My membership Search

Guidance

Confidentiality - an essential guide

Everything you need to know about confidentiality in medical practice and patient care.

An introduction to confidentiality

Confidentiality is central to the trust between healthcare professionals and patients; without it, patients may be reluctant to divulge personal information, and this could impact their care and treatment. It is often referred to as doctor-patient confidentiality.

Healthcare professionals and others working in a healthcare setting, such as reception and other administrative staff, have access to sensitive personal information about patients and have a legal, ethical and often a contractual duty to keep this information confidential.

Healthcare professionals must understand the general principles of patient confidentiality and their professional, ethical, and contractual obligations.

What is confidentiality?

Confidentiality in healthcare is the protection of a patient's personal information, including their health, family, lifestyle, and care needs. This is to protect the patient's privacy during their care and even after death. Confidentiality is an essential legal and ethical duty but - given the nature of safeguarding and the responsibilities of healthcare professionals - it is not absolute. 

Advice on a specific situation can be sought by contacting our advisory team on our dedicated advice line.

Key principles

Data relating to an identifiable individual should be held securely. The Privacy Commissioner for Personal Data is responsible for the enforcement of the Personal Data (Privacy) Ordinance (Cap 486). One of the data protection principles in the Ordinance relates to data security, and states that data users are required to “take all practicable steps to protect the personal data they hold against unauthorised or accidental access, processing, erasure, loss or use”. 

S.1.1.3 of the Medical Council of Hong Kong’s Code of Professional Conduct (January 2016) – or the Code – says: “All doctors have the responsibility to maintain systematic, true, adequate, clear and contemporaneous medical records.” Further, s.1.1.4 of the Code says: “All Medical records should be kept for such duration as required by the circumstances of the case and other relevant requirements.” Medical records may serve a medicolegal purpose and therefore it is legitimate to continue to keep records of a patient even if they will not be used for the purpose of medical consultation.

In essence, a duty of confidentiality relates to all personally identifiable information held about patients and includes:

  • Medical records
  • Personal details: name, address, age, marital status, sexuality, race
  • Record of appointments
  • Audio/visual recordings
  • The fact that the patient is your patient

Healthcare professionals and those working in a healthcare setting must take care to avoid unintentional disclosure of confidential patient information, for example, by ensuring that any consultations with patients cannot be overheard. Other potential areas and sources of breach of confidentiality include:

  • Waiting areas
  • Use of social networking sites
  • Telephone
  • Texts
  • Computer
  • Emails
  • Audio/visual recordings

Disclosure of information

When disclosing information in any of the situations outlined below, you should ensure that the disclosure is proportional – anonymised if appropriate – and includes only the minimum information necessary for the purpose.

In addition, under the Personal Data (Privacy) Ordinance (PDPO), patients have a right of access to their medical records and other information held about them and may choose to share this information with third parties, such as solicitors, insurance companies, or employers. For further information see our guide to medical record keeping.

Therefore, it is important to understand when information can be disclosed and when it should remain confidential.

Disclosure with consent

Before disclosing any information about a patient to a third party, a patient must consent to the disclosure. Consent may be implied or express; for example, most patients understand that information about their health needs to be shared within the healthcare team providing direct care, so implied consent is often adequate in this circumstance.

However, only information necessary for the provision of care should be shared, and the patient should be informed of the need to share the information and their right to withhold it if they wish. If a patient refuses to allow the sharing of information, then the implications of this on the patient and their care should be explained, and a compromise reached, if possible.

Express consent is required if patient-identifiable data is to be disclosed for any purpose, except if the disclosure is required by law, necessary in the public interest, or in the best interests of the patient - and can be justified despite their lack of consent.

When giving consent to disclosure of information, the patient must be made aware of what data will be disclosed, to whom, and for what purpose.

For consent to disclosure to be valid, the patient must be competent to give consent and must be provided with full information about the extent of the disclosure. Adult patients are assumed to be competent unless there is a specific reason to doubt this.

Additional information consent can be found in our Consent guide here.

Disclosure without consent

Confidentiality is an important ethical and legal duty - but it is not absolute. Certain circumstances can mean you are obliged to disclose information about a patient, even if you do not have the patient’s consent. You may also be asked to provide information from the medical records of patients who are incapable of giving consent, are aged under 18, or have died.

An obligation to disclose

Under certain circumstances, the disclosure of medical information is required by law. In these situations, consent from the patient is not required. Having said that, you should not disclose any more information than is necessary.

For example, under the Prevention and Control of Disease Regulation (Cap 599A), a health officer may, for the purpose of facilitating the investigation of a case or suspected case of a specified infectious disease, require you to give to the health officer any relevant information. You should comply with such a requirement.

Disclosures to third parties

Usually, you should obtain the patient’s consent before disclosing confidential information to a third party. However, s.1.4.2 of the Medical Council of Hong Kong’s Code of Professional Conduct (January 2016) says there are exceptional circumstances when consent is not necessary: “(i) where disclosure is necessary to prevent serious harm to the patient or other persons; (ii) when disclosure is required by law.” It also states that before making such a disclosure the arguments for and against it must be carefully weighed, and the clinician must be prepared to justify the decision.

Courts or litigation

Both civil and criminal courts have powers to order the disclosure of information in various circumstances. A judge can require you to disclose patient information.

In certain circumstances, the coroner is required to investigate the circumstances of a death – for example, if a person dies suddenly, by accident or violence, or under suspicious circumstances. You may be asked by the coroner, usually through the police, to disclose information about the deceased that is likely to be relevant to the investigation without the consent of the deceased’s family.

Justifiable disclosures in the public interest

The disclosure of information about a patient without the patient’s express consent may be justifiable, if the public interest in disclosing the information outweighs the patient’s interests in keeping it confidential.

In all cases, you must decide whether or not the possible harm caused to the patient – and the overall trust between doctors and patients – by disclosing this information will outweigh the benefits resulting from the disclosure.

You should attempt to seek the patient’s consent, but there are certain circumstances when this will not be possible. It is important to document any decision you make and your reasons for disclosing the information.

Communicable diseases

The Code provides that in any given cases when it appears that others, i.e, spouses, those close to the patient, other doctors and health workers, may be at risk if not informed that a patient has a serious infection, you should discuss the situation fully and completely with the patient. You should endeavour to obtain the patient’s permission for the disclosure of the facts to those at risk.

Should permission be refused and if the welfare of other health workers may be properly considered to be endangered, MCHK would not consider it to be unethical if those who might be at risk of infection whilst treating the patient were to be informed of the risk.

If the patient refuses to consent to the disclosure of their health to spouses or other partners who may be at risk, MCHK says you may “consider it a duty to inform the spouse or other partner”.

Adults lacking capacity

The overriding principle is that the disclosure of confidential information is made in the best interests of the persons lacking capacity. This may involve releasing information about their condition – for example, to their carer, to ensure they receive the best treatment.

Children and young people

Many young people have the capacity to consent to the disclosure of their medical records. If the child or young person (under 18 years of age) is able to understand the purposes and consequences of disclosure, he or she may consent or refuse consent to the disclosure.

If a child or young person under 18 refuses consent, you should nevertheless disclose the information if this is necessary to protect the child, young person or someone else from serious harm, or if disclosure is justifiable in the public interest.

Social media

It is essential to maintain patient confidentiality in all professional communications and this includes the use of social media and other digital communication formats.

Useful resources

Explore this page