Julie Baylis, Case Manager at Medical Protection, provides advice on common confidentiality queries received during the COVID-19 pandemic and how to avoid potential pitfalls in general practice

There is no doubt that the current COVID-19 pandemic has had a significant impact on general practice and the day-to-day life of GPs and practice staff. COVID-19 has changed the face of traditional consultations and raised a number of significant challenges, from self-isolation and social distancing to safety and suitability of remote consultations. 

This past year has been an extremely challenging time for all healthcare professionals and Medical Protection is here to support you. Medical Protection has received a number of queries that have arisen from the use of telemedicine and the potential impacts on maintaining confidentiality. Confidentiality remains central to the trust patients place in their doctors and a key ethical and legal principle in the age of COVID-19. With increased remote consultations taking place, it is vital to consider the potential pitfalls and how your practice can avoid accidental disclosures or confidentiality breaches.

Confidentiality – an overview

The Medical Council’s ethical and professional guidance¹ places great emphasis on the principle of confidentiality and highlights that it is a core element of the doctor-patient relationship. Confidentiality is a centrepiece of general practice: GPs have an ethical and legal duty to keep patients’ personal information confidential. These principles are set out in the Medical Council’s guidance, the General Data Protection Regulation and the Data Protection Act 2018. This duty goes beyond not revealing confidential information and includes a responsibility to ensure that any written patient information is kept securely. 

Confidentiality is a key cornerstone of the successful therapeutic relationship; however, this duty is not absolute. While the express consent of the patient would usually be required before disclosing confidential medical information, there are some circumstances where disclosure is required by law (for example, when ordered by a judge in a court of law). In addition, disclosure may be justified in the public interest to protect the patient or others (for example, in a case where the possible harm that may be caused to the patient by the disclosure is outweighed by the benefits that are likely to arise for the patient or others).

GPs and practices will be familiar with the above principles in the context of traditional face-to-face consultations; however, it is vital to recognise that the same ethical and legal principles apply to remote consultations and the potentially changing landscape of general practice due to the current COVID-19 pandemic. As the following case studies demonstrate, doctors should be aware of the possible confidentiality and accidental disclosure pitfalls exacerbated by the current pandemic and possible steps to reduce these risks.

---

Case one – A friendly chat in a familiar place

Dr K worked in a practice in a remote area in Donegal. Dr K faced significant challenges due to COVID-19 and was looking forward to the prospect of social life reopening. The local restaurant to Dr K was reopening soon, and Dr K had planned to attend with a good friend. 

Dr K had recently had a video consultation with Patient A who had experienced health issues related to COVID-19 infection, having been discharged back home after a three-week stay in the local hospital’s ICU. This was a particularly challenging remote consultation for Dr K. Dr K was aware of his duty of confidentiality to his patients and was very aware of the need to avoid against disclosures.

On the night of the reopening, Dr K enjoyed a meal with his friend, unwinding and discussing his experience of the pandemic as a GP in this rural practice. Dr K said that COVID-19 had been challenging and gave examples of recent difficulties faced with patients who had been discharged from hospital after COVID-19 infection.

Unbeknown to Dr K, Patient A’s brother was sitting on the table next to Dr K and overheard this conversation. Although Dr K did not directly state Patient A’s name, the brother was able to identify the patient being discussed. Patient A subsequently made an official complaint to Dr K that he breached her confidentiality. 

On social media, Dr K expressed his upset in receiving a complaint, especially during the pandemic. In Dr K’s post, he did not state the name of Patient A or her brother; however, a second patient B was identified from this post by a social media follower. Subsequently a complaint was made by Patient B to the practice’s social media page regarding Dr K’s social media post.

Dr K sought Medical Protection’s advice.

Medicolegal advice

In a small community, where it is likely that everyone knows everyone else, anonymising information can be extremely difficult. It is imperative to avoid discussing information that can allow a patient or patients to be identified. Although it may be cathartic to discuss COVID-19 and the challenges you have faced when out and about with friends or colleagues, it is essential to ensure that you are not accidentally breaching any patient’s confidentiality.

It would be advisable to avoid discussing COVID-19 in scenarios such as this, where information is difficult to anonymise. Breaches of confidentiality can often lead to complaints to the practice or the Medical Council, and discussing COVID-19 is no exception. Doctors should always be mindful, when discussing work-related issues in public spaces, that they may be overheard, and should take proactive steps to avoid disclosing confidential information in passing.

It was understandable that Dr K found this complaint upsetting. Complaints are often distressing; however, it is important to reflect and consider steps that could be taken to avoid the common pitfalls that are often highlighted by complaints.

Social media is a common reason why doctors seek Medical Protection’s advice. While social media is a useful and innovative tool and can be used to build professional relations and engage with the public, patients, and colleagues, it is important to remember that the use of social media can be risky, as Dr K experienced. 

The Medical Council has set out clear and helpful guidance on using social media as a doctor¹ and emphasises that you should still maintain the professional standards expected in other forms of communication when using social media. A doctor should always consider the possible impact on colleagues and patients, or the public’s perception of the profession before posting. Even if a post is made on a private social media page, purely for personal use, social media sites cannot guarantee confidentiality, whatever privacy settings are used. 

In small communities, you may have relatives or friends within your social media circle who have access to your posts, and you may inadvertently post confidential information after a bad day at work, vocalising your frustrations online. It would be advisable to avoid publishing information about patients, or any general discussion surrounding COVID-19 that may lead to patients being identified from the information you post on social media. 

Complaints, when made in the public arena, can be particularly challenging. It would be prudent for the practice to contact the patient offline, informing them of the complaints policy and asking if they would like to submit a complaint via formal channels so that the practice may offer a response. It would be advisable for Dr K to avoid responding to the complaint in such a public arena.

---

Case two – A so-called ‘private space’

Dr G was conducting a remote consultation via video. Patient C was visible onscreen. Dr G could also hear other sounds in the background. Dr G was aware that other individuals may have been within earshot of Patient C and was concerned about accidentally breaching his confidentiality during the video consultation.

Medicolegal advice

• Confidentiality considerations remain central when conducting remote consultations via video or by telephone.

• It is always advisable to consider whether other individuals, such as family members, are in the same room as the patient, or even in another room, but still able to overhear the discussion. Patients may talk more loudly in the context of remote consultations, particularly if the network or internet connection is poor.

• It would be advisable to ensure that the patient is sitting in a private space and you may wish to clarify with the patient, should you be concerned about confidentiality, that they are happy for the consultation to continue. You should bear in mind that conversations may be overheard and take proactive steps to avoid such accidental disclosures of personal confidential information.

• Just like in traditional face-to-face consultations, patients may wish for a trusted friend or family member to be present during the consultation. This does not differ in the context of remote consultations: this may also increase due to the ease of relatives already being at home. Implied consent should not necessarily be taken for granted – it would be advisable, when conducting remote consultations with patients who have a family member or other individual present,  to ensure that they are happy for certain things to be discussed, and that you do not accidentally disclose information that the patient would want to be kept confidential. 

Case three – The trusted family member

In the context of the COVID-19 pandemic, practices may receive an increase in family members of patients wishing to speak to a doctor about their loved one. This case provides an overview of the considerations in avoiding potential accidental disclosures.

During one busy Friday afternoon, Dr M received a request from a family member for a remote consultation to discuss Patient D’s most recent test results. Patient D was an adult who was competent to give consent. No further information was supplied to Dr M prior to returning the family member’s telephone call. Dr M reviewed the records and could see that there was no prior authorisation from Patient D on the file to discuss test results with this family member. Dr M also noted that Patient D had undergone a number of tests recently at the local hospital. Dr M considered the confidentiality aspects at play prior to returning the telephone call, to avoid an accidental disclosure.

Medicolegal advice

In this scenario, Dr M did not consider the disclosure to be required by law, nor did Dr M consider it to be in the public interest. Dr M therefore firstly sought express consent for the disclosure of this information to their family member from Patient D. Dr M provided her with full information about the extent of the disclosure, advising her of the information that had been requested and by whom. Patient D advised that she was happy for this information to be disclosed to their family member, although she stated that she did not consent for her recent MRI results to be disclosed to them. Dr M returned the call to the family member and only disclosed the information that he had received the express consent to disclose. 

The duty of confidentiality relates to all information you hold about your patients, including demographic data, dates and times of any appointments, or the fact that an individual may be a patient or registered at the practice. Before disclosing any information about a patient to a third party, the patient’s consent should be sought to the disclosure. Implied consent is considered adequate for instances such as sharing information about a patient’s health within the healthcare team providing care; however, express consent is required if patient-identifiable data is to be disclosed for any other purpose, except where the disclosure is required by law or is necessary in the public interest. 

The Medical Council, within their ethical guidance Guide to Professional Conduct and Ethics for Registered Medical Practitioners¹, provides detailed guidance on the obligations on doctors with regards to confidentiality, including when disclosures may be made with consent and guidance on when disclosure may be justified without consent or after the death of a patient. Doctors should be familiar with this guidance. 


If you are in doubt, please contact Medical Protection for case-specific advice.