require the production of documents to prevent, detect and prosecute fraud in the NHS. The Department of Health (England) and Welsh Assembly Government have published codes of practice for the use of these powers.
6. 9. Section 35A of the Medical Act 1983 gives the GMC power to require disclosure of information and documentation relevant to the discharge of
   our fitness to practise functions, provided such disclosure is not prohibited by other legislation.
7. 10. The Parliamentary and Health Service Ombudsman, Northern Ireland Ombudsman, Public Service Ombudsman for Wales and the Scottish Public Services Ombudsman have statutory powers similar to the High Court or Court of Session to require the production of documents and the attendance and examination of witnesses for the purposes of investigations about the health bodies that fall within their remits.

Court orders

1. 11. The courts, both civil and criminal, have powers to order disclosure of information in various circumstances. The basis on which disclosure is being ordered should be explained to you; and the patient whose personal information is sought should be told about the order, unless that is not
   practicable or would undermine the purpose for which disclosure is sought.