CONFIDENTIALITY

1
CONFIDENTIALITY

• Gina Mann
• Governance Officer

2
What we will be covering in this session?

• Legal Requirements
• Common Law of Confidentiality
• Human Rights Act 1998
• Data Protection Act 1998
• NHS Guidance
• Confidentiality NHS Code of Practice
• Caldicott Principles

3
Common Law Duty of Confidentiality
Common law is not written out in one document
like an Act of Parliament. It is a form of law
based on previous court cases decided by judges.
Definition of Confidentiality

• Being confidential is not disclosing anything
  learned about or from a person who has been in
  contact with the practice/hospital/PCT without
  that persons agreement

4
Human Rights Act 1998

• The Act establishes a right to respect for
  private and family life
• This underscores the duty to protect the privacy
  of individuals and preserve the confidentiality
  of their health records.
• Compliance with the Data Protection Act 1998 and
  the common law of confidentiality should satisfy
  Human Rights requirements.

5
Data Protection Act 1998

• Sensitive data, including health records, can
  only be processed under strict conditions
• Fair and lawful
• Used only for specified and lawful purposes
• Adequate, relevant and not excessive to need
• Accurate and kept up to date
• Not kept longer than necessary
• Processed in accordance with data subject rights,
  including rights of access
• Kept secure and protected against accidental
  disclosure, loss or damage

6
What is Data ?
Data Protection Act

• Personal data covers both facts and opinions
  about a living individual
• Ordinary personal data name address and
  telephone number
• Sensitive personal data relating to racial or
  ethnic origin, political opinions, religious
  beliefs, trade union membership, health, sex life
  and criminal convictions.
• Personal data can be in the following format
• Computer files, including word processor,
  database and spreadsheet files
• Paper files
• Microfiche, CCTV pictures, audio

7
Individual Rights
Data Protection Act

• Individuals on whom personal data is held have
  very specific rights under the Data Protection
  Act.
• These include
• Access to the data held on them
• The power to prevent the processing of data
• The right to have incorrect or misleading data
  amended or erased
• The purposes for which data will be used

8
Disclosure of Information
Data Protection Act

• You must check you have at least one of these
  three keys before sharing confidential
  information
• A legal requirement
• Consent
• Public or Vital Interest

9
A legal requirement

Data Protection Act

• A number of Acts create a duty to disclose
• information
• Childrens Act
• Road Traffic Act
• Terrorism Act
• Criminal Investigations Act

10
Childrens Act 2004
Data Protection Act

• All staff have a responsibility to act to make
  sure that all children are protected from harm
• If a request for information is requested from a
  professional or agency you have a duty to
  disclose confidential information if
• There are any perceived risks to a child
• The information given would allow appropriate
  help and services or action to reduce risk to a
  child

11
Criminal Investigations Act, Terrorism Act Road
Traffic Act
Data Protection Act

• You have a duty to disclose confidential
  information if a request is for -
• the prevention or detection of crime,
• the apprehension or prosecution of an offender,
• for the purpose of safeguarding national security

12
Consent
Data Protection Act

• Any consent is only valid if the patient has
  been informed and understands
• Consent must be recorded either using the
  respective agencies documentation i.e. Police use
  a DP7A form or your own
• Where an individual is incapacitated, the views
  of the persons carer or parent/guardian, should
  be taken into account

13
Public or Vital Interest

Data Protection Act

• The law does permit sharing of information in the
  interests of the public or the vital interests of
  an individual. If using this do still consider
  informing the patient provided no harm will arise
  from it.
• This key usually comes into affect when the
  sharing of information is critical to prevent
  harm or distress or is literally a matter of life
  or death

14
Access to Medical Records
Data Protection Act

• Everyone has a right to access their medical
  records
• Exceptions
• Cause serious harm
• Details about a 3rd party might be revealed from
  the records
• If applying for access on behalf of someone else
  you will need written consent
• Parents
• may have access to a childs records if this is
  in the childs best interest and not contrary to
  a competent childs rights
• Deceased Patient Records
• their personal representative or executor or
  administrator or anyone having a claim resulting
  from the death (this could be a relative or
  another person), has the right to apply for
  access to the deceaseds health records.

15
Process for accessing
Data Protection Act

• The request should be in writing or email and you
  need to have enough information to carry out the
  request i.e. Name, Address, DoB etc ideally a
  proof of identity should be asked for i.e number
  from their Driving Licence or Passport
• No fee is required if a pt just wishes to view
  the record however if copies are requested then
  the DPA details appropriate charges
• You have 40 days to comply

16
What have we covered so far?

• Legal Requirements
• Common Law of Confidentiality
• Human Rights Act 1998
• Data Protection Act 1998
• NHS Guidance
• Confidentiality NHS Code of Practice
• Caldicott Principles

17
Confidentiality NHS Code of Practice

• The Confidentiality Code of Practice is a result
  of a major public consultation that included
  patients, carers and citizens, the NHS, other
  healthcare providers, professional bodies and
  regulators.
• The Code offers detailed guidance on
• protecting confidential information
• informing patients about uses of their personal
  information
• offering patients appropriate choices about the
  uses of their personal information and
• the circumstances in which confidential
  information may be used or disclosed.
• The Code can be accessed from the Department of
  Health website.

18
Caldicott

• The Caldicott Committees remit was to review the
  transfer of patient-identifiable information from
  NHS organisation to other NHS or non-NHS bodes
  for purposes other than direct care, medical
  research or where there is a statutory
  requirement.
• The chair person Dame Fiona Caldicott presented
  here completed report in December 1997.

19
What is patient identifiable information
Caldicott

• Surname
• Forename
• Initials
• Address
• Postcode
• Date of Birth
• Other dates (i.e death, diagnosis)

• Sex
• NHS Number
• NI Number
• Ethnic Group
• Soundex Code
• Occupation
• Local Identifier (i.e. hospital or GP Practice
  No.)

20
Caldicott Principles
Caldicott

• The report recommended the following principles
• Justify the purpose
• Dont use patient-identifiable (PII) information
  unless it is absolutely necessary
• Use the minimum necessary
• Access to PII should be on a strict need-to-know
  basis
• Everyone with access to PII should be aware of
  their responsibilities
• Understand and comply with the law

21
Handy tips!

• Paper Confidential information
• Do not leave confidential documents on reception
• Lock such documents away at the end of the night
• Lock filing cabinets
• Lock surgery doors when empty
• Shred do not throw in bins try not to let
  shredding pile up
• Book out and track files
• Dont send sensitive information by post,
  especially to young people if it could be
  intercepted by others in the household could
  you text them or ring them to ask them to call
  into the surgery to pick it up?

22
Handy tips!

• Transfer of confidential information
• Do not leave messages on answerphones
• PCT policy states that you can only send emails
  containing patient information via the secure
  _at_glos.nhs.uk or _at_nhs.net, keep information to a
  minimum, double check whom you are sending to
  see PCT email policy
• Ensure envelopes are marked Private and
  Confidential

23
Handy tips!

• Requests on the telephone for Information from an
  external agency
• Verify the caller
• Ask the reason for the request
• Call them back
• Call them back on a main switchboard number, or
  on a number you recognise not a mobile
• If in any doubt check with your manager

24
Handy tips!

• Electronic confidential information
• Angel screens away from view
• Use screen savers and passwords
• Log off
• Never disclose your password
• Ensure back up procedures are in place

25
Handy tips!

• Overheard conversations
• Use the mute button when leaving the telephone
• Provide an area for speaking in confidence have
  a sign at reception to let them know they that
  this is available
• Music or video in waiting area
• Do not repeat names etc to confirm when using the
  telephone ask the patient to repeat or spell
• Use secure room/area to make sensitive calls

26
Good Practice

• Put Confidentiality on your Team meeting agenda
  as a recurring item
• Ask staff to highlight any areas of
  confidentiality they would like to discuss
  difficult situations such as relatives seeking
  information about patients and discuss
  solutions
• Check that staff have read and understand
  relevant policies go through them
• Health Care Professionals and managers agree to
  support staff when they need to justify breaking
  confidentiality i.e. consent
• Assess the risk regularly take it in turns to-
• Walk through the building
• Look through windows
• Sit in waiting room
• Feedback your findings to your manager and at
  team meetings

27
Information available

• Leaflets
• Have the following leaflet available for
  staffAbout patients guidance for staff on
  handling patient information
• Have the following leaflet for patientsYour
  Information what you need to know
• Contact names and telephone numbers
• Gina Mann Governance Officer and
• Sarah Robinson Assistant Director Governance
  08456 583826
• Policies and Acts
• ensure you have access to the policies and acts
  that have been discussed today you will find them
  on the DOH website
• www. dh.gov.uk
• PCT Policies Data Protection, Records Mgt,
  Information Sharing, Emailing of Pt Identifiable
  Information, Information Governance Policy are
  all available on the PCTs website
  www.glospct.nhs.uk

28
Any questions?
Thank you for participating in this session I
hope you found it useful.