Framework for Safeguarding Confidentiality in Children

"When dealing with adults who lack capacity and children, a medical professional often has to make a difficult choice between safeguarding confidentiality and making disclosures to protect the particular patient's welfare".

CRITICALLY DISCUSS the extent to which the legal framework has so far succeeded when addressing the balancing exercise referred to above and whether confidentiality for these groups of patients is sufficiently safeguarded.

1. Introduction:

In this paper, through reference to the jurisprudence of the courts of England and Wales, the author will critically discuss the extent to which the law has managed to strike an appropriate balance between protecting the rights of children and adult patients who lack capacity, on the one hand; and, allowing medical professionals to make disclosures when such disclosures are deemed to be in the best interests of their patients, on the other.

The structure of this paper will be as follows: First, the author will examine the legal basis for any rights to confidentiality and non-disclosure that are conferred on children and adult patients who lack capacity, by the law of England and Wales. Second, the author will identify the legal provisions and/or common law decisions which purport to allow medical professionals to act in contravention of these rights, when to do so is deemed in the best interests of their patients. Third, the author will perform a review of the jurisprudence of the courts of England and Wales to determine the legal scope of these justified derogations. Fourth, the author will perform a literature review to indentify the extent to which medical professionals, in practice, manage to apply their discretion appropriately. Finally, the author will review the various mechanisms in place, if any, to review the conduct of medical professionals and hold accountable any medical professionals who fail to adhere to the limits of the discretion conferred upon them by the law of England and Wales.

2. What is/are the legal basis/bases for the right to confidentiality enjoyed by children and adult patients who lack capacity?

2.1 Children patients who lack capacity and their ‘right(s)’ to confidentiality:

Before the rights of this select group of patients to confidentiality are examined, it is first important to define what is meant by ‘children patients who lack capacity’. In this context, we are referring to the ‘capacity’ to provide legally valid consent to their doctors or other medical professionals to disclose their confidential medical information to third parties.

Get Help With Your Essay

If you need assistance with writing your essay, our professional essay writing service is here to help!
Find out more about our Essay Writing Service

Under statute, a child patient will be presumed to possess sufficient capacity to consent in the regard the moment that they have attained the age of 16 years. This is provided by section 8 of the Family Law Reform Act 1969, subsection (1) of which provides: “The consent of a minor who has attained the age of sixteen years to any surgical, medical or dental treatment which, in the absence of consent, would constitute a trespass to his person, shall be as effective as it would be if he were of full age; and where a minor has by virtue of this section given an effective consent to any treatment it shall not be necessary to obtain any consent for it from his parent or guardian.”

Of course, this is merely a presumption. A particular child patient may have characteristics which invalidate this consent, even though they are over the age of 16. For example, if they qualify as a person who lacks consent under section 2 of the Mental Capacity Act 2005, which provides that: “[A] person lacks capacity in relation to a matter if at the material time he is unable to make a decision for himself in relation to the matter because of an impairment of, or a disturbance in the functioning of, the mind or brain.” It matters not whether this ‘impairment’ or ‘disturbance’ is temporary or permanent^[1], but assessments must be made on the basis of the actual decision-making capacity of the individual^[2], rather than through reference merely to the type of condition or impairment which that child is suffering from^[3]. Such assessments are to be made on the balance of probabilities^[4], i.e. a child patient who is between 16 and 18 years old will be deemed to lack the necessary capacity to consent if it is more likely than not that he or she is unable to fully appreciate the implications of the decision which needs to be made.

A child over the age of 16 may also be deemed to lack capacity to consent when they are physically unable to provide consent; for example, if they are unconscious^[5].

Similarly, the presumption that a child under the age of 16 lacks the necessary capacity to consent can be rebutted if, upon an assessment of the decision-making ability of that patient, it is deemed that he or she “...[has] achieve[d] a sufficient understanding and intelligence to enable him or her to understand fully what is proposed.^[6]” A minor who possesses this required threshold of understanding and intelligence will be said to be ‘Gillick competent’. However, it is highly unlikely that a child under the age of 13 will ever be deemed so competent^[7].

In conclusion, in this paper, when referring to child patients who lack capacity, we are referring (1) to minors who are under the age of 16 but who are not deemed to be Gillick competent; and, (2) to children who are 16 or 17 years of age, but who lack the necessary capacity to provide informed consent, perhaps because they are deemed to fail the test provided by section 3(1) of the Mental Capacity Act 2005; or, perhaps because they are unconscious, and are therefore physically unable to provide any consent whatsoever.

Having established the categories of patient to which we are referring, now let us examine the legal bases for their ‘right’ to confidentiality:

One such legal basis is provided by the Data Protection Act 1998, which was enacted to give effect to European Council Directive 95/46/EC. This Act creates a legal presumption that personal data may not be processed unless it is lawful to do so^[8], it is processed fairly^[9] and certain conditions are satisfied.

In regard to the conditions which must be satisfied: Schedule 2 and 3 of the 1998 Act provide a list of conditions and, in order for information to be processed in accordance with the Act, at least one condition from both sections must be satisfied^[10]. These conditions will be discussed at length in section 3 of this paper, when we turn to examine under what circumstances a medical professional is lawfully justified to make disclosure when it is deemed in the best interests of a patient’s welfare.

In regard to the requirement of fairness, in the medical context, Stauch et al (2002) write: “To be ‘fair’ the data must, in general terms, have been obtained from the patient honestly or in accordance with a legal obligation; the patient must have been told the purposes for which the information is to be processed; and the rules for providing access to the data subject must also have been observed.^[11]”

In regard to when it is deemed unlawful to process personal medical information, no definition of lawfulness is provided by the Data Protection Act 1998^[12]. One can only assume that this refers to the legal requirements provided under the common law and also under the Human Rights Act 1998.

Article 8 of the Human Rights Act 1998 provides: “(1) Everyone has the right to respect for his private and family life, his home and his correspondence. (2) There shall be no interference by a public authority with the exercise of this right except such as is in accordance with the law and is necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of health or morals, or for the protection of the rights and freedoms of others.” In the recent case of Rose v. Secretary of State for Health [2002]^[13] it has been held that this right is conferred on all citizens, including children. However, from the wording of the Article, in particular Article 8(2) it is immediately clear that this right to confidentiality is subject to a broad public policy category of exception. The category of exception will be analysed in greater detail in section 3 of this paper, when we turn to examine under what circumstances a medical professional is lawfully justified to make disclosure when it is deemed in the best interests of a patient’s welfare.

In regard to the common law right to privacy, this right is based upon equitable principle and therefore a breach of this right gives rise to a civil law cause of action only. Similar, but distinct, from the law of tort, one of the requirements which needs to be established before a common law right to confidentiality can be deemed to have arisen in any given case is a duty of confidentiality. This might arise from a contractual relationship between the parties or, in the medical context, simply from the fact that medical professionals are duty bound to respect the confidentiality of their patients^[14]. However, this duty is also subject to a public interest exception: In this case of W v Edgell [1990]^[15], it was held by Lord Justice Bingham, who provided the leading judgment in this case, that: “...the law treats such duties not as absolute but as liable to be overridden where there is held to be a stronger public interest in disclosure.^[16]” To what extent the welfare of a child patient who lacks capacity to consent can serve as such a ‘public policy’ justification for derogation of this duty by medical professionals will form part of the subject of discussion in section 3 of this paper, below.

2.2 Adult patients who lack capacity and their ‘right(s)’ to confidentiality:

An adult patient will be deemed to lack capacity either where he or she is unable, physically, to provide consent to disclosure; or, where that patient is deemed to lack capacity in accordance with the assessment criteria established under section 3 of the Mental Capacity Act 2005.

This group of patients enjoy the same rights to confidentiality as the children discussed in the previous subsection of this section of the paper; namely, they have a right under the Data Protection Act 1998 to have their personal data processed fairly and lawfully and only where certain pre-defined conditions has been satisfied; the right to privacy as provided by Article 8(1) of the Human Rights Act 1998 (but, likewise, subject to the public policy exceptions provided by Article 8(2) of that Act); and, the common law right to confidentiality.

3. What is/are the legal basis/bases on which medical professionals are entitled to derogate from the right to confidentiality otherwise enjoyed by their children and adult patients who lack capacity, when derogation is deemed to be in the best interest of their patients’ welfare?

In the previous section of this paper, we established that each of the various legal bases for the right to confidentiality and non-disclosure of children and adult patients who lack capacity are subject to exceptions. In regard to the Human Rights Act 1998 and also the common law duty to maintain patient confidentiality, the exception is one based upon considerations of ‘public policy’. In regard to the Data Protection Act 1998, the ‘exceptions’ are provided by Schedule 2 and 3 of the Act which set out a list of conditions, at least one from each schedule of which must be satisfied in order for a medical professional to be deemed entitled to disclose (i.e. ‘process’) the confidential information of his or her patients to 3^rd parties.

Let us now turn to examine to what extent ‘the welfare of these patients’ can be deemed a legitimate public policy justification for derogating from these patients’ right to confidentiality and also to what extent the conditions provided in schedule 2 and 3 of the Data Protection Act 1998 might be capable of being satisfied by considerations of patient welfare.

Before we embark upon this analysis, it is important to remind ourselves of the practical circumstances with which a medical professional might be confronted when treating children or adult patients who lack capacity: First, it should be remembered that such medical professionals will not be able to ask these patients for consent, because they, by definition, are either physically or mentally incapable of providing such consent; and, second, in the context of children patients who lack consent and who are under the age of 16, medical professionals are required by law to involve the parents or legal guardians of those patients in any decision-making processes pertaining to the treatment of their children—therefore issues of disclosure to these types of third party are irrelevant^[17].

Bearing these limitations in mind, let us examine the various categories of exception which operate to allow medical professionals to make disclosures in the absence of any consent (but not where consent has been withheld by the parents or legal guardians of the patients in question).

The first point to note is that medical professionals are fully entitled to disclose medical information to other medical professionals who are also involved in the treatment of a child or adult patient who lacks capacity. Such disclosure is permissible under the Data Protection Act 1998 because one condition from Schedule 2 and one Condition from Schedule 3 are both satisfied; namely, the condition provided by s6(1) of Schedule 2 to the Act, which staes that, “[t]he processing is necessary for the purposes of legitimate interests pursued by the data controller or by the third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject;” and, the condition provided by s8(1) of Schedule 3 to the Act, which provides: “[t]he processing is necessary for medical purposes and is undertaken by— (a) a health professional, or (b) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional..”

Such disclosures are made in the interests of the welfare of the patient, although assessments do not need to be made on a case-by-case basis as it is generally assumed that disclosure across medical professionals is legitimate and that consent for such disclosures would not be withheld.

In regard to making disclosures to other non-medical parties: The various exceptions identified in the previous section of this paper all depend upon derogation being justified in the ‘public interest’. In regard to Article 8(2) of the Human Rights Act 1998, the words “necessary... in the interests of... the protection of health or morals,” does seem to suggest that derogation on grounds of the welfare of a particular patient would be deemed justified. This has been confirmed by the courts in the case of Z v Finland (1998)^[18].

In regard to the common law duty to maintain patient confidentiality, we have already cited the case of W v Edgell [1990]^[19] as providing authority for the assertion that this duty can be overridden by competing public interests. It is highly unlikely that the Courts would wish to undermine the decisions of medical professions in this regard; after all, medical professionals are best qualified to determine how important disclosure is in any given case and therefore whether the duty of confidence should be overridden. As Bainham (2005) writes: “[I]t is... debateable how far the courts would want to question, retrospectively the clinical judgment of the medical profession.^[20]”

In regard to making disclosures to non-medical 3^rd parties under the Data Protection Act 1998, while little direct guidance can be found within the wording of the 1998 Act itself, the General Medical Council (2000), at paragraph 27 of its official publication entitled ‘Confidentiality: Protecting and Providing Information’, seems to suggest that disclosure on grounds of patient welfare will be considered a justified processing aim under the Data Protection Act 1998: “Disclosure of personal information without consent may be justified in the public interest where failure to do so may expose the patient... to risk of death or serious harm. Where the patient... [is] exposed to a risk so serious that it outweighs the patient’s privacy interest, you should seek consent to disclosure where practicable. If it is not practicable to seek consent, you should disclose information promptly to an appropriate person or authority.” It must be noted that this guidance notes does not suggest that disclosure will be justified where the risk to the patient is only minor, but provides no insight into how to assess the seriousness of any given welfare risk. Of course, if death is a risk faced by the patient if disclosure is not made, then this will automatically be deemed sufficiently serious.

4. The legal framework: How have the courts of England and Wales purported to strike an appropriate balance between protecting the rights (to confidentiality) of children and adult patients who lack capacity, on the one hand; and, allowing medical professionals to make disclosures when such disclosures are deemed to be in the best interests of their patients, on the other?

Much of this analysis has already been conducted in the previous sections of this paper, when determining the extent of patients’ rights to confidentiality and also the extent of medical professionals’ duties of confidentiality to their child and adult patients who lack capacity.

However, one key fact has been omitted: Throughout this paper we have seen how many of the exceptions available at law to patients’ rights to confidentiality depend upon a notion of the ‘public interest’. It should be noted that the courts have been reluctant to provide any categorical definitions of this phrase. Rather, they have approached the matter on a case by case basis, with pragmatism.

Those cases in which the Courts have held disclosure to be in breach of patients’ rights to confidentiality generally have involved circumstances where information has been released for interests other than those pertaining to the welfare of particular patients. For example, in the case of X v Y [1988]^[21] Rose J held that the disclosure of medical information for the purposes of protecting other employees was not a sufficient ground upon which to invoke the public interest defence.

In cases where the disclosure was made in the interests of that patient, particularly, then the Courts are therefore likely to be more willing to allow the public interest defence to succeed. This makes sense, when one considers that the Courts are generally concerned with the harm or potential for harm caused by a disclosure to the patient over which the sensitive medical information pertains^[22].

The Courts and medical professionals should also take into account that it is in the public interest to protect patients’ rights to confidentiality wherever possible. As Leung (2000) notes, if the right to confidentiality is not protected, then this could have far-reaching adverse consequences on the level of healthcare which is able to be provided by the National Health Service—patients will be less willing to be open and honest about sensitive facts, and therefore it may be less easy to diagnose and treat such persons^[23].

5. What, if any, mechanisms are in place to review the conduct of medical professionals and hold accountable any medical professionals who fail to adhere to the limits of the discretion conferred upon them by the law of England and Wales?

Of course, the primary mechanism which is in place is the right to private law action which patients are entitled to pursue in the event of a perceived breach of their data protection or privacy rights. The result of such actions will depend upon whether or not, in any given case, the court deems it appropriate to allow the defendant medical professional(s) to enjoy the protection afforded by the public interest defence. As we have argued in the previous section of this paper, where the reasons for disclosure were based solely on considerations of the particular patient’s welfare, then it is highly likely that the claimant’s case will fail.

However, not every victim of breach will decide to take legal action and therefore it is not wholly appropriate to rely upon this mechanism to ensure that medical professionals remain compliant with their data protection and confidentiality duties. That having been said, this author can find no evidence of any other mechanisms which have been developed to measure compliance in this regard.

Conclusions:

The statement at the top of this paper suggests that it is difficult for medical professionals to decide whether or not to disclose personal information of children and adult patients who lack capacity to 3^rd parties, when to do so is in the interests of the welfare of their particular patients.

In fact, as we have seen, so long as the interests contemplated really are based upon considerations of patient welfare, then this decision is not a difficult one at all: Disclosure is such cases should be made. The fact that the patients themselves are unable to provide consent or, more importantly, withhold it, makes this assessment all the more easy.

In regard to how well the law manages to safeguard the rights of children and adult patients who lack capacity to confidentiality: These rights are all, without exception, conditional and capable of being overridden in the public interest. While the Courts do seem to approach determinations of when the public interest defence should be allowed to succeed in a pragmatic and sensible way, taking into account the harm caused by each breach in question; it is arguable that some form of monitoring and accountability mechanism should be introduced at the practitioner level, to ensure that medical professionals are remaining compliant even where their patients, for whatever reasons, do not decide to take legal action for perceived breaches of their data protection and privacy rights.

References:

The Data Protection Act 1998

The Data Protection Directive, European Directive 95/46/EC

The Human Rights Act 1998

The Mental Capacity Act 2005

Rose v. Secretary of State for Health [2002] 2 F.L.R. 962

Bainham, A. (2005) Children: The Modern Law. Jordan Publishing.

Gillick v West Norfolk and Wisbech Area Health Authority [1985] 3 All ER 402

GMC (2000) Confidentiality: Protecting and Providing Information. Available online at http://www.gmc-uk.org/guidance/current/library/confidentiality.asp

W v Edgell [1990] 1 ALL ER 835

Z v Finland (1998) 25 EHRR 371

X v Y [1988] 2 All ER 648.

Devereux, J., and Moore, R. (2002) Medical Law. Routledge and Cavendish Publishing, 2002.

Stauch, M., Wheat, K., and Tingle, J. (2002) Sourcebook on Medical Law. Routledge Publishing,2002.

Bailey, P. & Harbour, A. (1999) The law and a child’s consent to treatment (England and Wales). Child Psychology and Psychiatry Review, 4, 30–34.

Wei, G. (2002) An Introduction to Genetic Engineering, Life Sciences and the Law. NUS Press Publishing, 2002.

Leung, W. (2000) Law for Doctors. Blackwell Publishing, 2000.

Footnotes

^[1] Section 2(2) of the Mental Capacity Act 2005.

^[2] The applicable criteria are provided by section 3(1) to (4) of the Mental Capacity Act 2005.

^[3] Section 2(3)(2) of the Mental Capacity Act 2005.

^[4] Section 2(4) of the Mental Capacity Act 2005.

^[5] Not merely asleep!

^[6] Gillick v West Norfolk and Wisbech Area Health Authority [1985] 3 All ER 402, per Lord Scarman.

^[7] Bailey and Harbour (1999) p32

^[8] Schedule 1, Part 1, section 1 of the Data Protection Act 1998.

^[9] Schedule 1, Part 1, section 1 of the Data Protection Act 1998.

^[10] Schedule 1, Part 1, section 1(a) and (b) of the Data Protection Act 1998.

^[11] Stauch et al (2002) p282

^[12] Ibid.

^[13] Rose v. Secretary of State for Health [2002] 2 F.L.R. 962

^[14] For example,

^[15] W v Edgell [1990] 1 Ch 359.

^[16] Cited by Devereux and Moore (2002) p343

^[17] As Bainham (2005) p330 writes: “But what of immature children who would fail the test of Gillick competence? Here, the obvious implication of Gillick was that the parent’s right to give or withhold consent would remain intact, and this has been confirmed by the later Court of Appeal decisions. Are there, then, any circumstances under which a doctor may act against parental wishes... because he judges it in the clild’s best interests to do so? It must be said that, as the law stands, this would be a precarious course of action...”

^[18] Z v Finland (1998) 25 EHRR 371

^[19] W v Edgell [1990] 1 Ch 359.

^[20] Bainham (2005) p331

^[21] X v Y [1988] 2 All ER 648.

^[22] Wei (2002) p95

^[23] Leung (2000) p45