In this series Charlotte Hudson explores the key risk areas in general practice

The issue of confidentiality is a complex one for doctors, particularly with regards to disclosing patient information to third parties. The legal and ethical dilemmas of when you can disclose information, whose consent you need and in what circumstances are particularly tricky areas for doctors. The situation is even more blurred in scenarios where a person lacks the capacity to consent

Working in general practice, you may be asked to provide information from the medical records of patients who are incapable of giving consent, are aged under 18, or have died. Or you may be asked by a child or young person to withhold information from their parents about their condition or treatment. How do you handle requests of this nature?

The GMC, in its Confidentiality guidance, states that when making decisions about whether to disclose information about a patient who lacks capacity, you must make the care of the patient your first concern; respect the patient’s dignity and privacy; and support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information.

"For consent to be valid, a patient must be competent to make a decision"

For consent to be valid, a patient must be competent to make a decision. Assessment of a person’s capacity should be based on his/her ability to understand, retain and weigh in the balance the information relevant to a particular decision. The person must also be able to communicate the decision. The starting point in the case of adults is always to presume that the patient has capacity until it is shown otherwise.

Children and young people with capacity

Many young people have the capacity to consent to the disclosure of their medical records. If the child or young person (under 18 years of age) is able to understand the purposes and consequences of disclosure (Gillick competent) they can consent or refuse consent to the disclosure. You should discuss disclosing the information with them and release it only with the child or young person’s consent. If a child or young person under 18 refuses consent, you should nevertheless disclose the information if it satisfies one of the circumstances below:

When should you disclose?

• If you consider the child or young person to be at risk of neglect or abuse
• To assist in the prevention, detection or prosecution of a serious crime
• Where the child or young person may be involved in behaviour that might put themselves or others at risk of serious harm, such as serious addiction, self-harm or joyriding
• For the purpose of a criminal investigation.

"You should involve the child in the decision and ensure it is documented, including notes on how the decision was reached"

You should involve the child in the decision and ensure it is documented, including notes on how the decision was reached. 

Confidentiality about treatment

As children grow older and become more competent to make their own decisions about treatment, they also become entitled to confidentiality about that treatment. Be aware that Gillick competent children may visit the surgery alone to talk about issues they want keeping confidential (such as family planning) but may still visit with a parent with other conditions. MPS frequently receives calls on the helpline in relation to matters regarding consent and confidentiality relating to children. 

Children and young people without capacity

The overriding principle, when dealing with the disclosure of the medical records of children or young people who do not have the maturity or understanding to make a decision, is ensuring that you act in their best interests.

If the child or young person lacks the capacity to consent to the disclosure of information, those with parental responsibility can consent on their behalf. The consent of only one person with parental responsibility is needed for consent for disclosure. Unless she lacks capacity herself, a child’s mother automatically has parental responsibility. A father will have parental responsibility if any of the following conditions apply:

• He is married to the mother of his child (or was married to her at the time of the child’s birth).
• He has made a parental responsibility agreement with the mother.
• He has obtained a court order granting him parental responsibility.
• The child was born after 15 April 2002 in Northern Ireland, 1 December 2003 in England or Wales, or 4 May 2006 in Scotland and the father is named on the child’s birth certificate, regardless of whether married or not.

"The overriding principle, when dealing with the disclosure of the medical records of children or young people who do not have the maturity or understanding to make a decision, is ensuring that you act in their best interests"

Other individuals or organisations (such as social services) may be given parental responsibility by court order, or by being appointed as a guardian on the death of a parent. There are also circumstances where parents might delegate parental responsibility to the child’s grandparents, eg, so that they can attend the surgery on behalf of the parents.

The Mental Capacity Act 2005 and the Children Act 1989 can apply in young people aged 16-17, depending on the circumstances. In England, the MCA defines anyone of age 16 as an adult.

It is important to record any decision made in the patient’s notes. This should include the information that was provided to the patient and the parents, and how the decision was reached.

Child abuse

The Children Act 2004 places a statutory duty on medical professionals to safeguard the wellbeing of children. The GMC also advises that if you believe a patient to be a victim of neglect, or physical, sexual or emotional abuse, and that they lack the capacity to consent to disclosure, you must give information promptly to an appropriate responsible person or authority, if you believe this is in the patient’s best interests or necessary to protect others from risk of serious harm. You should usually tell the patient that you intend to disclose the information before doing so. Where appropriate, you should also inform those with parental responsibility about the disclosure.

Adults lacking capacity

Under the Mental Capacity Act 2005, patients are assumed to have capacity, unless they have an impairment affecting their mind (eg, dementia), which means they are unable to make a specific decision at a specific time. There is also a requirement to ensure all practical steps have been taken to help the individual make a decision.

"The Children Act 2004 places a statutory duty on medical professionals to safeguard the wellbeing of children"

If a patient who lacks capacity asks you not to disclose personal information about their condition or treatment, you should try to persuade them to allow an appropriate person to be involved in the consultation. If they refuse, and you are convinced that it is essential in their best interests, you may disclose relevant information to an appropriate person or authority. In such a case you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer. You should document in the patient’s record your discussions and the reasons for deciding to disclose the information.

Remember that disclosure of confidential information should be made in the best interests of the person lacking capacity. 

Confidentiality after death

Your duty of confidentiality continues after the patient has died. The GMC’s Confidentiality (2009) states that a doctor does have discretion to disclose pertinent information after death, however this should be read in conjunction with the relevant legislation (the Data Protection Act [1983] applies only to living subjects, hence, the relevant legislation is the Access To Health Records Act [1990]). If the patient had asked that specific information remain confidential, their views should be documented, and respected, subject to disclosures that are required by law or justified in the public interest. There may be circumstances when disclosure may be justified, for example, the Access to Health Records Act (1990) allows either the deceased patient’s personal representative (this would be either an executor of the will or the administrator of the estate) or anyone who may have a claim arising out of the death to make an application to access the part of the records that is relevant to their request.