B3 W3: Data protection & confidentiality Flashcards
What are the reasons for maintaining confidentiality?
Talk about them in relation to ethical principles
CONSEQUENTIALIST ARGUMENT:
- Impact on the patient (breach may upset them and their trust in the Dr, may be less likely to share info in the future, less likely to access healthcare, under report symptoms etc.)
- Impact on others generally (loss of public trust, less effective care for many.)
RESPECT FOR AUTONOMY:
- Self-determination about how/ whether information is shared, how it is used.
VIRTUE ETHICS:
- Promise-keeping/ trustworthiness as virtues
OTHER DUTIES
- Duty of care (data shared in healthcare teams but not beyond)
- Patient-Dr relationship
Give some generalistic reasons for not maintaining confidentiality
Talk about the ethical principles
CONSEQUENTIALISM:
- Impact on specific others (harm of non-disclosure)
OTHER DUTIES:
- Duty of care (data shared in healthcare team but not outside)
What are the types of consent?
Implied or explicit
Implied consent can be sufficient if all the criteria are met……
i) Data is being used to support a patient’s direct care
ii) Information is available to the patient stating how it will be used & how they can object
iii) You have no reason to believe they would object
iv) Satisfied that anyone you disclose to will understand the information has been given in confidence & treat it accordingly
When should you get explicit consent to disclose patient information?
If you think the patient would be surprised to learn how you were accessing or disclosing their personal information
GMC Confidentiality paragraph 29
Give examples of secondary uses of patient information
What type of consent should be obtained?
- Research
- Certain types of audit (eg: financial)
- Public Health
- Education
- Health Service Planning
Explicit consent
What does the GMC Confidentiality Paragraph 95 say?
Seek explicit consent to disclose personal information for purposes other than direct health care/ local clinical audit
UNLESS the information is:
Required by law, or is not appropriate or practical to obtain consent
When may you disclose personal information for secondary purposes without breaching duties of confidentiality?
What type of information should be given- identifiable or anonymised?
1) Disclosure required by law, including the courts
2) Patient has given explicit consent
3) Disclosure approved through statutory process that sets aside common law duty of confidentiality
4) Disclosure can be, exceptionally, justified in public interest
Anonymised information is usually sufficient for purposes other than direct care
When is data considered anonymised?
i) Does not itself directly identify any individual
ii) Unlikely to allow an individual to be identified through combination with any other data
Different types of data have different levels of re-identification risk (Small versus large data set)
Anonymised vs pseudonymised data are NOT the same
Secondary use of data- disclosing in the public interest what must you consider?
i) The potential harm/distress to the patient- will they engage in further Tx/ Dr-Pt relationship
ii) The potential harm to trust in Dr’s generally
iii) The potential harm to others (specific person or public) if not discolsed
iv) The potential benefits to an individual/ society with release of information
v) Nature of the information disclosed & views expressed by the patient
vi) Can the harms be avoided or benefits gained without breaching the patient’s privacy. If not, what is the minimum intrusion?
When disclosing information about a patient you should…..
(GMC process for disclosing patient information)
a) Use anoymised/ coded information if practical that will serve the purpose
b) Be satisfied that the patient:
- i) Has access to the information that their personal information may disclosed for the sake of their care, local clinical audit & they can object
- ii) Has not objected
c) Explicit consent if information is: identifiable, for purposes other than their direct care, local clinical audit, unless the disclosure is justified by law or public interest
d) Keep disclosure to minimum necessary for purpose
e) Keep up-to-date with, observe all relavent legal requirements including common law & data protection law
Notifable disease under the Health Protection Regulations 2010
What are the Acts/ Legislations around this?
Who should be informed?
Give some examples
Legislation:
- Public Health (Infectious Diseases) Act 1998
Public Health England regulations
- Health Protection Regulation 2010
Hospital Infection control- duty microbiologist
PHE:
- Diagnosing clinician’s duty to report case to local health protection team
- Form
- Notify urgent cases by phone in 24 hours
Eg: Tb, Acute Poliomyelitis, Acute infectious hepatitis, anything the may present significant risk to human health (meningitis, meningococcal septicaemia, measles mumps rubella, scarlet fever, infectious bloody diarrhoea).
What are the General Data Protection Regulation (GDPR) 6 key principles?
GDPR = new data protection framework that applies in all EU member states
New data protection act (2018) enacted to supplement GDPR, two laws considered together.
Data must be:
1) Processed fairly, lawfully & in transparent manner
2) Collected for specified, explicit, legitimate purpose & not further processed for other purposes incompatible with those purposes
3) Adequete, relavant & limited to what is necessary
4) Accurate and kept up to date
5) Kept in a form that permits identification of data subjects for no longer than is necessary for the purpose of which the data is processed
“Allows identifcation of data so that it is not kept longer that needed for the purpose it is being used for”
6) Processed in a way that ensures appropriate security of personal data including protection against unauthorised/ unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures
What act allows people to see the health records of deceased people?
Access to Health Records Act 1990
Under what are you allowed to access the health records for all living people?
GDPR- general data protection regulation:
allows access to health records for all living individuals, NHS trust have 1 month to respond
