Is There a Right of Confidentiality Within the NHS?

Is There a Right of Confidentiality Within the NHS?

Confidentiality is an obligation which requires doctors to keep personal and medical information about their patients private. It constitutes a guarantee of fairness in medical actions. Generally, a doctor adopts such an obligation during a patient consultation. Everyone working for the National Health Service (NHS) is under a legal duty to keep patient information, held in whatever form, confidential. This must be contained in their contract of employment as a specific requirement.

The NHS must meet a range of legal and ethical requirements in relation to confidentiality, which can sometimes prove to be a complex task.

A duty of confidentiality is crucial in a doctor and patient relationship. Patients may be hesitant to seek medical advice if the reassurance that their information will be kept confidential is not established. The House of Lords affirmed in AG v Guardian Newspaper (No 2) [1990] AC 109 that there is a public interest in the protection of confidence. However, this duty may not be easy for doctors to abide by at all times. Professional organisations, such as the British Medical Association (BMA) and the General Medical Council (GMC), provide guidelines for doctors on their obligation in respect to confidentiality. These guidelines are not an account of law, but it is surely regarded as persuasive authority.

The NHS must meet a range of legal and ethical requirements in relation to confidentiality, which can sometimes prove to be a complex task. The protection of confidentiality is guaranteed by human rights law in the European Convention of Human Rights (ECHR). Article 8 of the ECHR provides the right to respect for private and family life to every individual. Personal data is governed by the principles in the Data Protection Act 1998. As stated in Z v Finland (1998) 25 EHRR 371:

the protection of personal data, not least medical data, is of fundamental importance to a person’s…right to respect for private and family life.

A statutory obligation of confidence is also held in the NHS (Venereal Disease) Regulations 1974 SI 1974/29, which obliges all NHS Trusts to take reasonable steps in order to safeguard confidentiality.

To determine whether there has been a breach of Article 8, the courts break down the judgement into fragments. First, it needs to be established that the patient was entitled to a reasonable expectation of privacy and, second, whether the disclosure of privacy will be highly offensive. If so, further consideration needs to be given to whether the publication pursues a legitimate aim and, in relation to proportionality, whether the interests gained by the disclosure of privacy are proportionate to the damage to privacy.

Protecting medical confidentiality is difficult as it is influenced by two overlapping spheres of interest, the law and ethics. The ethical notion of confidence plays a huge role as it is crucial to keep in mind when assessing, the circumstances in which the obligation can be lawfully breached, and to consider whether the breach can also be justified on ethical grounds. Lord Coleridge CJ stated in R v Instan [1893] 1QB 450 at 453 that,

[A] legal common law duty is nothing else than the enforcing by law of that which is a moral obligation without legal enforcement.

The classic codes of practice in the Hippocratic Oath states that ‘all that may come to my knowledge… which ought not to be spread abroad, I will keep secret’. There is an apparent indication here that some things ‘may’ be disclosed. In addition, the Declaration of Geneva similarly states: ‘I will respect the secrets which are confined in me’. Again, the word ‘respect’ is subject to a wide interpretation which does not secure a fully implemented right of confidentiality on patients.

In whatever form, disclosure must be done with appropriate care at all times.

There are numerous exceptions which can legally or ethically justify a breach of confidence. This may be a permit under common law or an Act of Parliament. In whatever form, disclosure must be done with appropriate care at all times. A patient’s consent to publish their information is a legal exception. This includes information held on paper, data, visual, audio and even information retained in memory. Regard is not made in relation to the patients age, state or mental health. This rule applies objectively. It is expected that patients are effectively informed about the methods in which their information will be used, in order to receive either an implied consent (where consent has been given in the form of a signal via the informed patient’s behaviour) or an express consent (usually written or oral), including terms which are interchangeable. It is also expected that patients are accommodated with choices, should they not be happy with the method of disclosure before consenting.

Disclosure in the public interest

Where consent is not possible, the NHS may be able to rely on the disclosure being in the public interest. These are circumstances that justify overruling the right of an individual to confidentiality. However, before such justification may be established, the reasoning behind disclosure on such grounds must be scrutinised. First, the judgement must be balanced between the public interest in preserving privacy and protecting confidential information. Second, specialist or legal advice should be taken before information is disclosed. In addition, any disclosed information should be documented.

The courts may also instruct for a disclosure of expert medical reports to be made before a trial to stand in as evidence against a party.

Examples of reasonable arguments of public interest include the disclosure to maintain the freedom of the press. Staff from the NHS may be asked to provide information on certain patients, such as celebrities, in distressing accidents or in regards to a public complaint made by a patient or relative about the care or treatment they were provided. In practice, the express consent of the patient must be gained before any disclosure. In relation to distressing incidents, disclosure must be conducted with utmost care to avoid the breach of confidence, whilst approaching sympathetically with request of information. Campbell v Mirror Group Newspapers [2004] 2 AC 457 concerned the details of two practicing doctors who were treated for AIDs being published in a newspaper. It was held that doctors required protection just like patients. Hence, the health authority succeeded in gaining an injunction.

Disclosure can also be justified to prevent crime. In W v Egdell [1990] CH 359 (CA) it was reasonable for an independent psychiatrist to release information on a prisoner to the director of the hospital and the Home Office. It was of public interest as it concerned the protection of the public from dangerous criminal acts. Section 12 of the Police and Criminal Evidence Act 1984 allows access to records relating to the individual’s physical or mental state for investigation. Furthermore, the Data Protection Act 1998 allows the handling of data to provide assistance in the discovery and prosecution of crime. The BMA also encourages doctors to disclose information if an offence is grave, as the detection of crime may be delayed or prejudiced without disclosure. Nonetheless, disclosure may be uncertain if there is no continuing danger. The courts may also instruct for a disclosure of expert medical reports to be made before a trial to stand in as evidence against a party.

Patients that lack capacity

Some patients may lack capacity to authorise the disclosure of information. This may be an incapable adult or an incapable child. An incapable adult may be an unconscious person in the A&E or a patient suffering from a long term intellectual impairment. So the question which arises is how much information can the NHS disclose in such circumstances? The Mental Capacity Act 2005 states a presumption of capacity. A person will lack capacity if at the time they are unable to make a decision for themselves in relation to the matter because of an impairment or a disturbance in the functioning of the mind or brain, by virtue of the fact that they cannot understand, retain, weigh or use the information relevant to the decision. If lack of capacity is clearly proven, the doctors will not be legally liable on condition that they acted in the best interest of the patient. However, ‘best interest’ may be subject to a wide interpretation. Hence, when patients are conscious, more care needs to be taken before releasing information in their ‘best interest’. Occasionally, lack of capacity in a patient may imply that doctors consult other practitioners about the patient, or inquire advice from family members.

In some cases, carers who care for an incapable adult may believe that they have authority to access that person’s medical information. Healthcare authorities may be reluctant to disclose information as, on one hand, they must consider the principles of confidentiality and their duty towards it and, on the other hand, they must consider whether disclosure is in the best interest of the incapable patient.

The topic of HIV has given rise to a range of problems in relation to confidentiality.

The jurisprudence concerning children and their right of confidence is based on the principles laid out in the case of Gillick v West Norfolk and Wisbech Health Authority [1985] 3 All ER 402. The principle states that minors under 16 can authorise medical intervention if they understand what is proposed, and due to that sufficient understanding, their consent must be respected. It is then up to the doctors to conclude whether the child is competent to fully apprehend the nature of the treatment. However, the child should be encouraged to involve parents or other legal guardians. Should a minor be deemed incompetent under Gillick, then information will then be disclosed to parents or legal guardians provided it is in the child’s best interest. Similarly, if a competent child refuses life threatening treatment, then due to a doctor’s duty of care, he may break the bond of confidentiality and inform the parents or legal guardians in order to make the correct decision.

Patients with HIV

The topic of HIV has given rise to a range of problems in relation to confidentiality. It is ethical to point out that patients who are HIV positive would not want that information to be disclosed and that an issue of privacy arises. Although the actual dilemma here is that if an absolute right of confidentiality to such information was given, this may lead to the failure of people following advice and treatment and, as a result, the spread of such a disease.

Disclosure for medical research

Disclosure for the matter of medical research is of significant public interest. Medical research may involve investigations for new treatments or developing procedures in order to improve patient care. Although disclosure for such a purpose is generally authorised by patients, this may sometimes prove to be unpractical. As stated by the Department of Health, the fundamental principle to apply is of proportionality. It may not be reasonable and proportionate to disclose information to a researcher where patient consent is not expressed. However, if it is difficult to locate a patient without unreasonable effort and the likelihood of detriment to the patient is negligible, then disclosure for research may be proportionate. If in such a case information is disclosed, then a method of safeguarding must be respected. This could be in an anonymous format, and will not constitute a breach of confidence.

Sharing with other health authorities

Sharing information with other authorities providing care may also amount to a legitimate exception for a breach of confidence. It may be obvious that, in some cases, a patient’s information must be shared as they need to be consulted by several practitioners before an agreement is made in relation to their care. The GMC permits information to be shared in such cases, provided they assume responsibility of that patient and that the sharing of information is necessary in order for them to carry out their duties. Moreover, it is the doctor’s duty to assure that information disclosed to entitled practitioners must be restricted in strict professional confidence. Hence, a doctor’s duty is bound in a reasonable way and the likelihood of them bearing the onus for any failed responsibility for their fellow colleagues is reduced.  Furthermore, the GMC 2002 publication provides ethical guidance and, in particular, paragraph 34 specifically draws the attention of doctors to the possibility of breaking the law if they do not act in accordance with the rules.

Statutory exceptions

As part of the legal process, disclosure can be considered under statutory exceptions. Disclosure here seems to be evidently aimed to the good of society. One reason as to why it is impossible for the NHS to provide an absolute right to their patients is due to the fact that some statutes also provide for certain mandatory disclosures, such as for the protection of individuals by the state, or for statistical purposes. Section 251 of the NHS Act 2006, presents the Secretary of State with the authority to use patient-identifiable information without the consent of patients in situations where the information is required to support specific NHS activity. As usual, that authority must be in the interest of the patient or wider public. However, the Secretary of State must consult with the Patient Information Advisory Group (PIAG) before authorising any regulation under section 251.

Damages may be rewarded in the form of compensation as a result of the patient suffering detriment due to the breach.

The issue of confidentiality does not only refer to the duty of the doctor to keep information private, but also the unfettered right of the patient to access their medical information. This may be for several reasons, such as verifying the accuracy of the confidential information kept in medical records about them. They may also need to access their record in order to file a complaint against the NHS or their healthcare authority, or simply want to see how a decision was made about their care. The Access to Health Record Act 1990 was passed as a result. Failure to allow a patient access may conclude a breach of Article 8 of the ECHR. This has been replaced by the Data Protection Act 1998 in all respects, except in regards to deceased persons.

Deceased patients

So far, concerns about an absolute right not being implemented by the NHS have been shown towards living patients. On the other hand, concerns have grown in regards to deceased patients. The Hippocratic Oath compels a doctor to keep medical confidentiality even after death. In terms of legal obligation, the common law is not clear as the doctor and patient relationship has also extinguished.

The GMC states that the duty on confidentiality continues after a patient has died. Personal representatives of deceased patients can request access to the patients records under section 3(1)(f) of the Access to Health Record Act 1990, which is the only remaining live provision. Ethically, it seems that if no harm will be caused to the personal representative or relatives, then disclosure should not be prohibited subject to there being no countervailing ethical factor.

Remedies for breach

Although breaches of confidentiality have many justifications, especially under the category of public interest, cases may arise where doctors fail to keep confident information without sufficient legal or ethical reason. In such circumstances, a patient is entitled to remedies, should they wish to take action. Damages may be rewarded in the form of compensation as a result of the patient suffering detriment due to the breach. Also, the discretionary remedy of an injunction may also be rewarded as seen in Campbell v Mirror Group Newspapers [2004] 2 AC 45


It can be established with certainty that neither the right of protection of confidence nor the right of privacy are absolute and can be lawfully breached in the public interest, or with the consent of the patient. It is ethical to break confidentiality without a patient’s consent, provided it is in their best interest, but it remains that a doctor’s duty to make every reasonable effort and persuade the patient to consent. Should a breach be justified by one of the statutory, ethical or common law exceptions, this will provide for a complete defence for the NHS.

However, the right not being absolute does not mean patients do not have a right to confidence at all. Before any consideration of breaching confidence is made, reference to statutes and legal rights towards patients must be taken into account. Only when all methods of retaining confidentiality have been exhausted can a breach be considered with valid reason. Of course all cases carry a great deal of differences in respect to confidentiality. Whilst some require the disclosure of confidential information, some may not, leaving the patient with an absolute right to confidentiality provided by the NHS.

1 Star2 Stars3 Stars4 Stars5 Stars (1 votes, average: 5.00 out of 5)
Exclusive email insights, members-only careers events, insider tips and more.