Search

In this article, we analyse the legal components of disclosing confidential patient information under the UK’s common law duty of confidentiality (CLDoC) and processing personal (health) data under the UK’s General Data Protection Regulation (GDPR) and Data Protection Act 2018. We describe the ostensible divide between the CLDoC and data protection law when it comes to the requirements of a valid signal of consent by a patient to use and disclose patient information, obtained by a health professional in the context of direct care, for health care and health research purposes. Ultimately, our analysis suggests that we are saddled, at least in the medium term, with two regimes operating with different standards of a valid consent—while putatively protecting similar interests. There is, however, opportunity for progress. It is possible to improve professional guidance on the interaction between the regimes and to achieve significant normative alignment without aligning the signalling standard for consent; this would promote consistent protection of reasonable expectations of patients across both regimes. Further coherence would require aligning not only the standard, but also the role played by consent under each regime. Here we argue that, in relation to direct care, any such shift should be away from consent as the normal justification. In relation to health research, on the contrary, it should be toward consent as the normal justification for use and disclosure of patient information under both the CLDoC and data protection law.

The National Health Service in England and Wales is dependent upon the flow of confidential patient data. In the context of consent to the use of patient health data, insistence on the requirements of an ‘informed’ consent that are difficult to achieve will drive reliance on alternatives to consent. Here we argue that one can obtain a valid consent to the disclosure of confidential patient data, such that this disclosure would not amount to a breach of the common law duty of confidentiality, having provided less information than would typically be associated with an ‘informed consent’. This position protects consent as a practicable legal basis for disclosure from debilitating uncertainty or impracticability and, perhaps counter-intuitively, promotes patient autonomy., The National Health Service in England and Wales is dependent upon the flow of confidential patient data. In the context of consent to the use of patient health data, insistence on the requirements of an 'informed' consent that are difficult to achieve will drive reliance on alternatives to consent. Here we argue that one can obtain a valid consent to the disclosure of confidential patient data, such that this disclosure would not amount to a breach of the common law duty of confidentiality, having provided less information than would typically be associated with an 'informed consent'. This position protects consent as a practicable legal basis for disclosure from debilitating uncertainty or impracticability and, perhaps counter-intuitively, promotes patient autonomy.

The disclosure of confidential patient data without an individual's explicit consent should be for purposes that persons have reason to both expect and accept. We do not currently have the required level of clarity or consistency in understanding regarding the disclosure of confidential patient information for public health purposes to support effective public dialogue. The Health Service (Control of Patient Information) Regulations 2002 establish a legal basis in England and Wales for data to be disclosed for public health purposes without patient consent. Under the Regulations, there is more than one potential route towards lawful processing: Data may be processed for public health purposes under both Regulations 3 and 5. The alternatives have different safeguards and conditions attached, and their respective applicability to processing for purposes of public health improvement is currently unclear and subject to review. Beyond the need for clarity regarding the safeguards applicable to processing for particular public health purposes, there are reasons to prefer recognition that Regulation 5 is the most appropriate legal basis for disclosure when the purpose is public health improvement rather than public health protection. Where health improvement, rather than protection, is the aim, there is no justification for discarding the additional safeguards associated with processing under Regulation 5.

Before disclosing confidential patient information for purposes not directly related to his or her care and treatment, there is currently a responsibility upon health professionals to consult with a patient wherever practicable. The Health and Social Care Act 2012 has diluted that responsibility to consult, at least in relation to any information that the Health and Social Care Information Centre requires health professionals to disclose. This is at odds with other moves to support an individual's involvement in decisions that affect them. Moreover, a responsibility to consult can be shown to be a procedural aspect of the fundamental right to respect for private and family life as guaranteed by Article 8 of the European Convention on Human Rights (ECHR). The scope and nature of a procedural requirement for consultation can be revealed, at least in part, by considering the case law concerning disclosure in the field of criminality information sharing. If the Health and Social Care Act 2012 is to be adequately protected from a challenge for incompatibility with the ECHR, then practicable opportunities to provide information about the intended purposes of processing, and respect for any reasonable objection to disclosure, must be recognised beyond those explicitly provided for by the 2012 Act. The Code of Practice that the Information Centre is responsible for producing represents an opportunity to guarantee adequate levels of consultation will be preserved, consistent with proposed changes to the NHS Constitution.