Legal Aspects of Patient Confidentiality 2nd edition

Title page

Legal Aspects of Patient Confidentiality

Bridgit Dimond

Publisher information

Quay Books Division, MA Healthcare Ltd, St Jude’s Church, Dulwich Road, London, SE24 0PB

2014 digital version by Andrews UK Limited

www.andrewsuk.com

© MA Healthcare Limited 2010

All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording or otherwise, without prior permission from the publishers

Note

Health and social care practice and knowledge are constantly changing and developing as new research and treatments, changes in procedures, drugs and equipment become available.

The authors, editor and publishers have, as far as is possible, taken care to confirm that the information complies with the latest standards of practice and legislation.

Preface

This monograph follows the publication of a series of articles in the British Journal of Nursing on confidentiality. The need for a book for health professionals setting out the law and practice on confidentiality led to Quay Publications agreeing that the articles, updated and revised, could form the basis of a concise publication covering the main concerns which arise in respecting the duty of confidentiality. It is hoped that all registered health professionals (for convenience referred to here as practitioners) will find the book of value in their professional work, which involves the protection of the rights of the patient and working within the confines of the law. Trust is at the heart of the health professional/patient relationship, yet many practitioners find themselves in situations where they are torn between their duty of confidentiality to the patient and other duties. Knowledge of the law should assist them in resolving such dilemmas.

Acknowledgements

I would like to give my special thanks to Dr Yardley who read the entire typescript and made some valuable suggestions to the text, and who also recommended that the book should be marketed to other health professionals as well as nurses, since the issues considered here are important to them all. I should also record my considerable debt to Bette Griffiths in proofreading and preparing the indexes for the book and her constant encouragement and support.

Chapter 1: The duty to respect patient confidentiality

Box 1.1 Case scenario: breach of confidentiality

Staff Nurse (S/N) Brown discovers that a recent admission on the surgical ward is a member of a famous pop band. She tells her friend, on a promise of total secrecy, that he has been admitted and will be having an operation for a hernia repair the following day. To her embarrassment and shame, the next day the papers publish the story and the disclosure is eventually traced to S/N Brown. What legal repercussions are likely and why?

The duty to respect patient confidentiality arises from a variety of sources including the duty of care to the patient, the contract of employment, professional codes of practice and Acts of Parliament.

Department of Health: Code of Practice on Confidentiality

The Department of Health published an NHS Confidentiality Code of Practice in 2003 (DH, 2003). This supersedes the earlier advice on the protection and use of patient information issued in 1996. The guidance covers the definition of confidentiality; providing a confidential service (including a confidentiality model); and using and disclosing confidential patient information. Annex A sets out the detailed requirements for providing a confidential service. Patients’ health information and their interests must be protected through a number of measures, which include:

1. Recognising that confidentiality is an obligation for all staff, external contractors, and volunteers

2. Recording patient information accurately and consistently

3. Keeping patient information private

4. Keeping patient information physically and electronically secure

5. Disclosing information with appropriate care

Annex B sets out a model which can be used to aid decision making in disclosure situations. There are three distinct flow charts which distinguish three sets of circumstances:

B1, where it is proposed to disclose confidential information in order to provide healthcare

B2, where the purpose is not healthcare but it is a medical purpose as defined in legislation

B3, where the purpose is unrelated to healthcare or another medical purpose

Annex B states that these are important distinctions, in that the legal and ethical requirements differ in each case.

Duty of care to the patient

Implicit within the duty of care owed to the patient is the duty to recognise the right of the patient to have personal information relating to him/her kept confidential (Furniss v. Fitchett [1958]). In theory, therefore, the pop singer in the case scenario (see Box 1.1) could sue the employers of the nurse for their vicarious liability for the breach of confidentiality by the nurse. However, he is unlikely to do this since more publicity would be generated, when clearly he wished the admission to be kept secret. He would have to show that he suffered harm as a result of the disclosure if he were to rely upon an action for breach of the duty of care.

Often when royalty and other famous persons are admitted to hospital, their public relations officers agree with the hospital on an announcement of the admission and on the condition bulletins which are made during their stay. If, however, they wish for the admission and condition to be kept confidential, then this is their right. Had the singer been aware of the intent to publish before it actually took place, then he could have sought an injunction from the court to prevent the publication going ahead. An injunction is an order of the court prohibiting specified action taking place. Failure to comply with an injunction could lead to imprisonment for contempt of court. In the scenario the example of a pop singer is used, but of course the right to confidentiality applies to all patients and not just to the famous.

Duty under the contract of employment

Staff Nurse Brown could face disciplinary proceedings. It is either an express term (i.e. set out in writing or mentioned by word of mouth) of her contract of employment or an implied term (i.e. a term recognised by the courts as implicit within the contract of employment) that she should respect the confidential nature of information about patients. By failing to comply with this term of the contract of employment, she could be disciplined, the ultimate sanction being the loss of her job. Should she consider this to be an unfair dismissal, then if she has the requisite continuous service she could apply to the employment tribunal for a hearing. The employers would have to show the reason for the dismissal and the tribunal would decide if the employer acted reasonably in relying upon this reason to justify dismissal. (For further information on this see Dimond (2008).)

Duty of confidentiality arising from professional codes of practice

The NMC, the HPC and the GMC require all their registered practitioners to recognise the duty of confidentiality owed to the patient as part of the NMC Code of Professional Conduct (NMC, 2008).

The NMC in its 2008 Code states:

Respect people’s confidentiality

You must respect people’s right to confidentiality

You must ensure people are informed about how and why information is shared by those who will be providing their care

You must disclose information if you believe someone may be at risk of harm, in line with the law of the country in which you are practising

Under the duty to uphold the reputation of the profession, the NMC places the following duty on the registered practitioner:

You must cooperate with the media only when you can confidently protect the confidential information and dignity of those in your care

Additional guidance on confidentiality is given by the NMC in its advice sheet (NMC, 2009).

In August 2008 the HPC published guidance on confidentiality (HPC, 2008). It covers keeping information safe; disclosing information; disclosing information without consent; disclosing information by law; confidentiality; and accountability. It also provides a glossary. It will be referred to frequently in this book. Whilst it accepts that guidance cannot cover all situations, it lays down the following principles:

You should:

take all reasonable steps to keep information about service users safe;

get the service user’s informed consent if you are passing on their information, and get express consent, in writing, if you are using the information for reasons which are not related to providing care or services for the service user;

only disclose identifiable information if it is absolutely necessary, and, when it is necessary, only disclose the minimum amount necessary;

tell service users when you have disclosed their information (if this is practical and possible);

keep appropriate records of disclosure;

keep up to date with relevant law and good practice;

if appropriate, ask for advice from colleagues, professional bodies, unions, legal professionals or us [i.e. HPC]; and

make your own informed decisions about disclosure and be able to justify them.

These principles for confidentiality are set out by the HPC in the context of the standards it has set on conduct, performance and ethics. These standards are shown in Box 1.2.

Box 1.2

1 You must act in the best interests of service users.

2 You must respect the confidentiality of service users.

3 You must keep high standards of personal conduct.

4 You must provide (to us and any other relevant regulators) any important information about your conduct and competence.

5 You must keep your professional knowledge and skills up to date.

6 You must act within the limits of your knowledge, skills and experience and, if necessary, refer the matter to another practitioner.

7 You must communicate properly and effectively with service users and other practitioners.

8 You must effectively supervise tasks you have asked other people to carry out.

9 You must get informed consent to give treatment (except in an emergency).

10 You must keep accurate records.

11 You must deal fairly and safely with the risks of infection.

12 You must limit your work or stop practising if your performance or judgement is affected by your health.

13 You must behave with honesty and integrity and make sure that your behaviour does not damage the public’s confidence in you or your profession.

14 You must make sure that any advertising you do is accurate.

Whether or not S/N Brown loses her job, she could face professional conduct hearings before the NMC for her breach of the Code. It is likely that on the facts the NMC would consider disclosure of confidential information about a patient, without any lawful justification, to be misconduct by a nurse and evidence of unfitness to practise. It has various sanctions, the ultimate being removal from the register. If this is the outcome, then the nurse would lose her job. Other health professionals, such as psychologists (recently admitted as registered practitioners with the HPC), also have codes of conduct which require members to recognise the duty of confidentiality, and breach of this duty in circumstances where not justified could result in disciplinary action.

Duties arising from statutory provisions

Sometimes Acts of Parliament lay down clear provisions in relation to confidentiality and make breach of a duty of confidentiality a criminal offence. Thus, the Human Fertilisation and Embryology Act 1990 (as amended by the 1992 Act) makes stringent provisions on disclosure of information. (This is considered in Chapter 7 of this book.) Other statutes and regulations with penalties for breach of confidentiality include:

Abortion Regulations 1991 (as amended in 2002) made under the Abortion Act 1967

NHS (Venereal Disease) Regulations 1974

The Data Protection Act 1998

None of these apply in S/N Brown’s case. They are considered in later chapters of this book.

Human Rights Act 1998

The provisions of this Act came into force in England and Wales on 2 October 2000. They came into force on devolution in Scotland. The Act required all public authorities or organisations carrying out functions of a public nature to respect the European Convention of Human Rights, which is set out in Schedule 1 to the Act. In addition, it gave a right for citizens to bring an action in the courts of the UK if they considered that their human rights as set out in the Schedule had been breached by a public authority. Judges were also required to refer back to Parliament any legislation which they considered to be incompatible with the Articles set out in the European Convention of Human Rights.

One of the most significant changes brought about by this Act is that people no longer have to take their case to Strasbourg for a hearing before the European Court of Human Rights but can avoid the additional cost and delay and bring the case in local courts. If a judicial review is sought of a decision which is considered to be in breach of the human rights recognised in the Convention, then legal aid is available for this action. The House of Lords held that the definition of an organisation exercising functions of a public nature, for the purposes of the Human Rights Act, did not cover a care home under contract with local authorities for the provision of places (YL v. Birmingham City Council [2007]). As a consequence there was considerable concern that all those in private care homes would not have their human rights respected and the definition