Monitoring public health and the safety of medicines and devices including disclosures to cancer and other registries

  22.  Professional organisations and government regulatory bodies which monitor the public health or the safety of medicines or devices, as well as cancer and other registries, rely on information from patients' records for their effectiveness in safeguarding the public health. For example, the effectiveness of the yellow card scheme run by the Committee on Safety of Medicines depends on information provided by clinicians. You must co-operate by providing relevant information wherever possible. The notification of some communicable diseases is required by law (see also paragraph 43), and in other cases you should provide information in anonymised form, wherever that would be sufficient.

  23.  Where personal information (ie information about people which doctors learn in a professional capacity and from which individuals can be identified) is needed, you should seek express consent before disclosing information, whenever that is practicable. For example, where patients are receiving treatment there will usually be an opportunity for a health care professional to discuss disclosure of information with them.

  24.  Personal information may sometimes be sought about patients with whom health care professionals are not in regular contact. Doctors should therefore make sure that patients are given information about the possible value of their data in protecting the public health in the longer-term, at the initial consultation or at another suitable occasion when they attend a surgery or clinic. Patients should be given the information set out in paragraph 16: it should be clear that they may object to disclosures at any point. You must record any objections so that patients' wishes can be respected. In such cases, you may pass on anonymised information if asked to do so.

  25.  Where patients have not expressed an objection, you should assess the likely benefit of the disclosure to the public and commitment to confidentiality of the organisation requesting the information. If there is little or no evident public benefit, you should not disclose information without the express consent of the patient.

  26.  Where it is not practicable to seek patients' consent for disclosure of personal information for these purposes, or where patients are not competent to give consent, you must consider whether disclosures would be justified in the public interest, by weighing the benefits to the public health of the disclosure against the possible detriment to the patient

  27.  The automatic transfer of personal information to a registry, whether by electronic or other means, before informing the patient that information will be passed on, is unacceptable save in the most exceptional circumstances. These would be where a court has already decided that there is such an overwhelming public interest in the disclosure of information to a registry that patients' rights to confidentiality are overridden; or where you are willing and able to justify the disclosure, potentially before a court or to the GMC, on the same grounds.

PRINCIPLES

  11.  Information about patients is requested for a wide variety of purposes including education, research, monitoring and epidemiology, public health surveillance, clinical audit, administration and planning. You have a duty to protect patients' privacy and respect their autonomy. When asked to provide information you should follow the guidance in paragraph 1, that is:

(a)  seek patients' consent to disclosure of any information wherever possible, whether or not you judge that patients can be identified from the disclosure;

(b)  anonymise data where unidentifiable data will serve the purpose;

(c)  keep disclosures to the minimum necessary.

  12.  The paragraphs which follow deal with obtaining consent, and what to do where consent is unobtainable, or it is impracticable to seek consent.

OBTAINING CONSENT

  13.  Seeking patients' consent to disclosure is part of good communication between doctors and patients, and is an essential part of respect for patients' autonomy and privacy.

Consent where disclosures will have personal consequences for patients

  14.  You must obtain express consent where patients may be personally affected by the disclosure, for example when disclosing personal information to a patient's employer. When seeking express consent you must make sure that patients are given enough information on which to base their decision, the reasons for the disclosure and the likely consequences of the disclosure. You should also explain how much information will be disclosed and to whom it will be given. If the patient withholds consent, or consent cannot be obtained, disclosures may be made only where they can be justified in the public interest, usually where disclosure is essential to protect the patient, or someone else, from risk of death or serious harm.

Consent where the disclosure is unlikely to have personal consequences for patients

  15.  Disclosure of information about patients for purposes such as epidemiology, public health safety, or the administration of health services, or for use in education or training, clinical or medical audit, or research is unlikely to have personal consequences for the patient. In these circumstances you should still obtain patients' express consent to the use of identifiable data or arrange for members of the health care team to anonymise records (see also paragraphs 16 and 18).

  16.  However, where information is needed for the purposes of the kind set out in paragraph 15, and you are satisfied that it is not practicable either to obtain express consent to disclosure, nor for a member of the health care team to anonymise records, data may be disclosed without express consent. Usually such disclosures will be made to allow a person outside the health care team to anonymise the records. Only where it is essential for the purpose may identifiable records be disclosed. Such disclosures must be kept to the minimum necessary for the purpose. In all such cases you must be satisfied that patients have been told, or have had access to written material informing them:

(a)  That their records may be disclosed to persons outside the team which provided their care.

(b)  Of the purpose and extent of the disclosure, for example, to produce anonymised data for use in education, administration, research or audit.

(c)  That the person given access to records will be subject to a duty of confidentiality.

(d)  That they have a right to object to such a process, and that their objection will be respected, except where the disclosure is essential to protect the patient, or someone else, from risk of death or serious harm.

  17.  Where you have control of personal information about patients, you must not allow anyone access to them for the purposes of the kind set out in paragraph 15, unless the person has been properly trained and authorised by the health authority, NHS trust or comparable body and is subject to a duty of confidentiality in their employment or because of their registration with a statutory regulatory body.

DISCLOSURES IN THE PUBLIC INTEREST

  18.  In cases where you have considered all the available means of obtaining consent, but you are satisfied that it is not practicable[4] to do so, or that patients are not competent to give consent, or exceptionally, in cases where patients withhold consent, personal information may be disclosed in the public interest where the benefits to an individual or to society of the disclosure outweigh the public and the patient's interest in keeping the information confidential.

  19.  In all such cases you must weigh the possible harm (both to the patient, and the overall trust between doctors and patients) against the benefits which are likely to arise from the release of information.

  20.  Ultimately, the "public interest" can be determined only by the courts; but the GMC may also require you to justify your actions if we receive a complaint about the disclosure of personal information without a patient's consent.