GROUP WORK 2: Deciding What to Share

1. GROUP WORK 2:Deciding What to Share Groups: by the number on your badge • Sharing Scenariocards: • Health/Social Care agency to another • Relatives, friends, carers and clients/patients • Police & other authorities • Other parties – solicitors, drug companies, researchers

2. Wouldwe share?Couldwe share?Shouldwe anyway? Pick a card... • As a group, discuss and decide whether or not you WOULDshare in these situations • Using the ‘Questions to Ask’ framework, decide whether you COULD share – legally & ethically • Finally, decide whether you SHOULD share, even if it was a breach of confidentiality or the law • Record on any issues or questions for the Q&A session later.

4. Care in the Home • While providing care for your patient you notice some bruising and she tells you ‘in confidence’ that her son, who cares for her, is habitually losing his temper, and one day did lash out at her but has promised not to do it again. You know she is also receiving social care. What should you do?

5. Points in the discussion should include: • The patient has requested you do not share the information, can you persuade her to consent? • What are the risks – to the patient? To the relative? To you? Or the risk of delay? • How serious is the injury, how vulnerable is the patient • Encourage the patient to tell her social worker. • Duty to prevent the patient from further abuse – protection of vulnerable adults (No Secrets initiative) • You cannot give absolute assurances about confidentiality. Damage to relationship • Person with capacity has the right to make decisions even if foolish • Support for carer

6. Comment • This scenario is of course very subjective. The decision is whether to breach the patient’s right to confidentiality. • Depending on the seriousness, it can be argued to be in the patient’s best interest. This is usually defined as a matter of life and death, however it should perhaps also relate to issues of serious harm or distress. • Ideally any other avenue should be explored, such as gaining consent, or advising the patient to tell their social worker themselves. • If the situation is really serious, then there might just be an argument for saying that there needs to be a disclosure for the administration of justice, however that would not necessarily relate to sharing with the social worker, and maybe the police need to be involved. The ‘No secrets’ initiative sets out timescales for reporting, where the decision has been taken to do so, immediately where there is risk of serious physical harm or serious criminal act (making evidence safe), 24 hours relating to a specific incident which may be on going or likely to happen again or within 7 days if there is more general concern. There should be no delay in reporting serious incidents to Social Services or the Police.

7. An issue of child protection? • A 4 year old child in your day nursery appears slightly malnourished. The parents appear to be perfectly loving and caring, but they are vegan, and you are concerned they are not replacing dairy products in the child’s diet sufficiently. You discussed this with them a few months ago, but nothing appears to have changed. • What could you do now?

8. Points in the discussion should include: • Communication is key – try to get the parents to take the child for tests if they disagree with your opinion that the child is malnourished. • If they disagree, ask for consent to refer the child yourself. • If they refuse consent you should still refer the child. • Referral is part of protocol in any case of neglect, so the family should be appropriately informed, even if the decision was not to seek consent.

9. Comments • Own prejudices/ views on malnourished • Cultural issues – Ramadan • Risks if delaying referring to monitor situation

10. Young person’s confession… • A young person (under 18) you are providing care for, confides in you that they have been abused by a family member, but begs you to keep it secret as they are scared about what will happen to them and their family. • What do you do?

11. Points in the discussion should include: • Communication is key again • Is there a legal duty at this stage? • Police & Criminal Evidence Act – can give a power to disclose • Human Rights doesn’t necessarily prevent a disclosure – protection of health & rights • Data Protection – vital interests of the subject – possibly – medical purposes – possibly • What about consent – what about damage to trust between you and the child?

12. Comment • Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play. • Mental Capacity Act – from 16 • Protocols re support for children in these situations

13. A Mother’s confession… • The mother of a young person (under 18) to whom you are providing care, confides in you that they have abused the child, but begs you to keep it secret as they are scared about what will happen to them and their family. • What do you do?

14. Points in the discussion should include: • Is there a legal duty at this stage? • Police & Criminal Evidence Act – can give a power to disclose • Human Rights doesn’t necessarily prevent a disclosure – protection of health & rights • Data Protection – vital interests of the subject, possibly – medical purposes, possibly • What about consent? • CP – precedence over mother • Enough information to judge seriousness

15. Comment • Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play.

16. Enough to put you off your food… • On a visit to a child, you notice the mother seems ill and suspect she has an infectious disease. The mother works as a chef, does not want medical advice, wants her information kept confidential and intends going to work that evening. What do you do?

17. Points in the discussion should include: • You don’t know for sure she has an infectious disease • Can you persuade her to seek medical advice? • She may not be your patient – therefore there is not a statutory duty on you, but there is on the GP • Human Rights doesn’t necessarily prevent a disclosure – protection of health & rights • Data Protection – vital interests of the subject, medical purposes, protecting the public (substantial public interest)

18. Comment • Legal duty – possibly not directly as it is not necessarily a section 47 enquiry, however professional duty of care would come into play. • Duty of care to third parties • Health and safety at work – possible disciplinary • Extra precautions to protect from risk

19. Pharmaceutical Company • A large pharmaceutical company have requested patient information to make an approach to patients with certain medication for participation in a clinical trial. What do you do….? • Further to this, the company have offered to undertake the search of the database and all the required activities (mail shots etc) to contact the patients. What else should you do…?

20. Points in the discussion should include: • Patients should be made generally aware that records are used for research/teaching by publicity about use of records (Fair Processing Notice) • The search of the database should be by someone who already has access to the records for providing care. • Retrieval of data should be the minimum required • Approach to the patient must be via the healthcare organisation (or in partnership) • Need consent or approval under S251 where it can be shown that seeking consent is not practicable. • Where to get specific advice

21. This is a growing practice, and the second element of offering a service is often popular, but carries great potential risk. There have been cases where pharmaceutical employees have made changes to prescriptions so that their products are favoured. They can view large amounts of other information not necessarily relevant to their drug. • There is almost a catch 22 situation in this. You cannot get explicit consent to look at someone’s record to see if you can then approach them to get consent for participation, as you don’t know who to approach without looking. Therefore general awareness needs to be raised about the use of records. Section 251 of the NHS Act 2006 support is there via NIGB to cover this activity. • However the search should ideally be done by a person who already has access to the system and the data. • Discussions prior to the activity should identify the minimum data required, this ideally should only be personal details (name & address) and not any sensitive items (although by implication the persons medical condition becomes known and would constitute a breach of confidentiality) • Initial contact should be via the clinical care team. There should be a covering letter from the GP/Care team saying they are writing on behalf of researcher and details of study enclosed. The letter should make it clear that it is entirely up to the patient whether to take part in the study and this will not affect their usual care or relationship.

22. Researcher ‘Phone Call’ • You take a phone call from a researcher asking for a list of patients with specific conditions. • What do you do….?

23. Points in the discussion should include: • How do you know they are who they say they are? • Can they confirm ethical committee approval for their research? (REC approval is not enough) • Ask why they want the information • Refer to line manager if possible • Ask for a written request detailing who they are, what they want and why. • Lists of patients with particular conditions should not be disclosed to researchers without prior consent of the patients or S251 approval • Refer to NHS Research Governance staff

24. Comment • Research is often a bona-fide activity, and many people appreciate the benefits of it and wish to be helpful, but it is also a key method for those wishing to obtain data in an unauthorised manner to use. Be extremely cautious, any bona-fide researcher should be able and happy to give you all the details you require for you or appropriate line manager to make a decision. • Always best to handle such requests in writing as further authenticity can be sought.

25. Insurance company requesting records • You receive a letter from an insurance firm asking for the medical record of one of your patients. What do you do….?

26. Points in the discussion should include: • General application processes should include a ‘consent’ process – but is the patient aware of what might be released? • Release should only ever be what the patient has consented to. • Capacity to consent – assessment • May be an option to omit information but clinician states the record is incomplete – indicate if relevant • Consequences of withholding information – discussion with patient

27. Comment • Patients not aware of what is in their records – however they may not think to request to see a copy of the report – what can you do? • Cannot lie on reports (obviously) – but this may not be what the patient wants – puts you in awkward situation, but legally you should disclose appropriate information related to what they are applying for.

28. Parents and Adolescents • John aged 14 years old, is being seen by his GP for care relating to recreational drugs. His father rings up to find out whether John has an appointment booked. What would you do and why? • Is it different if the father asks – ‘can you remind me what time his appointment is tomorrow?’

29. Points in the discussion should include: • Is it implicit that John does not want his parents involved? Perhaps only the GP can judge? • Is John ‘Fraser competent’? (Axon Case parent wanting information on contraceptive advice given to child) • Does his father know about the context? (Probably no way we can know) • Is it in his best interest to share the information? • If you tell the father – might it damage John’s trust in the practice/NHS forever more? • There is no simple answer • If you say ‘I can’t tell you’ – is that it? • If asked ‘remind me the time’ – it could be ‘fishing…’ why can’t he ask his son?

30. Comment • Children are also owed a duty of confidentiality, but initially their information is shared with parents/guardians who are responsible for their care. • As children gain competency, they can make their own decisions. A child under 16 deemed ‘Fraser competent' by a doctor in general, can give or withhold consent to treatment and to disclosure of personal information including to parents (Gillick and Axon cases). • A child would be regarded as “Fraser competent" if the doctor concludes that he or she understands the information provided and the consequences of their decision. Like capacity it relates to the particular decision to be made. Sometimes this creates difficulties where a doctor may perceive a difference in competency in relation to treatment and disclosure.

31. Safe Sex? • A patient has told you he is HIV positive, and also tells you that his partner does not know. He requests you do not tell her. • What do you do?

32. Points in the discussion should include: • Is there a threat to the partner (or others) Duty of care to third parties (clinical negligence knows risk but fails to act) • What is the likelihood the partner is already infected? • Can you persuade the patient to tell the partner? • Can you persuade the partner to be tested without giving the game away? • Is the patient knowingly engaging in unprotected sex? • Data Protection – schedule 3,condition 3 – vital interests • Human rights/common law – protection of health/rights/freedoms

33. Comment • In 2003, Mohammad Dica was jailed for 8 years for transmitting HIV – the first person in 137 years to be convicted in England of deliberately transmitting a disease. • Kelly, (Scottish Law) sentenced to five years for culpable and reckless conduct. • Z v Finland disclosure of wife’s record in criminal case v husband accused of rape and intentional transmission of HIV. Wife had objected to disclosure but records were relevant as the date of her HIV diagnosis was material as to whether her husband knew he would be infecting others

34. Please don’t tell • Whilst you are treating a patient, who has full mental capacity, but is physically very incapable, they express the wish that you don’t tell their carer about the recent terminal diagnosis they have received, despite the fact the carer may need to know to provide effective care

35. Points in the discussion should include: • Patient has given instruction not to disclose, so first principle should be to respect that if possible • Carers do not have automatic rights to information, however they need information to provide the appropriate care – do you think they need to know this new information? • Does the risk warrant the damage to your relationship with the patient? • Have you exhausted discussions with the patient to change their mind?

36. Comment • If the information is not stored in a ‘structured’ filing system then not covered by the Data Protection Act, however it will be covered by the common law duty of confidentiality. • Patient has capacity so needs to be respected and it should be possible to give information on care without disclosing terminal diagnosis

37. Keeping daughter in touch via email • Your patient’s daughter lives overseas and cannot easily visit the patient. She has requested that she is informed of the progress of the patient via email. The patient has full mental capacity, but is quite physically incapacitated (can’t speak). What do you do?

38. Points in the discussion should include: • Any email to the relative will go over the Internet and is therefore inherently unsafe from a confidentiality perspective • Who should decide? The Patient following appropriate discussion. • Limit the amount of information transmitted or break up the information into separate emails • Are there other methods of communication? Fax, letter? • Could leave out references to identity of patient • Can patient be supported to communicate?

39. Email over the Internet is likened to sending confidential information on a postcard – many people can read it. Without encryption it is inherently unsafe. • However the patient should decide whether they are happy with this risk being taken. There is a medium risk of confidentiality breach, but a low risk of resultant harm from that. Provided the patient has decided from a basis of full knowledge then this can be done. Ideally the patient would sign the consent. • Ideally still limit the information transmitted, it may not be necessary to name the patient, or give full clinical details etc • Other methods could be used, but are they any more/less secure? Faxes are more difficult to intercept en-route, but also perhaps in many circumstances more subject to unauthorised access at the other end (imagine it being a work fax and the relative not in for the day, colleagues would undoubtedly see it, whereas an email sent to the individual they may not). Letters also get lost, but otherwise if properly addressed can be quite secure, however of course they are not timely. • Fax and post also carry a potentially high ‘unit cost’ for sending, especially overseas, whereas an email does not.

40. Rape investigation record request • The police require access to a patient’s medical record. The patient has committed suicide. The patient has previously signed a consent form for the Police, stating that they can access any information about him from 1993 onwards, and details of his accident. The Police now want access to the entire record (inc prior to ’93) to help investigate a number of rapes in the area over the previous years. What do you do?

41. Points in the discussion should include: • Patient is dead, therefore not covered by DP Act, but by Access to Health Records act. • Does common law of confidentiality apply with respect to relatives of deceased? • Can disclose from ’93 onwards, provided consent is valid (were they mentally stable, not coerced etc) • Should still only release relevant information – may need to ask for more detail of Police requirements • Public interest may outweigh patient’s rights (Serious crime investigation) • If still not sure – Police will probably get a court order

42. Comment • Common law of confidentiality applies in this case, as worst case scenario is that the release of the information slurs the name of the deceased and causes undue harm/distress to family & friends. • What evidence is there that the consent signed in 93 (which itself is probably an unusual event) is valid? Was the patient informed of likely disclosures? Where they capable of making the decision? Were they coerced in anyway? What period of time elapsed between ’93 and the death? Could they have changed their mind, but not expressed their wishes? Would that matter? Does any of the information from ’93 onward look like it was provided on the implied basis it would not be shared, despite this almost blanket consent being in place? Would the patient remember their earlier consent in these circumstances? (not always!) • There is a significant public interest, and provided disclosure is controlled then ideally it should take place. • Final position maybe a court order, if so this has to be obeyed. • Case law – Bluck v Information Commissioner Lewis v Redfern enquiry third party information would still be confidential and should be removed before disclosure

43. A firearm in the family home • A woman reports to you that her husband has been brandishing his gun about to control his family. Should you inform the Police?

44. Points in the discussion should include: • What is the intent? • What is the threat to the family or staff? • Note the situation for other staff – health & safety compliance • Common Law & Human rights allow breach of confidentiality/privacy in the robust public interest or public safety – the family are members of the public • Data Protection allows sharing of personal info (name & address in this case) in cases of public interest. • You may want to suggest the wife contacts the police herself, but you may not know if she has.

45. Comment • Duty of care/protection to members of the family – possibly child protection etc

46. ‘Road Traffic Accident’ • Following an accident, the Police have called asking for the contact details of a passenger who was in one of the cars involved, as they wish to check the driver’s story. Can we give them the details? What should we consider?

47. Points in the discussion should include: • Is the Passenger ‘allegedly guilty of an offence under the Road Traffic Act’ (probably not – but if yes then there may be a duty to disclose) • Data Protection (personal info only – not sensitive) – may allow sharing for ‘legitimate interests of recipient – provided it does not harm the individual’. • Can we gain consent of the passenger (ideal course of action) • Common law/Human Rights – how robust is the ‘public interest’?

48. Comments • GMC guidance on disclosure to DVLA

49. Dangerous Driving • Your patient has a medical condition that makes them a danger on the roads, yet they insist they are safe to drive. What do you do? • Alternatively you suspect a patient is exceedingly drunk but wants to drive home – are you allowed to call the Police?

50. Points in the discussion include: • Is the patient capable of understanding the diagnosis or situation? • Persuade them to tell DVLA • Suggesting a second opinion for them • (Limited) Disclosure to DVLA medical adviser? • Try to inform patient of the decision to do so • DVLA make decision about ‘medically unfit’ • If they are a danger to the public (drunk) and you see them drive off, then if you are sufficiently concerned, the public interest justification from common law, Human Rights and Data Protection could apply, to support calling the Police.