Fin Wright, case manager at Medical Protection, provides guidance to practices who are approached by the police regarding a disclosure of medical records

According to the GMC Confidentiality guidance, there are five criteria under which you can disclose personal information:

“Confidentiality is an important ethical and legal duty but it is not absolute. You may disclose personal information without breaching duties of confidentiality when any of the following circumstances applies.

• The patient consents, whether implicitly or explicitly for the sake of their own care or for local clinical audit, or explicitly for other purposes.
• The patient has given their explicit consent to disclosure for other purposes.
• The disclosure is of overall benefit to a patient who lacks the capacity to consent.
• The disclosure is required by law, or the disclosure is permitted or has been approved under a statutory process that sets aside the common law duty of confidentiality.
• The disclosure can be justified in the public interest.”

As per the second point above, you should seek consent from the patient to disclose information before you do so.

If you are unable to contact the patient in order to gain consent, or the patient refuses, it is important to consider if disclosure is required by law or if it is in the public interest.

The GMC’s guidance states: “If you believe that disclosure is necessary in the public interest, and that the benefits from disclosure outweigh the risks from doing so, it may be justified to disclose the information, even without the patient’s consent.

“Such circumstances usually arise where there is a risk of death or serious harm to the patient or others. If possible, you should seek the patient’s consent and/or inform them of the disclosure before doing so. Examples of such a situation would include one in which disclosure of information may help in the prevention, detection or prosecution of a serious crime. A competent adult’s wishes should generally be respected if they refuse to allow disclosure and no-one else will suffer.”

If you do decide to proceed and release the information to the police without consent then it is important to disclose only the information that is relevant for the purpose of the request. The GMC’s Confidentiality guidance and the Data Protection Act state that only the minimum amount of information necessary to the request should be disclosed. Any third party information and any information that could cause serious harm should be redacted prior to disclosure.

Whether you decide to disclose or not disclose the records to the police, you should document your reasoning within the patient’s medical records. This will demonstrate that you have carefully considered this request, reviewed the relevant guidance and have come to an informed decision regarding the matter. There is less scope for criticism if you have considered the guidance in this area and documented your decision and reasoning for the disclosure or non-disclosure.

If you need assistance with this situation or anything similar, please call the Medical Protection advice line on 0800 561 9090.