Disclosures for the protection of patients and others

You must disclose information if it is required by statute, or if you are ordered to do so by a judge or presiding officer of a court (see paragraphs 87 - 94).

You should satisfy yourself that the disclosure is required by law and you should only disclose information that is relevant to the request. Wherever practicable, you should tell patients about such disclosures, unless that would undermine the purpose, for example by prejudicing the prevention, detection or prosecution of serious crime.

Laws and regulations sometimes permit, but do not require, the disclosure of personal information.⁸  If a disclosure is permitted but not required by law, you must be satisfied that there is a legal basis for breaching confidentiality (see paragraph 9). You must also be satisfied that the other relevant requirements for disclosing information are met (see paragraph 10).

You may disclose information on the basis of implied consent for direct care when the conditions in paragraphs 28 and 29 are met, and for local clinical audit when the conditions in paragraph 96 are met. In other cases, you should ask for explicit consent to disclose personal information unless it is not appropriate or practicable to do so.

For example, this might be because:

1. the disclosure is required by law (see paragraphs 17 - 19)
2. you are satisfied that informed consent has already been obtained by a suitable person⁷ 
3. the patient does not have capacity to make the decision. In such a case, you should follow the guidance on disclosures about patients who lack capacity to consent (see paragraphs 41 - 49)
4. you have reason to believe that seeking consent would put you or others at risk of serious harm
5. seeking consent would be likely to undermine the purpose of the disclosure, for example by prejudicing the prevention, detection or prosecution of a serious crime
6. action must be taken quickly, for example in the detection or control of outbreaks of some communicable diseases where there is insufficient time to contact the patient
7. seeking consent is not feasible given the number or age of records, or the likely traceability of patients.
8. you have already decided to disclose information in the public interest (see paragraphs 63 - 70).

There are a large number of laws that require disclosure of patient information – for purposes as diverse as the notification of infectious diseases, the provision of health and social care services, the prevention of terrorism and the investigation of road accidents.

You must disclose information if it is required by law. You should:

1. satisfy yourself that personal information is needed, and the disclosure is required by law
2. only disclose information relevant to the request, and only in the way required by the law
3. tell patients about such disclosures whenever practicable, unless it would undermine the purpose of the disclosure to do so
4. abide by patient objections where there is provision to do so.³² 

You can find advice about disclosures that are permitted but not required by law in paragraph 19.

The courts, both civil and criminal, have powers to order disclosure of information in various circumstances. You must disclose information if ordered to do so by a judge or presiding officer of a court.

You should only disclose information that is required by the court. You should object to the judge or the presiding officer if attempts are made to compel you to disclose what appears to you to be irrelevant information, such as information about a patient’s relative who is not involved in the proceedings. You should also tell the judge or the presiding officer if you think disclosing the information might put someone at risk of harm.

If disclosure is ordered, and you do not understand the basis for this, you should ask the court or a legal adviser to explain it to you. You should also tell the patient whose information the court has asked for what information you will disclose in response to the order, unless that is not practicable or would undermine the purpose for which disclosure is sought.

You must not disclose personal information to a third party such as a solicitor, police officer or officer of a court without the patient’s explicit consent, unless it is required by law, or ordered by a court, or can be justified in the public interest. You may disclose information without consent to your own legal adviser to get their advice.

In Scotland, under the process of precognition disclosure, if you receive a precognition request, in some cases you will have a legal duty to share information, and in other cases disclosure would be voluntary and subject to the guidance at paragraph 9.³³ 

You may disclose information on the basis of implied consent for direct care when the conditions in paragraphs 28 and 29 are met, and for local clinical audit when the conditions in paragraph 96 are met. In other cases, you should ask for explicit consent to disclose personal information unless it is not appropriate or practicable to do so.

For example, this might be because:

1. the disclosure is required by law (see paragraphs 17 - 19)
2. you are satisfied that informed consent has already been obtained by a suitable person⁷ 
3. the patient does not have capacity to make the decision. In such a case, you should follow the guidance on disclosures about patients who lack capacity to consent (see paragraphs 41 - 49)
4. you have reason to believe that seeking consent would put you or others at risk of serious harm
5. seeking consent would be likely to undermine the purpose of the disclosure, for example by prejudicing the prevention, detection or prosecution of a serious crime
6. action must be taken quickly, for example in the detection or control of outbreaks of some communicable diseases where there is insufficient time to contact the patient
7. seeking consent is not feasible given the number or age of records, or the likely traceability of patients.
8. you have already decided to disclose information in the public interest (see paragraphs 63 - 70).

You may disclose information on the basis of implied consent for direct care when the conditions in paragraphs 28 and 29 are met, and for local clinical audit when the conditions in paragraph 96 are met. In other cases, you should ask for explicit consent to disclose personal information unless it is not appropriate or practicable to do so.

For example, this might be because:

1. the disclosure is required by law (see paragraphs 17 - 19)
2. you are satisfied that informed consent has already been obtained by a suitable person⁷ 
3. the patient does not have capacity to make the decision. In such a case, you should follow the guidance on disclosures about patients who lack capacity to consent (see paragraphs 41 - 49)
4. you have reason to believe that seeking consent would put you or others at risk of serious harm
5. seeking consent would be likely to undermine the purpose of the disclosure, for example by prejudicing the prevention, detection or prosecution of a serious crime
6. action must be taken quickly, for example in the detection or control of outbreaks of some communicable diseases where there is insufficient time to contact the patient
7. seeking consent is not feasible given the number or age of records, or the likely traceability of patients.
8. you have already decided to disclose information in the public interest (see paragraphs 63 - 70).

Confidentiality is an important ethical and legal duty but it is not absolute. You may disclose personal information without breaching duties of confidentiality when any of the following circumstances applies.

1. The patient consents, whether implicitly or explicitly for the sake of their own care or for local clinical audit, or explicitly for other purposes (see paragraphs 13 - 15).
2. The patient has given their explicit consent to disclosure for other purposes (see paragraphs 13 - 15 ).
3. The disclosure is of overall benefit⁴ to a patient who lacks the capacity to consent and the dislcosure is made in line with the relevant capacity legislation (see paragraphs 41 - 49).
4. The disclosure is required by law (see paragraphs 17 - 19), or the disclosure is permitted or has been approved under a statutory process that sets aside the common law duty of confidentiality (see paragraphs 20 - 21).
5. The disclosure can be justified in the public interest (see paragraphs 22 - 23).

When disclosing information about a patient you must:

1. use anonymised information if it is practicable to do so and if it will serve the purpose
2. be satisfied the patient:
   1. has ready access to information explaining how their personal information will be used for their own care or local clinical audit, and that they have the right to object
   2. has not objected
3. get the patient’s explicit consent if identifiable information is to be disclosed for purposes other than their own care or local clinical audit, unless the disclosure is required by law or can be justified in the public interest
4. keep disclosures to the minimum necessary for the purpose
5. follow all relevant legal requirements, including the common law and data protection law.⁵ 

Confidential medical care is recognised in law as being in the public interest. The fact that people are encouraged to seek advice and treatment benefits society as a whole as well as the individual. But there can be a public interest in disclosing information to protect individuals or society from risks of serious harm, such as from serious communicable diseases or serious crime.²³ 

If it is not practicable or appropriate to seek consent, and in exceptional cases where a patient has refused consent, disclosing personal information may be justified in the public interest if failure to do so may expose others to a risk of death or serious harm. The benefits to an individual or to society of the disclosure must outweigh both the patient’s and the public interest in keeping the information confidential.

Such a situation might arise, for example, if a disclosure would be likely to be necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person. When victims of violence refuse police assistance, disclosure may still be justified if others remain at risk, for example from someone who is prepared to use weapons, or from domestic violence when children or others may be at risk.

Other examples of situations in which failure to disclose information may expose others to a risk of death or serious harm include when a patient is not fit to drive,²⁴ or has been diagnosed with a serious communicable disease,²⁵  or poses a serious risk to others through being unfit for work.²⁶ 

When deciding whether the public interest in disclosing information outweighs the patient’s and the public interest in keeping the information confidential, you must consider:

1. the potential harm or distress to the patient arising from the disclosure – for example, in terms of their future engagement with treatment and their overall health
2. the potential harm to trust in medical professionals generally – for example, if it is widely perceived that doctors, physician associates or anaesthesia associates will readily disclose information about patients without consent
3. the potential harm to others (whether to a specific person or people, or to the public more broadly) if the information is not disclosed
4. the potential benefits to an individual or to society arising from the release of the information
5. the nature of the information to be disclosed, and any views expressed by the patient
6. whether the harms can be avoided or benefits gained without breaching the patient’s privacy or, if not, what is the minimum intrusion.

If you consider that failure to disclose the information would leave individuals or society exposed to a risk so serious that it outweighs the patient’s and the public interest in maintaining confidentiality, you should disclose relevant information promptly to an appropriate person or authority.

Decisions about whether or not disclosure without consent can be justified in the public interest can be complex. Where practicable, you should seek advice from a Caldicott or data guardian or similar expert adviser who is not directly connected with the use for which disclosure is being considered. If possible, you should do this without revealing the identity of the patient.

You must document in the patient’s record your reasons for disclosing information with or without consent.  You must also document  any steps you have taken to seek the patient’s consent, to inform them about the disclosure, or your reasons for not doing so.