Patient confidentiality

Legislation

Personal data which relates to living individuals must be processed in accordance with the Data Protection Act 2018 (DPA), which is the UK’s implementation of the General Data Protection Regulation (GPDR). Personal data relating to deceased patients must be handled in accordance with the Access to Health Records Act 1990.

Disclosure

There are certain situations where practitioners may need to disclose patient information. The most common scenario is when patients or their representatives make a ‘subject access request’ to obtain a copy of their clinical notes under their ‘Right of Access,’ but sometimes disclosure may be required by law, or because the patient is at risk of serious harm. For children, if you think they have capacity and may object to the disclosure of their information, you should seek their permission first, and this should be documented on their file.

From time to time, you may be contacted by another practice for information about a patient you have previously seen. In such circumstances, it is important to contact the patient and ask their permission to disclose their personal data. You should take steps to satisfy yourself that you are speaking to the correct patient, for example, by asking them to confirm their date of birth and the first line of their address.

We do not recommend providing prescriptions over the phone, as there is a high risk of errors arising, even when speaking to a registrant. Instead, ask for the patient’s permission to send the information by fax, email or post. It is also important to note that patient information remains confidential after their death, with exceptions, for example where it is required by a court of law.

Occasionally, a patient may ask you not to share their information, even when you believe it is in their best interests to do so. For example, some patients may not want to be referred, even though referral is clinically indicated. If you believe the patient has capacity to make decisions about their healthcare it is important to respect their wishes, but to help the patient reach an informed decision you should also explain:

• Why you want to share their information (for example, so they can access appropriate healthcare)
• What the possible consequences might be if they do not follow your advice (for example, a health condition remains undiagnosed, leading to permanent loss of vision)
• What they need to do if they change their mind (for example, contact the practice again, or take a referral letter to their GP).

In some situations, it may be helpful to follow up verbal advice with written information, so the patient has an opportunity to reach an informed decision in their own time.

Occasionally, you may be required by law to share a patient’s personal data, for example, if there is a court order requiring you to do so. Another situation whereby you may need to disclose information without patient consent, is when it is in the wider public interest. This situation sometimes arises when a patient is unable to meet vision standards for driving, but is unwilling or unable to notify the DVLA/DVA. If you think you may need to disclose information without patient consent, we recommend contacting the AOP’s regulation team for advice on a case-by-case basis on [email protected]

Aishah’s three tips on confidentiality

1. Ensure that staff are trained and aware of the importance of patient confidentiality
2. In some situations, it may be helpful to follow up verbal advice with written information, so the patient has an opportunity to reach an informed decision in their own time
3. If you think you may need to disclose information without patient consent, we recommend contacting the AOP’s regulation team.

About the author

Aishah Fazlanie an optometrist and clinical adviser on the regulatory team at the AOP.