From Confidentiality: Protecting and Providing
Information, GMC, August 2000
Monitoring public health and the safety of medicines
and devices including disclosures to cancer and other registries
22. Professional organisations and government
regulatory bodies which monitor the public health or the safety
of medicines or devices, as well as cancer and other registries,
rely on information from patients' records for their effectiveness
in safeguarding the public health. For example, the effectiveness
of the yellow card scheme run by the Committee on Safety of Medicines
depends on information provided by clinicians. You must co-operate
by providing relevant information wherever possible. The notification
of some communicable diseases is required by law (see also paragraph
43), and in other cases you should provide information in anonymised
form, wherever that would be sufficient.
23. Where personal information (ie information
about people which doctors learn in a professional capacity and
from which individuals can be identified) is needed, you should
seek express consent before disclosing information, whenever that
is practicable. For example, where patients are receiving treatment
there will usually be an opportunity for a health care professional
to discuss disclosure of information with them.
24. Personal information may sometimes be
sought about patients with whom health care professionals are
not in regular contact. Doctors should therefore make sure that
patients are given information about the possible value of their
data in protecting the public health in the longer-term, at the
initial consultation or at another suitable occasion when they
attend a surgery or clinic. Patients should be given the information
set out in paragraph 16: it should be clear that they may object
to disclosures at any point. You must record any objections so
that patients' wishes can be respected. In such cases, you may
pass on anonymised information if asked to do so.
25. Where patients have not expressed an
objection, you should assess the likely benefit of the disclosure
to the public and commitment to confidentiality of the organisation
requesting the information. If there is little or no evident public
benefit, you should not disclose information without the express
consent of the patient.
26. Where it is not practicable to seek
patients' consent for disclosure of personal information for these
purposes, or where patients are not competent to give consent,
you must consider whether disclosures would be justified in the
public interest, by weighing the benefits to the public health
of the disclosure against the possible detriment to the patient
27. The automatic transfer of personal information
to a registry, whether by electronic or other means, before informing
the patient that information will be passed on, is unacceptable
save in the most exceptional circumstances. These would be where
a court has already decided that there is such an overwhelming
public interest in the disclosure of information to a registry
that patients' rights to confidentiality are overridden; or where
you are willing and able to justify the disclosure, potentially
before a court or to the GMC, on the same grounds.
Section 4 Disclosure of information other
than for treatment of the individual patient
11. Information about patients is requested
for a wide variety of purposes including education, research,
monitoring and epidemiology, public health surveillance, clinical
audit, administration and planning. You have a duty to protect
patients' privacy and respect their autonomy. When asked to provide
information you should follow the guidance in paragraph 1, that
(a) seek patients' consent to disclosure
of any information wherever possible, whether or not you judge
that patients can be identified from the disclosure;
(b) anonymise data where unidentifiable data
will serve the purpose;
(c) keep disclosures to the minimum necessary.
12. The paragraphs which follow deal with
obtaining consent, and what to do where consent is unobtainable,
or it is impracticable to seek consent.
13. Seeking patients' consent to disclosure
is part of good communication between doctors and patients, and
is an essential part of respect for patients' autonomy and privacy.
Consent where disclosures will have personal consequences
14. You must obtain express consent where
patients may be personally affected by the disclosure, for example
when disclosing personal information to a patient's employer.
When seeking express consent you must make sure that patients
are given enough information on which to base their decision,
the reasons for the disclosure and the likely consequences of
the disclosure. You should also explain how much information will
be disclosed and to whom it will be given. If the patient withholds
consent, or consent cannot be obtained, disclosures may be made
only where they can be justified in the public interest, usually
where disclosure is essential to protect the patient, or someone
else, from risk of death or serious harm.
Consent where the disclosure is unlikely to have
personal consequences for patients
15. Disclosure of information about patients
for purposes such as epidemiology, public health safety, or the
administration of health services, or for use in education or
training, clinical or medical audit, or research is unlikely to
have personal consequences for the patient. In these circumstances
you should still obtain patients' express consent to the use of
identifiable data or arrange for members of the health care team
to anonymise records (see also paragraphs 16 and 18).
16. However, where information is needed
for the purposes of the kind set out in paragraph 15, and you
are satisfied that it is not practicable either to obtain express
consent to disclosure, nor for a member of the health care team
to anonymise records, data may be disclosed without express consent.
Usually such disclosures will be made to allow a person outside
the health care team to anonymise the records. Only where it is
essential for the purpose may identifiable records be disclosed.
Such disclosures must be kept to the minimum necessary for the
purpose. In all such cases you must be satisfied that patients
have been told, or have had access to written material informing
(a) That their records may be disclosed to
persons outside the team which provided their care.
(b) Of the purpose and extent of the disclosure,
for example, to produce anonymised data for use in education,
administration, research or audit.
(c) That the person given access to records
will be subject to a duty of confidentiality.
(d) That they have a right to object to such
a process, and that their objection will be respected, except
where the disclosure is essential to protect the patient, or someone
else, from risk of death or serious harm.
17. Where you have control of personal information
about patients, you must not allow anyone access to them for the
purposes of the kind set out in paragraph 15, unless the person
has been properly trained and authorised by the health authority,
NHS trust or comparable body and is subject to a duty of confidentiality
in their employment or because of their registration with a statutory
18. In cases where you have considered all
the available means of obtaining consent, but you are satisfied
that it is not practicable
to do so, or that patients are not competent to give consent,
or exceptionally, in cases where patients withhold consent, personal
information may be disclosed in the public interest where the
benefits to an individual or to society of the disclosure outweigh
the public and the patient's interest in keeping the information
19. In all such cases you must weigh the
possible harm (both to the patient, and the overall trust between
doctors and patients) against the benefits which are likely to
arise from the release of information.
20. Ultimately, the "public interest"
can be determined only by the courts; but the GMC may also require
you to justify your actions if we receive a complaint about the
disclosure of personal information without a patient's consent.
4 For example where records are of such age and/or
number that reasonable efforts to trace patients are unlikely
to be successful; where the patient has been or may be violent,
or where action must be taken quickly (for example in the out-break
of some communicable diseases) and there is insufficient time
to contact patients. Back