It is reasonable to consider and trust that information taken from us about our medical health and history will be protected by rules on confidentiality and consent. Apart from very rare cases, perhaps of major public interest or for public health reasons, this information will not be shared with others without our consent. However, both a number of reforms in National Health Service patient data management policy (now enshrined in legislation) and developments in the general law on privacy challenge this traditional view of our control and choice over our medical information, as this article will show. In doing so, it analyses the question as to whether in spite of the rhetoric do any of us now really have choice over the access to and use of our medical data? In reality, our choices are limited and in any relationship of trust and shared decision making this ought to be transparent.
Department of Health. The NHS Constitution the NHS Belongs to us All, London: DH, 2013, pp. 8–8.
2.
Department of Health. Equity and Excellence: Liberating the NHS, London: Department of Health, 2010. Cm 7881.
3.
Ibid., p. 3.
4.
Health and Social Care Act, 2012, Ch. 7.
5.
Typical of many of the coalition Governments health reforms, it has taken time for a groundswell of opinion to form and raise concerns, in this instance about the unconsented sharing of patient information that could be considered confidential. A loose collaborative of the British Medical Association (BMA), the Royal College of General Practitioners (RCGPs), privacy campaigners such as medConfidential became vociferous in their critiques of the NHS England information policy. The latter organisation describing the history of same as ‘hellishly convoluted’. http://medconfidential.org/2014/section-251-to-be-amended/.
6.
TorjesonI. I have shamelessly used the word from the following. Furore over data could jeopardise research. BMJ2014; 348: g1761–g1761.
7.
See http://www.ic.nhs.uk/gpes and http://www.hscic.gov.uk/gpes. ‘GPES is a centrally managed primary care data extraction service that extracts information from GP IT systems for a range of purposes [my italics] at a national level’.
8.
See www.england.nhs.uk/caredata. The care.data dataset includes confidential medical information such as NHS numbers, dates of birth, postcodes along with prescription details and physiological indices. Data extracted along this pathway can be linked to personal confidential data from elsewhere such as hospital and social care environments.
These datasets are managed by the Health and Social Care Information Centre (HSCIC) whose establishment role and duties (and potential conflicts) are well described elsewhere. See Grace J and Taylor MJ. Disclosure of confidential patient information and the duty to consult: the role of the health and social care information centre. Med Law Rev 2013; 0: 1–33.
11.
Ungoed-Thomas J. NHS sells a billion patient records. The Sunday Times, 16 March 2014, p. 1–2.
12.
See Montgomery v Lanarkshire Health Board (Scotland) [2015] UKSC 11 [75–76]. [75] Their Lordships (Lord Kerr and Lord Reed) stated,
… patients … are widely treated as consumers exercising choice … . a wider range of health care professionals [other than doctors – my addition] now provide treatment … The treatment which they can offer is now understood to depend not only upon their clinical judgment but upon … such matters as resource allocation, cost-containment and … . administration: decisions that are taken by non-medical professionals.
13.
PollockARoderickPBoothP. Parliamentary Control over the Health and Social Care Information Centre. Proposed Amendment to the Care Bill and Briefing Note, London: Centre for Primary Care and Public Health, Queen Mary University of London and medConfidential, 2014, pp. 3–4.
14.
After the submission of this article for publication (Nov 2014) in February 2015, the Nuffield Council for Bioethics published a comprehensive detailed analysis of the ethical issues associated with data management in health care and biomedical research. This put forward a number of ‘recommendations and precepts’ on the topic. See Nuffield Council for Bioethics. The Collection, Linking and Use of Data in Biomedical Research and Health Care: Ethical Issues. London: Nuffield Council, 2015, p. 198.
15.
For some 20 years, there has been the clinical patient research data link (CPRD), until recently called the general practice research database. This encompasses in the order of 5 million longitudinal records at first obtained from general practice and now including hospital records. As well as being used for NHS purposes, the data once ‘anonymised’ (names, dates of birth and postcodes removed) has long been sold on to the pharmaceutical industry.
16.
n. 1 above.
17.
CaldicottF. Information: To Share or not to Share? The Information Governance Review, London: Department of Health [DoH], 2013, pp. 142–142.
18.
Secretary of State for Health. Information: To Share or not to Share? Government Response to the Caldicott Review, London: DoH, 2013, pp. 3–3.
19.
Ibid., p. 22.
20.
General Medical Council. Public and Professional Attitude to Privacy of Healthcare Data – A Survey of the Literature. Cambridge Health Informatics Ltd for the General Medical Council, 2007, p. 4, http://www.gmc-uk.org/GMC_Privacy_Attitudes_Final_Report_with_Addendum_pdf. 34090707_pdf. Having identified a number of definitions of confidentiality, privacy and security, Cambridge Health Informatics opted to treat confidentiality and privacy as synonymous, ‘since authors may not have made consistent distinctions between the terms’.
21.
McHaleJ. Medical Confidentiality and Legal Privilege, London: Routledge, 1993, pp. 56–56.
Without reference to legal interpretations at this point in the article.
26.
n. 15 above.
27.
General Medical Council (GMC). Confidentiality, London: GMC, 2009, pp. 6–6.
28.
The Hippocratic Oath, see Brazier M and Cave E. Medicine, Patients and the Law. 5th ed. London: Penguin Group, 2011, p. 83.
29.
Duke of Queensberry v Shebbeare, [1758] 2 Eden 329 and Morison v Moat [1851] 68 Eng Rep 492 (Ch).
30.
n. 20 above.
31.
Coco v A N Clark (Engineers) Ltd [1969] RPC 41, at 47.
32.
A-G v Guardian Newspapers Ltd (no 2) [1990] AC 109.
33.
X v Y [1988] 2 All ER 648.
34.
W v Egdell [1990] 1 All ER 835.
35.
Attorney-General v Guardian Newspapers Ltd (no 20 (‘Spycatcher’) [1990] 109, at 281.
36.
R v Department of Health, ex parte Source Informatics [1999] 52 BMLR 65, CA.
37.
Ibid.
38.
DoH. The Protection and Use of Patient Information, London: DoH, 1996.
39.
See n. 32 above. In A-G v Guardian Newspapers (no 2), Lord Keith stated,
… as a general rule, it is in the public interest that confidences should be respected, and the encouragement of such respect may in itself constitute a sufficient ground for recognising and enforcing the obligation of confidence even when he confider can point to no specific detriment to himself.
40.
See n 31 above. In Coco v AN Clark (Engineers) Ltd, Megarry J stated that ‘…three elements are normally required if, apart from contract, a case of breach of confidence is to succeed. First, the information itself, in the words of Lord Greene MR in the Saltman [Saltman Engineeering Co Ltd v Campbell Engineering Co Ltd (1948) [1963] 3 All ER 413 at 415], must “have the necessary quality of confidence about it.” Secondly, that information must have been imparted in circumstances importing an obligation of confidence. Thirdly, there must be an unauthorised use of that information to the detriment of the party communicating it.
41.
Kennedy I and Grubb A. Medical Law. London: Butterworths, 2002, p. 1069. In making their point, Kennedy and Grubb drew an analogy ‘with an action in libel or slander’. They equated disclosure with publication of information and as such the individual has to be identified or is identifiable to some others in the event of them having ‘particular knowledge’.
42.
Ibid., p. 1072.
43.
The author is grateful to the anonymous reviewer for suggesting this reflection on individual patient expectations in the differing scenarios.
44.
MiolaJ. Owning information – anonymity, confidentiality and human rights. Clin Ethics2008; 3: 116–120.
45.
Ibid., citing Herring J. Medical Law and Ethics. Oxford: Oxford University Press, 2006, p. 162 and referencing also Pattinson S. Medical Law and Ethics. London: Sweet and Maxwell, 2006.
46.
LaurieG. Genetic Privacy; a Challenge to Medico-Legal Norms, Cambridge: Cambridge University Press, 2002, pp. 303–303.
47.
Z v Finland (1997) EHRR 371. At para 93, the court stated that ‘the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8.’, and at para 95,
Respecting the confidentiality of health data is a vital principle … It is crucial not only to respect the sense [bold – my addition] of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general.
48.
MS v Sweden (1997) 24 EHRR 313.
49.
Campbell v MGN Ltd [2004] UKHL 22.
50.
Ibid., at [145].
51.
Ibid., at [133].
52.
Ibid., With Lord Nicholls [21] talking of non-disclosure as a function of the related individual’s ‘reasonable expectation of privacy’. Again, this appears to be a rather fluid concept.
53.
Douglas v Hello! Ltd (No 3) [2006] QB 125. Lord Phillips MR at [53] indicating that in order to achieve Article 8(1) rights, the Court had to ‘shoehorn’ into an action for breach of confidence a claim for misuse of private information. The ‘information’ concerned photographs of a social non-public occasion rather than medical matters.
54.
n. 27 above, pp. 10–11. General information is given to medical practitioners about disclosures required by statute such as those with ‘specific statutory requirements’, e.g., certain notifiable diseases, and to ‘various’ regulatory bodies including the GMC. In addition, there is guidance over ‘disclosures to courts or in connection with litigation’.
55.
Nathanson V. Amendments to the Coroners and Justice Bill. BMJ 2009; 338: b895. Clause 152 would have permitted ministers ‘to remove or modify any legal barrier to data sharing’. In the explanatory notes, it reads,
This could be by repealing or amending other primary legislation, changing any other rule of law (for example, the application of the common law of confidentiality to defined circumstances), or creating a new power to share information where that power is currently absent.
Data Protection Act 1998 giving effect to Council Directive 95/46/EC.
58.
BainbridgeDStatutory protection of medical records. In: TingleJ (ed). Patient Confidentiality, Welwyn Garden City: Emis Professional Publishing, 2002, pp. 19–44.
Article 2 provides that ‘Everyone’s right to life shall be protected by law …’.
67.
n. 65 above, para 116.
68.
See also Foster C. Simple rationality? The law of healthcare resource allocation in England. J Med Ethics 2007; 33: 404–407 and Hart D. The impact of human rights on medical law. Seminar delivered 21 October 2002.
69.
National Health Services Act 2006 c. 42 Patient information Section 251 Control of patient information.
Health Service (Control of Patient Information) Regulations 2002 (SI 2010/659).
74.
See, for example, http://www.england,nhs.uk/wp-content/uploads/2014/ig-bull-10.pdf NHS England Who Pays? Information Governance Advice for Invoice Validation. Advises that under Regulation 5 CCGs and Commissioning support units (CSUs) are allowed to process Confidential Personal Data (CPD) for the purposes of invoice validation.
medConfidential describes itself as ‘an independent, non-partisan organisation working with patients and medics, service users and care professionals, drawing advice from a network of experts in the fields of health informatics, computer security, law/ethics and privacy’, http://www.medconfidential.org/about/.
Pollock A and Roderick P. Trust in the time of markets: protecting patient information, www.thelancet.com 383 (accessed 3 May 2014).
79.
BartlettP. Doctors as fiduciaries: equitable regulation of the doctor-patient relationship. Med Law Rev1997; 5: 198–198.
80.
See Gillon R. Philosophical Medical Ethics. Chichester: Wiley & Sons, 2002 [1985], p. 189 and for a Virtue Ethics approach to general practice, Oakley J and Cocking D. Virtue Ethics and Professional Roles. Cambridge: Cambridge University Press, 2001, pp. 95–115.
81.
Royal College of General Practitioners Curriculum 2010 revised August 2013 Statement 2.01 The GP Consultation in Practice.
82.
n. 79 above, pp.193–224.
83.
BrazierMLobjoitMFiduciary relationship: an ethical approach and a legal concept? In: ErinCBennettR (eds). HIV and AIDs Testing, Screening and Confidentiality, Oxford: Oxford University Press, 1999, pp. 179–199.
84.
For a concise analysis of the ever present debates about the fiduciary nature or otherwise of the doctor–patient relationship, see Tamin J. Models of occupational medicine practice: an approach to understanding moral conflict in ‘dual obligation’ doctors’. Med, Health Care Philos 2013; 16: 500–501.
85.
This, from as far back as 2007: ‘ … the medical profession, in its retreat from out of hour’s responsibility and personal continuity of care … ’ Jones R. The future of the medical profession. BMJ 2007; 335: 53. doi:10.1136/bmj.39266.662928.BE (accessed 16 September 2007).
86.
GillamSSteelN. QOF points: valuable to whom?BMJ2013; 346: 21–23.
87.
British Medical Association, Health Policy and Economic Research Unit. BMA Quarterly Tracker Survey. An Extract of Responses from GPs, London: BMA, 2014, pp. 18–18.
88.
Harris S. ‘Data confusion’, personal correspondence. BMA News, 9 November 2013.
89.
PatelK. Whose data are they anyway?BMJ2012; 344: e2135–e2135.
90.
n. 34 above, Rose J., at 653 ‘In the long run, preservation of confidentiality is the only way of securing public health; … individual patients will not come forward if doctors are going squeal on them’.
Todd R. ‘Grave concerns’ over new GP dataset, http://www.ehi.co.uk/news/primary-care/8313/’grave-concerns’-over… (accessed 18 June 2014). See also Willis J. Thank you, no. Br J Gen Pract 2006; 640 and Keighley B. The way I see it … Confidentiality-the final betrayal. BMJ 2005; 259.
93.
Abortion Act 1967 Clause 4 (1) … no person shall be under any duty, whether by contract, or by statutory or other legal requirement, to participate in any treatment … to which he has a conscientious objection: […] As applied by the Courts currently the new data handling requirements are hardly likely to constitute treatment participation, See Regina v. Salford Area Health Authority (respondent) ex parte Janaway [1988] 2WLR 442; HA [1988] 3 All ER 1079 249. A moot point perhaps?.
See The Mid-Staffordshire NHS Foundation Trust Public Inquiry. Report of Mid-Staffordshire NHS Foundation Trust Public Inquiry Executive Summary, London: The Stationery Office, 2013. HC 947, p. 125.
96.
See The Stationery Office. The Report of the Public Inquiry into children’s heart surgery at the Bristol Royal Infirmary 1984–1995: Learning from Bristol (Cm 5207). London: The Stationery Office, 2001 and Royal Liverpool Children’s Inquiry. Report/The Royal Liverpool Children’s Inquiry. London: The Stationery Office, 2001, p. 540.
97.
Smyth C. Doctors “could sink as low as bankers”. The Times, 3 September 2013, quoting Professor Ben Bridgewater, Consultant cardio-thoracic surgeon.
98.
O’Neill O. Autonomy and Trust in Bioethics. Cambridge, Cambridge University Press, 2002, p. 110.
99.
Chester v Afshar [2004] UKHL41; [2004] 3 WLR 927, HL [2002] EWCA Civ 724; [2003] QB 978, CA. at 86.
100.
McCartneyM. Care.data doesn’t care enough about consent. BMJ2014; 348: g2831–g2831.
101.
See Cronin AJ. Dr Finlay’s Casebook (1962–71), http://www.screenonline.org.uk/tv/id/481822 and Berger J and Mohr J. A Fortunate Man. London: Writers & Readers Publishing Cooperative, 1976.
WhitemanI. The Fallacy of Choice in the Common Law and NHS Policy. Health Care Anal2013; 21: 146–170.
104.
n. 99 above, Section 5, para 5.5, pp. 57–58.
105.
DixonWGSpencerKWilliamsH. Dynamic model of patient consent. BMJ2014; 348: g1294–g1294.
106.
n. 100 above.
107.
Macfarlane A and Pollock A. Why the public should opt to care.data and out of data privatisation’, 31 January, 2014, http://www.allysonpollock.com/?tag=care-data (accessed 28 May 2014).
