1

GROUP WORK 2:

Deciding What to Share

Groups: by the number on your badge Sharing Scenario cards:

Health/Social Care agency to anotherRelatives, friends, carers and

clients/patientsPolice & other authoritiesPolice & other authoritiesOther parties – solicitors, drug Other parties – solicitors, drug

companies, researcherscompanies, researchers

2

Would we share? Could we share? Should we anyway?

As a group, discuss and decide whether or not you WOULD share in these situations

Using the ‘Questions to Ask’ framework, decide whether you COULD share – legally & ethically

Finally, decide whether you SHOULD share, even if it was a breach of confidentiality or the law

Record on any issues or questions for the Q&A session later.

3

4

Care in the Home

While providing care for your patient you notice some bruising and she tells you ‘in confidence’ that her son, who cares for her, is habitually losing his temper, and one day did lash out at her but has promised not to do it again. You know she is also receiving social care. What should you do?

5

Points in the discussion should include: The patient has requested you do not share the

information, can you persuade her to consent? What are the risks – to the patient? To the relative? To

you? Or the risk of delay? How serious is the injury, how vulnerable is the patient Encourage the patient to tell her social worker. Duty to prevent the patient from further abuse –

protection of vulnerable adults (No Secrets initiative) You cannot give absolute assurances about

confidentiality. Damage to relationship Person with capacity has the right to make decisions

even if foolish Support for carer

6

Comment This scenario is of course very subjective. The decision is whether to

breach the patient’s right to confidentiality. Depending on the seriousness, it can be argued to be in the patient’s best

interest. This is usually defined as a matter of life and death, however it should perhaps also relate to issues of serious harm or distress.

Ideally any other avenue should be explored, such as gaining consent, or advising the patient to tell their social worker themselves.

If the situation is really serious, then there might just be an argument for saying that there needs to be a disclosure for the administration of justice, however that would not necessarily relate to sharing with the social worker, and maybe the police need to be involved. The ‘No secrets’ initiative sets out timescales for reporting, where the decision has been taken to do so, immediately where there is risk of serious physical harm or serious criminal act (making evidence safe), 24 hours relating to a specific incident which may be on going or likely to happen again or within 7 days if there is more general concern. There should be no delay in reporting serious incidents to Social Services or the Police.

7

An issue of child protection?

A 4 year old child in your day nursery appears slightly malnourished. The parents appear to be perfectly loving and caring, but they are vegan, and you are concerned they are not replacing dairy products in the child’s diet sufficiently. You discussed this with them a few months ago, but nothing appears to have changed.

What could you do now?

8

Points in the discussion should include: Communication is key – try to get the parents

to take the child for tests if they disagree with your opinion that the child is malnourished.

If they disagree, ask for consent to refer the child yourself.

If they refuse consent you should still refer the child.

Referral is part of protocol in any case of neglect, so the family should be appropriately informed, even if the decision was not to seek consent.

9

Comments

• Own prejudices/ views on malnourished

• Cultural issues – Ramadan

• Risks if delaying referring to monitor situation

10

Young person’s confession… A young person (under 18) you are providing care

for, confides in you that they have been abused by a family member, but begs you to keep it secret as they are scared about what will happen to them and their family.

What do you do?

11

Points in the discussion should include: Communication is key again Is there a legal duty at this stage? Police & Criminal Evidence Act – can give a power to

disclose Human Rights doesn’t necessarily prevent a

disclosure – protection of health & rights Data Protection – vital interests of the subject –

possibly – medical purposes – possibly What about consent – what about damage to trust

between you and the child?

12

Comment

Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play.

Mental Capacity Act – from 16 Protocols re support for children in these

situations

13

A Mother’s confession…

The mother of a young person (under 18) to whom you are providing care, confides in you that they have abused the child, but begs you to keep it secret as they are scared about what will happen to them and their family.

What do you do?

14

Points in the discussion should include:

Is there a legal duty at this stage? Police & Criminal Evidence Act – can give a power to

disclose Human Rights doesn’t necessarily prevent a

disclosure – protection of health & rights Data Protection – vital interests of the subject,

possibly – medical purposes, possibly What about consent? CP – precedence over mother Enough information to judge seriousness

15

Comment

Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play.

16

Enough to put you off your food…

On a visit to a child, you notice the mother seems ill and suspect she has an infectious disease. The mother works as a chef, does not want medical advice, wants her information kept confidential and intends going to work that evening. What do you do?

17

Points in the discussion should include: You don’t know for sure she has an infectious

disease Can you persuade her to seek medical advice? She may not be your patient – therefore there

is not a statutory duty on you, but there is on the GP

Human Rights doesn’t necessarily prevent a disclosure – protection of health & rights

Data Protection – vital interests of the subject, medical purposes, protecting the public (substantial public interest)

18

Comment

Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play.

Duty of care to third parties Health and safety at work – possible

disciplinary Extra precautions to protect from risk

19

Pharmaceutical Company A large pharmaceutical company have

requested patient information to make an approach to patients with certain medication for participation in a clinical trial. What do you do….?

Further to this, the company have offered to undertake the search of the database and all the required activities (mail shots etc) to contact the patients. What else should you do…?

20

Points in the discussion should include: Patients should be made generally aware that records

are used for research/teaching by publicity about use of records (Fair Processing Notice)

The search of the database should be by someone who already has access to the records for providing care.

Retrieval of data should be the minimum required Approach to the patient must be via the healthcare

organisation (or in partnership) Need consent or approval under S251 where it can be

shown that seeking consent is not practicable. Where to get specific advice

21

This is a growing practice, and the second element of offering a service is often popular, but carries great potential risk. There have been cases where pharmaceutical employees have made changes to prescriptions so that their products are favoured. They can view large amounts of other information not necessarily relevant to their drug.

There is almost a catch 22 situation in this. You cannot get explicit consent to look at someone’s record to see if you can then approach them to get consent for participation, as you don’t know who to approach without looking. Therefore general awareness needs to be raised about the use of records. Section 251 of the NHS Act 2006 support is there via NIGB to cover this activity.

However the search should ideally be done by a person who already has access to the system and the data.

Discussions prior to the activity should identify the minimum data required, this ideally should only be personal details (name & address) and not any sensitive items (although by implication the persons medical condition becomes known and would constitute a breach of confidentiality)

Initial contact should be via the clinical care team. There should be a covering letter from the GP/Care team saying they are writing on behalf of researcher and details of study enclosed. The letter should make it clear that it is entirely up to the patient whether to take part in the study and this will not affect their usual care or relationship.

22

Researcher ‘Phone Call’ You take a phone call from a

researcher asking for a list of patients with specific conditions.

What do you do….?

23

Points in the discussion should include:

How do you know they are who they say they are? Can they confirm ethical committee approval for their

research? (REC approval is not enough) Ask why they want the information Refer to line manager if possible Ask for a written request detailing who they are, what

they want and why. Lists of patients with particular conditions should not

be disclosed to researchers without prior consent of the patients or S251 approval

Refer to NHS Research Governance staff

24

Comment Research is often a bona-fide activity, and many

people appreciate the benefits of it and wish to be helpful, but it is also a key method for those wishing to obtain data in an unauthorised manner to use. Be extremely cautious, any bona-fide researcher should be able and happy to give you all the details you require for you or appropriate line manager to make a decision.

Always best to handle such requests in writing as further authenticity can be sought.

25

Insurance company requesting records

You receive a letter from an insurance firm asking for the medical record of one of your patients. What do you do….?

26

Points in the discussion should include:

General application processes should include a ‘consent’ process – but is the patient aware of what might be released?

Release should only ever be what the patient has consented to.

Capacity to consent – assessment May be an option to omit information but clinician

states the record is incomplete – indicate if relevant Consequences of withholding information –

discussion with patient

27

Comment Patients not aware of what is in their records

– however they may not think to request to see a copy of the report – what can you do?

Cannot lie on reports (obviously) – but this may not be what the patient wants – puts you in awkward situation, but legally you should disclose appropriate information related to what they are applying for.

28

Parents and Adolescents

John aged 14 years old, is being seen by his GP for care relating to recreational drugs. His father rings up to find out whether John has an appointment booked. What would you do and why?

Is it different if the father asks – ‘can you remind me what time his appointment is tomorrow?’

29

Points in the discussion should include: Is it implicit that John does not want his parents

involved? Perhaps only the GP can judge? Is John ‘Fraser competent’? (Axon Case parent wanting

information on contraceptive advice given to child) Does his father know about the context? (Probably no

way we can know) Is it in his best interest to share the information? If you tell the father – might it damage John’s trust in the

practice/NHS forever more? There is no simple answer If you say ‘I can’t tell you’ – is that it? If asked ‘remind me the time’ – it could be ‘fishing…’

why can’t he ask his son?

30

Comment Children are also owed a duty of confidentiality, but

initially their information is shared with parents/guardians who are responsible for their care.

As children gain competency, they can make their own decisions. A child under 16 deemed ‘Fraser competent' by a doctor in general, can give or withhold consent to treatment and to disclosure of personal information including to parents (Gillick and Axon cases).

A child would be regarded as “Fraser competent" if the doctor concludes that he or she understands the information provided and the consequences of their decision. Like capacity it relates to the particular decision to be made. Sometimes this creates difficulties where a doctor may perceive a difference in competency in relation to treatment and disclosure.

31

Safe Sex? A patient has told you he is HIV positive, and

also tells you that his partner does not know. He requests you do not tell her.

What do you do?

32

Points in the discussion should include: Is there a threat to the partner (or others) Duty of care

to third parties (clinical negligence knows risk but fails to act)

What is the likelihood the partner is already infected? Can you persuade the patient to tell the partner? Can you persuade the partner to be tested without

giving the game away? Is the patient knowingly engaging in unprotected sex? Data Protection – schedule 3,condition 3 – vital

interests Human rights/common law – protection of

health/rights/freedoms

33

Comment In 2003, Mohammad Dica was jailed for 8 years for

transmitting HIV – the first person in 137 years to be convicted in England of deliberately transmitting a disease.

Kelly, (Scottish Law) sentenced to five years for culpable and reckless conduct.

Z v Finland disclosure of wife’s record in criminal case v husband accused of rape and intentional transmission of HIV. Wife had objected to disclosure but records were relevant as the date of her HIV diagnosis was material as to whether her husband knew he would be infecting others

34

Please don’t tell

Whilst you are treating a patient, who has full mental capacity, but is physically very incapable, they express the wish that you don’t tell their carer about the recent terminal diagnosis they have received, despite the fact the carer may need to know to provide effective care

35

Points in the discussion should include:

Patient has given instruction not to disclose, so first principle should be to respect that if possible

Carers do not have automatic rights to information, however they need information to provide the appropriate care – do you think they need to know this new information?

Does the risk warrant the damage to your relationship with the patient?

Have you exhausted discussions with the patient to change their mind?

36

Comment

If the information is not stored in a ‘structured’ filing system then not covered by the Data Protection Act, however it will be covered by the common law duty of confidentiality.

Patient has capacity so needs to be respected and it should be possible to give information on care without disclosing terminal diagnosis

37

Keeping daughter in touch via email

Your patient’s daughter lives overseas and cannot easily visit the patient. She has requested that she is informed of the progress of the patient via email. The patient has full mental capacity, but is quite physically incapacitated (can’t speak). What do you do?

38

Points in the discussion should include:

Any email to the relative will go over the Internet and is therefore inherently unsafe from a confidentiality perspective

Who should decide? The Patient following appropriate discussion.

Limit the amount of information transmitted or break up the information into separate emails

Are there other methods of communication? Fax, letter?

Could leave out references to identity of patient Can patient be supported to communicate?

39

Email over the Internet is likened to sending confidential information on a postcard – many people can read it. Without encryption it is inherently unsafe.

However the patient should decide whether they are happy with this risk being taken. There is a medium risk of confidentiality breach, but a low risk of resultant harm from that. Provided the patient has decided from a basis of full knowledge then this can be done. Ideally the patient would sign the consent.

Ideally still limit the information transmitted, it may not be necessary to name the patient, or give full clinical details etc

Other methods could be used, but are they any more/less secure? Faxes are more difficult to intercept en-route, but also perhaps in many circumstances more subject to unauthorised access at the other end (imagine it being a work fax and the relative not in for the day, colleagues would undoubtedly see it, whereas an email sent to the individual they may not). Letters also get lost, but otherwise if properly addressed can be quite secure, however of course they are not timely.

Fax and post also carry a potentially high ‘unit cost’ for sending, especially overseas, whereas an email does not.

40

Rape investigation record request

The police require access to a patient’s medical record. The patient has committed suicide. The patient has previously signed a consent form for the Police, stating that they can access any information about him from 1993 onwards, and details of his accident. The Police now want access to the entire record (inc prior to ’93) to help investigate a number of rapes in the area over the previous years. What do you do?

41

Points in the discussion should include: Patient is dead, therefore not covered by DP Act, but

by Access to Health Records act. Does common law of confidentiality apply with

respect to relatives of deceased? Can disclose from ’93 onwards, provided consent is

valid (were they mentally stable, not coerced etc) Should still only release relevant information – may

need to ask for more detail of Police requirements Public interest may outweigh patient’s rights (Serious

crime investigation) If still not sure – Police will probably get a court order

42

Comment Common law of confidentiality applies in this case, as worst case

scenario is that the release of the information slurs the name of the deceased and causes undue harm/distress to family & friends.

What evidence is there that the consent signed in 93 (which itself is probably an unusual event) is valid? Was the patient informed of likely disclosures? Where they capable of making the decision? Were they coerced in anyway? What period of time elapsed between ’93 and the death? Could they have changed their mind, but not expressed their wishes? Would that matter? Does any of the information from ’93 onward look like it was provided on the implied basis it would not be shared, despite this almost blanket consent being in place? Would the patient remember their earlier consent in these circumstances? (not always!)

There is a significant public interest, and provided disclosure is controlled then ideally it should take place.

Final position maybe a court order, if so this has to be obeyed. Case law – Bluck v Information Commissioner Lewis v Redfern enquiry

third party information would still be confidential and should be removed before disclosure

43

A firearm in the family home

A woman reports to you that her husband has been brandishing his gun about to control his family. Should you inform the Police?

44

Points in the discussion should include: What is the intent? What is the threat to the family or staff? Note the situation for other staff – health & safety

compliance Common Law & Human rights allow breach of

confidentiality/privacy in the robust public interest or public safety – the family are members of the public

Data Protection allows sharing of personal info (name & address in this case) in cases of public interest.

You may want to suggest the wife contacts the police herself, but you may not know if she has.

45

Comment

Duty of care/protection to members of the family – possibly child protection etc

46

‘Road Traffic Accident’

Following an accident, the Police have called asking for the contact details of a passenger who was in one of the cars involved, as they wish to check the driver’s story. Can we give them the details? What should we consider?

47

Points in the discussion should include: Is the Passenger ‘allegedly guilty of an offence under

the Road Traffic Act’ (probably not – but if yes then there may be a duty to disclose)

Data Protection (personal info only – not sensitive) – may allow sharing for ‘legitimate interests of recipient – provided it does not harm the individual’.

Can we gain consent of the passenger (ideal course of action)

Common law/Human Rights – how robust is the ‘public interest’?

48

Comments

GMC guidance on disclosure to DVLA

49

Dangerous Driving

Your patient has a medical condition that makes them a danger on the roads, yet they insist they are safe to drive. What do you do?

Alternatively you suspect a patient is exceedingly drunk but wants to drive home – are you allowed to call the Police?

50

Points in the discussion include: Is the patient capable of understanding the diagnosis or

situation? Persuade them to tell DVLA Suggesting a second opinion for them (Limited) Disclosure to DVLA medical adviser? Try to inform patient of the decision to do so DVLA make decision about ‘medically unfit’

If they are a danger to the public (drunk) and you see them drive off, then if you are sufficiently concerned, the public interest justification from common law, Human Rights and Data Protection could apply, to support calling the Police.

51

Comment

Patient is legally responsible for telling the DVLA – however disclosure of sensitive data without consent can happen under the Data Protection Act, if it is ‘in the subject’s or another person’s best interest’ (usually matters of life & death), which this could well be.

52

Police request to A&E A patient has been treated for hand lacerations, that

he claimed was an accident with a bread knife. A police officer has arrived in A&E asking if there are any patients with a similar type of wound. What steps should be taken by the department & its staff?

Conversely, what if you suspect a patient, should you report it to the police?

53

Points in the discussion should include: The Policeman should not be told anything without

discussion taking place away from them Further information is required – is the Officer looking for

victim or criminal? Can it be discussed with the Patient? Senior clinician involved in the treatment of the patient

has to make the decision about what to do Decision based on judging facts where possible If involvement is unclear, encouragement should be for

the Police to pursue other lines of enquiry If the belief is that the patient was involved, then inform

the Police

54

Comment If appropriate there is a legal basis for sharing the information

within the Data Protection Act and its relation to the Criminal Justice Act.

The requirements of the Officer should be further defined What will be the impact of discussion with the Patient? What if

they are a victim? (May not want police involvement) What if they are the perpetrator? (May abscond)

Decision should not be made by ‘junior’ staff, they should exercise caution over everything they say and pass responsibility up the chain of command.

Where the clinician has noted the injury and is suspicious, only when the grounds for suspicion are so great should information be passed (potentially under the Police & Criminal Evidence act as noted before). There may well be other circumstances leading to greater suspicion, such as news reports etc.

Always document actions & reasons.