When the police come knocking….

Medical practices and hospitals hold vast amounts of personal data. When the police are investigating crime they frequently seek access to medical records to obtain information that could assist their enquiries. Sometimes the reasons for such requests are not entirely clear, whereas on other occasions it is obvious – for example in child protection cases or murder investigations when a patient is either the victim or suspected perpetrator.

There is significant risk in disclosing information inappropriately but there is also a risk of being obstructive and increasing harm to others if certain disclosures are not made in response to an appropriate request from the police.

The police often attend with forms regarding personal data requests which include reference to the permissive clauses of the Data Protection Act (DPA). These allow disclosure to assist in the prevention and detection of crime or the apprehension or prosecution of offenders (section 29(3)). However this may not be sufficient to allow disclosure - depending on the individual details of a case.

Although appropriate paperwork may allow disclosure without adverse consequences under the DPA, a disclosure without patient consent may still amount to a breach of confidentiality in relation to General Medical Council (GMC) guidance, which should always be considered in these cases. The same applies when the police are seeking any patient information from a doctor involved in their care.

Consider the following case: The police arrive asking to speak to Dr Smith who saw a patient three weeks ago who has now been found dead in suspicious circumstances. As far as the police know the patient had been dead for a short time, she was married and her husband is helping with enquiries. Both the husband and wife are patients in the practice. They have two young children who are also registered. The police ask for details of the wife’s recent consultation and for copies of the records for all the family.

Starting from the premise that any disclosure without consent is a breach of confidentiality, in the first place it is sensible to ask if there is any consent from the husband regarding his notes and those of his children. In some instances consent has been provided so this should not be overlooked. If there is consent the disclosure can be made in line with that.

When there is no consent (and sometimes when there has been a refusal of consent) a decision has to be made whether disclosure can be justified in the public interest. That is, does the benefit of disclosure outweigh the general benefit to the public of maintaining confidentiality? Clearly, the answer will always depend on the circumstances of a particular case.

What features would favour disclosure? Certainly when there is a risk of serious harm to an individual or society. The GMC also state: “Such a situation [disclosure] might arise, for example, when a disclosure would be likely to assist in the prevention, detection or prosecution of serious crime, especially crimes against the person.”

In the above case where a suspicious death is under investigation these criteria may be met. However doctors should not be afraid to ask the police why they seek certain information to help assess the extent of any disclosure to be made. Where a wide range of information is requested - here copies of four patients’ notes - a decision has to be made for each individual. Can the disclosure be made in the public interest? What is the risk to the public good of non-disclosure when weighed against disclosure? Is there an ongoing risk of harm – especially to the children here? In the case in question, set against the background of a potentially very serious crime, the disclosure is likely to be considered justifiable.

The extent of any disclosure must also be considered: in some cases limited disclosure will be sufficient. This depends on the matter under investigation by the police and they should provide enough information to permit consideration of (a) whether or not to breach confidentiality, and (b) how much information needs to be disclosed. In circumstances where there is no patient consent the disclosure should be the minimum amount of information necessary.

As in any case of disclosure, care must be taken in relation to third party info and if any doubt about this seek advice from MDDUS

The GMC’s Confidentiality guidance from October 2009 states at paragraph 35:

If a patient refuses consent, or if it is not practicable to get their consent, information can still be disclosed if it is required by law or can be justified in the public interest.

In relation to public interest the GMC clarifies at paragraph 37:

"Personal information may, therefore, be disclosed in the public interest, without patients’ consent, and in exceptional cases where patients have withheld consent, if the benefits to an individual or to society of the disclosure outweigh both the public and the patient’s interest in keeping the information confidential."

 Also relevant to police enquiries the GMC guidance at paragraph 38 acknowledges that seeking consent might not be practicable because:

"(b) you have reason to believe that seeking consent would put you or others at risk of serious harm
"(c) seeking consent would be likely to undermine the purpose of the disclosure, for example, by prejudicing the prevention or detection of serious crime."

The GMC go on to say that you should document “your reasons for disclosing information without consent and any steps you have taken to seek the patient’s consent, to inform them about the disclosure, or your reasons for not doing so”.

And always remember that you can seek advice on any of the above matters from our advisory team at MDDUS.