Introduction:

Perhaps the most fundamental of the principles of medical ethics is that all which passes between patient and doctor in the course of a professional relationship is secret [1]. This principle can sometimes bring the doctor into conflict with others, notably the police and lawyers.

In some countries the law positively obliges the medical practitioner to maintain confidentiality, with criminal sanctions for a breach. In English law there is no general statutory duty of confidentiality, although some people argue that there should be, and that there should be some uniformity in the law within the member states of the European Community. Most lawyers agree that, in English law, confidentiality is an implied term of the contract between a doctor and his patient and that unauthorised disclosure of professional secrets would be a breach of the contract, giving grounds for civil proceedings. Although English courts have, in recent years, considered cases involving issues of confidentiality as between doctors and patients and others, confidentiality remains essentially an ethical as much as a legal principle in the UK. Issues of confidentiality may be complex with scope for differences of opinion arising from conflicts of competing interests.

At the heart of the relationship of trust between a medical practitioner and their patient, is the obligation on the part of the practitioner to keep confidential what they learn in the course of providing professional services and to refrain from generating collateral benefit from what they have learned [2]. The long-standing obligation of doctor-patient confidentiality has been significantly modified to allow, and on some occasions to mandate, practitioners to provide information to facilitate patients,’ third parties,’ and the general community’s health and safety.

Modern medical practice is founded on the concept of respecting patient autonomy, which in part includes respecting the right of an individual to determine what personal information may or may not be divulged to a third party [3]. Unwarranted disclosure of a patient’s medical treatment, advice or medical records is regarded as breach of their personal integrity. In essence, confidentiality protects the patient’s informational autonomy.

The concepts of confidentiality and privacy are inter-related, but they are not identical. Privacy is generally viewed as an individual right, whereas confidentiality is considered an interest but not necessarily an individual right.

The major ethical theories accommodate the notion of confidentiality. Deontology envisages confidentiality as a moral duty, but accepts that breaching confidentiality may be ethically acceptable if there is a more pressing duty to disclose information. Utilitarianism supports confidentiality if it promotes the best consequences, but obviously allows for breaches of confidentiality if the greater good is best served by disclosure. The maintenance of confidentiality may also be seen as a virtue in its own right.

Patients:

Consent must be obtained before disclosing information to another party, unless there are exceptional circumstances [4]. It is good practice to document this consent. Depending on the nature of the information being shared, this can be done formally with the patient’s written consent or as a written record that verbal consent has been given. To give his or her consent, the patient should understand the nature and effects of the disclosure and have the capacity to make the decision.

It is essential that information is passed between health professionals to provide good healthcare. Clearly it is not always necessary to obtain explicit consent for this, provided that the patient has agreed to investigation or treatment. For instance, if a patient agrees to a specialist referral from his or her general practitioner (GP), then it is implied that the patient is happy for the GP to pass on details to the specialist. Patients expect health professionals to communicate effectively, and poor communication is a common source of frustration and complaints. However, difficulties can arise when patients and their doctors differ in their understanding of what information needs to be communicated and to whom. Only information that is relevant and required for optimum care should be disclosed, and it is the doctor’s duty to ensure that the patient understands what information will be given. A doctor should also make sure that anyone receiving such information recognises that it is given in confidence.

If information is to be shared with others who are not involved in the healthcare of a patient, such as an employer, insurance company or benefi ts agency, then the patient’s express consent must be obtained. It is the doctor’s responsibility to ensure that the patient understands what information is shared and any adverse effects that this may have. Consent should be in writing prior to sharing information and only factual, relevant information should be imparted. A copy of the report should be given to the patient before disclosing it to others, unless this would cause serious harm to an individual or breach another person’s confidentiality. If a patient withholds consent then information can only be given if there is a legal requirement to do so or if it is in the public’s interest.

Consent:

There is more to consent than getting a patient's signature on a consent form [1]. In seeking consent the doctor is required to provide sufficient details and information about what is proposed to enable the patient to form a proper decision. Misinformed consent or consent given without proper understanding of what is involved is of little legal value: whilst it might protect against allegations of assault or battery, it would not afford a defence against allegations of inadequate counselling or failure to warn.

The extent of the explanation which the doctor should give when seeking consent will depend on many factors and may pose considerable problems, calling for fine clinical judgement. Factors to be taken into account include the patient's age and maturity, physical and mental state, intellectual capacity, and the reason for the procedure, operation or treatment. For example, a routine cosmetic procedure may need to be discussed far more extensively than an emergency operation for a life-threatening condition in an ill patient. The explanation which the doctor gives will also depend upon the questions the patient asks, some patients requiring to know far more than others about sideeffects, complications, etc. A careful and truthful answer must be given to a particular patient's request for information.

The most obvious exception to a doctor’s duty of confidentiality is when confidential information is disclosed to others with the patient’s consent [5]. This exception is distinct from the others in that there is no question of balancing an individual right against a societal interest. Disclosure of confidential information with the confider’s consent will not amount to a breach of confidence as there is no unauthorised disclosure. There are two particular issues which cloud the image of genuine consent to disclosure. First, medical records are routinely shared amongst a healthcare team. Confidential information is likely to be available not just to doctors but also to nurses, administrators, social workers and many others. Recent developments in information technology mean that even more people will now be privy to confidential patient information. Even without such an unauthorised disclosure, it is unlikely that genuine consent was obtained for the accessibility of confidential information to such a large number of people. There is a danger that an assumption of implied consent to circulation of information within a healthcare team may be inaccurate. It is vital, therefore, that the GMC’s (General Medical Council) sensible advice on this issue is followed. The GMC guidance requires that patients be made aware that personal information about them will be shared within the healthcare team unless they object and that any such objection will be respected. Controversy surrounds recent government plans to create a centralised medical records system for the NHS which would allow health professionals anywhere in the country to access confidential medical data. An opt-out is available but only in relation to the ‘Summary Care Record’ (which will include all major illnesses, allergies and prescriptions for access in an emergency) and not in relation to the detailed medical records also to be stored on the system. In the absence of an opt-out, consent for the storage of personal data will merely be presumed. The details of the scheme are still being worked out (and campaigns to counter the threat to medical confidentiality are gaining support) but there is no doubt that the development of a centralised, computerised medical records system poses a huge threat to the privacy rights of all NHS patients.

The second, related, issue is whether a patient knows what personal information is recorded about him or her and thus might be shared with others. It is possible that consent to disclosure may be based on a misconception of what information is held. Therefore, the patient’s right to know is inextricably linked with a right to confidentiality. 

Fidelity:

Fidelity is aspect of respecting persons. When commitments are made to others, other things being equal, most people recognize that there is a moral obligation to keep those commitments [6]. To fail to do so would be a sign of lack of respect. Commitments can take many forms, one of which is making a promise. Insofar as the promise is made, there is an ethical obligation to keep it, according to people who include a principle of fidelity in their ethics.

This does not necessarily mean that the duty of fidelity is rigid and without exception. In some cases, such as when remaining faithful to one’s commitments would result in serious harm being done to another, the requirements of doing good and avoiding harm may conflict with those of fidelity. If keeping a promise means that serious harm will be done, then the principle of beneficence would pull in the direction of breaking the promise, whereas the principle of fidelity would pull in the direction of keeping it. Here, these partial or prima facie duties pull in opposite directions. Whether the commitment is kept or broken will depend on how one relates the demands of the two principles. If, for example, one uses only calculations of benefit and harm as the criteria for resolving such conflicts of principle, then promises would never be kept when breaking them does more good than harm. Other philosophers, however, give priority to the principle of fidelity, leading to the conclusion that the promise should be kept even if breaking it would do more good. Still others argue that neither principle can take absolute priority, giving rise to an approach in which one “balances” the competing claims and is guided by how weighty the demands of each principle are in a particular case.

Commitment:

One aspect of fidelity is the keeping of confidences, that is the commitment not to disclose information learned in the course of the clinical relation [6]. This is one of the classical requirements of professional healthcare ethics. In virtually all of the codes of ethics for the healthcare professions, some form of confidentiality requirement is included. The content of those codes is more variable and controversial than might be expected, however. Hippocratic Oath is very ambiguous. It calls for confidentiality only in reference to those things “which ought not be spoken abroad.”

The code of the World Medical Association and the Florence Nightingale Pledge seem to require keeping all confidences without exception. The 2002 Code of Professional Conduct of the United Kingdom Nursing and Midwifery Council, however, allows the nurse to share confidential patient information with the patient’s consent. The International Council of Nurses’ (ICN) Code of Ethics for Nurses, while stating that “the nurse holds in confidence personal information,” acknowledges that the nurse may also use his or her judgment “in sharing this (personal) information.”

Grounding confidentiality in a principle of privacy may lead to a strong confidentiality requirement—perhaps too strong. It would seem not to allow for breaking confidence under any circumstances, either to protect the client (e.g., initiating commitment hearings for a suicidal patient) or others (e.g., reporting child abuse).

Another possibility is that confidentiality should be grounded in the ethics of promise keeping. Fidelity is a principle in many ethical systems. It, like autonomy and truth telling, may be a right-making characteristic of ethical action, binding on a person independent of the consequences. If that is the basis, then the critical question is: What should healthcare professionals and clients promise one another regarding confidentiality? Should they promise confidentiality of the patient’s health record information? Should they promise that they will not discuss the patient in a public place without his or her permission? Many would agree that the obligation of confidentiality includes these latter promises. They are supported by the ANA (American Nurses Association) Code of Ethics for Nurses and expected by the public, although, as research has shown, such promises are often broken.

The duty to keep secrets is enshrined in all codes of medical ethics [7]. All health professionals know that it is one of the strictest ethical rules of their various professions that they should not give confidential information about a patient to third parties other than in exceptional cases. If this obligation is breached, health professionals may find themselves before the professional conduct committee of their professional body (the General Medical Council (GMC) for doctors, the Nursing and Midwifery Council (NMC) for nurses, midwives and health visitors or the Health and Care Professions Council (HCPC) for allied health professionals) and may even run the risk of being struck off the register, depending on the seriousness of the offence. The law leaves the matter of professional ethics to the professions themselves, so it is from them that guidance must be obtained on what constitutes good professional practice.

There is a legal as well as an ethical duty of confidence. Lawyers sometimes find it difficult to define the legal category into which the duty of confidence falls. For our purposes it is sufficient to state that the duty arises where there is a contract between the confider and the confidant which includes a term (which may be express or implied) that confidence will be kept, or there is a relationship between the parties which implies a duty of confidence.

Mental Health:

Keeping the communications between a client and a therapist confidential is of paramount importance [8]. Ethically, legally, and therapeutically the psychotherapist– client privilege is an integral part of the ability to provide mental health treatment.

Confidentiality laws vary from state to state, and mental health confidentiality is often treated differently from other health care confidentiality. Federal law (i.e., HIPAA) also assures that recipients’ mental records are kept confidential. Practicing clinicians would do well to obtain a copy of their state’s mental health confidentiality act and familiarize themselves with the state’s laws. Clinicians practicing in more than one state should review the laws of each state they practice in and conform with the laws of the state in which service was delivered to a particular client. Although there are subtle differences in the laws from state to state, the one basic premise presents in all confidentiality acts is that the client’s record is confidential and not to be shared with anyone unless the client him- or herself gives permission in advance. There are state-to-state nuances, for example, in what information is to be contained in the written release form, the language of the release form, or how the mental health record of a child is to be handled with regard to parental access. But the overarching principle is that the client has a right to have his or her mental health information remain private, and this includes whether he even received mental health treatment in the first place.

Any breach of this right to privacy without the client’s consent or without the presence of a legal exception to the right to privacy can form the basis of a successful lawsuit and ethical complaint. We would argue that in any case where the therapist is seeking to breach the client’s right to confidentiality due to a legal exception, such as a belief that they have a duty to warn someone about a client’s desire to hurt himself or someone else, that a consultation with a competent mental health attorney or a colleague who is intimately familiar with the laws of the state is in order before the confidentiality is breached. Once the genie is out of the bottle, it is impossible to put it back in. Thus, a few minutes’ time to seek a consultation before breaching the confidentiality of the client is always a prudent course of action.

Clinicians should also be aware of the possibility of unintentional breaches of confidentiality through notes thrown out in the office trash, loss or theft of computer equipment, interception of unencrypted electronic media, or sloppy office policies such as having a sign-in sheet on the front desk or people’s first and last names in the office appointment book that is on the front counter in plain view of the clients. Even someone’s finding out that Client X is seeing you constitutes a violation of her confidentiality, so it is incumbent upon all clinicians to review their office policies to be certain that confidentiality is not purposefully or unwittingly being breached.

Exceptions:

The duty of confidence is not absolute [9]. A number of exceptions have already been noted:

1. Consent: Since the duty is for the benefit of the patient, the patient may waive the duty (ie. consent to disclosure of information). Consent may be express or implied. So, for example, a patient who is offered a referral to see a specialist, impliedly agrees to the general practitioner releasing medical information about the patient to the specialist.
2. Public interest: There will be instances where the disclosure of confidential information could save lives. So, for example, a psychiatrist who is told of violent fantasies a patient has may by informing the subject of the violent fantasy, or the police, enable the subject to seek safety.

The duty of confidence is often described as protecting a private interest – that of the patient. However, it also protects a public interest – public health is promoted indirectly because more people are encouraged to seek treatment when they know information imparted to a doctor is kept confidential. Viewed as a conflict of one public interest (confidentiality) against another (public safety), it is then easier for a court to determine whether one should take precedence over another.

Jurisdiction:

Some jurisdictions permit a judge’s discretion to overrule privilege between clinician and client on determination that the interests of justice outweigh the interests of confidentiality [10]. Some jurisdictions limit privilege exclusively to civil actions, whereas others may include criminal proceedings, except in homicide cases. In many circumstances, designated practitioners have a legally mandated obligation to breach confidentiality and report certain information to authorities. Just as some physicians must under some state laws report gunshot wounds or certain infectious diseases, mental health practitioners may have an obligation to report certain cases, such as those involving child abuse, to state authorities. These restrictions could certainly affect a therapeutic relationship adversely, but the client has a right to know any limitations in advance, and the clinician has the responsibility both to know the relevant facts and to inform the client as indicated.

Other circumstances, such as a suit alleging malpractice, may constitute a waiver of privilege and confidentiality. In some circumstances, a client may waive some confidentiality or privilege rights without fully realizing the extent of potential risk. In certain dramatic circumstances, a therapist may also face the dilemma of violating a confidence to prevent some imminent harm or danger from occurring. These matters are not without controversy, but it is important for mental health professionals to be aware of the issues and think prospectively about how one ought to handle such problems.

When law and ethical standards diverge (e.g., when a confidential communication does not qualify as privileged in the eyes of the law), the situation becomes extremely complex, but one cannot ethically fault a therapist for divulging confidential material if ordered to do so by a court of competent authority. On the other hand, one might reasonably question the appropriateness of violating the law if one believes that doing so has become necessary to behave ethically. Consider, for example, the clinician required by state law or court order to disclose some information learned about a client during the course of a professional relationship. If the therapist claims that the law and ethical principles conflict, then by definition the ethical principles in question would seem illegal. The therapist may choose civil disobedience as one course of action, but does so at personal peril in terms of the legal consequences. Ethics codes advise psychologists to attempt to resolve such conflicts but also provide that when such conflicts seem irresolvable, psychologists may ethically adhere to the requirements of the law, regulations, or other governing legal authority

Scientific Research:

There are good reasons in moral theory to seek informed consent from research subjects [11]. What does informed consent mean in practice? What information is required? How should it be presented? Debate surrounds what is actually required of researchers and subjects. According to federal standards at the present time, informed consent should include the purpose of the research; its possible risks and possible benefits for the subject, if any; alternatives to participating; the degree of confidentiality that can be expected; what compensation might be provided, including the cost of medical injuries; and the names of persons to contact in case of questions.

These requirements deserve elucidation. Scientists often have a highly technical vocabulary in which they express the nature and purpose of the study. Scientific language is precise, but it may act as a barrier to understanding on the part of subjects. By the same token, researchers run the risk of oversimplifying if they try to explain a study in nontechnical language. It is also sometimes unclear how precise to be with respect to possible risks. Should researchers mention every possible risk of a drug? If so, will potential subjects simply stop listening as the recitation goes on and make their decisions without fully appreciating the nature and extent of risks?

The way in which information is presented, or the framing effect, can be influential in determining how a person interprets information and agrees to participate in research. If the project is presented in glowing language with a great deal of emphasis on its potential benefits, the subject may agree without full consideration of the risks. Other impediments to comprehension exist: researchers rushing potential subjects to a decision, speaking in language that is difficult for the subjects to understand, and so on. These obstacles to comprehension should be taken into consideration by researchers, who should make information comprehensible to subjects.

Whilst few would challenge the idea that adult patients have a legitimate expectation that the information they give nurses will be kept secret, this ‘culture of confidentiality’ is not always extended to children and young people [12]. Certainly, research has shown that young people, especially adolescents, are significantly worried about the confidentiality of their health information. Research has also highlighted how confidentiality for younger children has almost always focused on parents’ perceptions with little attention being given to the child’s point of view. A further complicating factor is that many different agencies may be involved in a child’s care – making uniform standards of confidentiality difficult to maintain.

Conclusion:

The doctor is obliged to provide the patient with all the necessary information about his/her health condition and is obliged to keep this information and make it inaccessible to third parties. In other words, it can be said that all data from the patient's medical records are protected by medical secrecy. In addition to information about the patient's health condition, the term medical secrecy may include various other information that the doctor learns about during treatment. These can be data that can be found out when going on a home visit to the patient, or the conditions in which he/she lives.