CEL 2: Duties of

Information Governance
Introduction
This unit covers issues related to the flow of information between doctors, their patients, and other
interested parties. Advances in information technology enable more and more health information to be
stored than ever before, and also enable that information to be distributed to more people, at greater
speed, than was ever possible in the days of paper records. Furthermore, patients can access a vast
amount of health information on-line, some reliable, some less so, adding a new layer of complexity
to clinical consultations. The regulatory framework that lays out a doctor’s duties of information
governance is complex and includes case-law, contractual obligations, statutory obligations and
European law.

In CEL Workshop 2, during R&I Week A (and a bespoke workshop for CGC students at West
Suffolk Hospital during Clinical Skills 2), we will discuss the extent to which a doctor is obliged to
inform patients about prognosis. We will also revisit briefly some learning from CEL 1 (duty to
inform patients of the risks of treatment) and introduce briefly some material that will be revisited in
Year 6 (CEL11 – duties of care and candour). We will discuss the doctor’s duty of confidentiality and
when that duty may, or even must, be breached. We will also discuss the patient’s right to privacy and
the implications that this may have for the way in which we collect, store and use information about
them.

Objectives
Students should be able to:
 Discuss the importance of trust, integrity, honesty and accountability in all professional
relationships.
 Discuss the concept of confidentiality and its ethical, legal and professional underpinnings.
 Demonstrate awareness of when it is ethically, legally and professionally justifiable or
mandatory to disclose confidential information, and how to do this appropriately.
 Discuss the ethical and legal aspects of the use, transmission and storage of all types of
personal data.
 Outline good practice in sharing information with relatives, carers, and other HCPs,
recognising potential ethical and legal tensions.
 Critically examine and apply General Medical Council guidance, principally relating to: the
need to promote best practice and respect for patients, colleagues, and other healthcare
professionals; professional standards expected of students; maintaining professional
boundaries with patients; use of social media.

These objectives are taken from the Institute of Medical Ethics’ Core Curriculum for Undergraduate
Medical Ethics and Law (2019), designed to ensure that your learning in this area covers the
requirements of the GMC’s Outcomes for Graduates (2018).

1
Part 1. Trust and Trustworthiness
Think back to the introductory reading for this course and reflect for a moment on the ethics of truth-
telling. What did you think of the Kantian view that lying is irrational (because it only works if people
believe you, and they won’t believe you if they know you tell lies) and therefore wrong? How about
the consequentialist view that lying can be the right thing to do if telling the truth would do more
harm than good? Is honesty essential to gaining the trust of our patients?

Patients need to be able to trust doctors to treat the information that we gather about them with
appropriate respect. What can we do to demonstrate that we are worthy of their trust? Onora O’Neill
(Emeritus Professor of Philosophy, University of Cambridge and Chair of the Equality & Human
Rights Commission) has some ideas:

‘Systems of accountability won't make trust easier unless people have reason to trust these systems. If
they are too complex or designed for other purposes - as they often are - most of us will find it
difficult to follow them, and it's hard to know whether they are trustworthy guides. They may damage
professional performance - as a midwife commented recently, it takes longer to do the paperwork
than to deliver the baby and that's surely the wrong way around.

Transparency is another fashionable remedy, and has become technically easy. It can be achieved
merely by pushing information into the public domain. But as lots of people will not find the
information, or will find it obscure, or will not be able to work out whether to trust it, transparency is
no guarantee that others will be more likely to trust.

When we are wondering whether to trust others, the most useful evidence of trustworthiness is usually
non-verbal communication. A shop that announces that it will take back unwanted purchases, no
questions asked, communicates that it is confident about the quality of its products, and is likely to be
trusted. A business that deals well with complaints (as opposed to sending customers to a so-called
helpline, to talk to people who inflict scripted conversations) is more likely to be trusted.

Professionals who take the time to listen, who use plain language, who open themselves to check and
challenge, who offer others opportunity to judge their honesty, competence and reliability, are more
likely to be trusted... Where statistical evidence is competent and well-communicated, it is much more
likely to be trusted. Conversely, communication that is evasive, over-complex, incomplete or
incompetent, defeats trust. Good, assessable communication cannot guarantee others' trust: that trust
is theirs to give or to refuse. But good communication can make it easier to judge others'
trustworthiness. It is important and often indispensable for placing or refusing trust intelligently.

I think it's perverse to think of trust as more basic than trustworthiness. To place and refuse trust
intelligently we need first to judge others' trustworthiness, or their lack of trustworthiness, in specific
matters. Only when we can do so, will we be in a position to place and refuse trust intelligently. What
matters is not the plaintive question, "How can we restore trust?" but the practical question, "How
can we make it easier to judge trustworthiness?"

2
Part 2. Informed Consent
Maintaining confidentiality is one way of earning the trust of patients, who may need to impart
sensitive or embarrassing information to doctors in the course of seeking treatment. We will consider
this in more detail further on in this unit. Equally important, however, is providing appropriate
information to patients.

Legal considerations
For consent to be informed, the patient must be provided with accurate information about:
All the options (including no treatment), covering -
1) The nature (what would be done) and purpose (why it would be done – expected benefits) of the
investigations or treatments.
2) The material risks associated with each option:
a) what a reasonable patient would want to know before making this decision,
b) any information this patient wants to know.
Failure to inform your patient of the nature or purpose of an investigation or treatment you
intend to perform leaves you liable for assault, as you have no consent.
Failure to provide information material to the decision, is a breach of your duty of care, leading to
potential liability for negligence. We shall discuss this in more detail in Year 6, in the workshops on
Duties of Care and Candour.

Ethical considerations
Thinking about this issue in terms of ethical principles, we can see that patients need a certain amount
of information about diagnosis, prognosis and treatment options in order to be involved in decisions
about their care. Some patients may choose to leave the decision to the doctor, but this should be their
choice.

The issues here are around balancing respect for autonomy (and providing the information needed to
make autonomous choices) with non-maleficence (not unduly alarming patients or overburdening
them with technical information which makes it harder for them to make a decision) and beneficence
(when treatment is clearly needed, it can be tempting to ‘manage’ the flow of information in order to
persuade the patient to accept treatment). In relation to the principle of justice, if you are considering
with-holding information that you would normally disclose then you should ask your self – are there
good reasons for treating this patient differently from others?
Good communication skills are important in managing the flow of information to patients so that they
receive the information that they need, in a form that they understand, and they have the opportunity
to stop the flow of information if they want.

Part 3. Disclosure, deception & clinical discretion

3
Generally speaking, we favour openness with patients. However, there are times when we may
wonder whether telling a patient everything is the right thing to do.

Non-disclosure to protect the doctor: Duty of candour

When mistakes are made, or complications occur, a timely explanation and apology is usually the
recommended course of action. Patients should already have been made aware of the risks of
treatment before consent is sought. They will usually need to know about any adverse consequences
that have occurred so that appropriate action can be taken to minimize the harm that may result, and
so that they can participate in decisions about the management of the problem.

Hence, disclosure is supported by the ethical principles of beneficence, non-maleficence and respect
for autonomy. However, the principle of non-maleficence may also suggest limiting disclosure in
some circumstances, if the distress that it would cause the patient outweighs the good that would
come of it.

Remember, it is the interests of the patient that must be considered. Decisions motivated by a desire
to cover up your own mistakes or those of colleagues are not justifiable.

Failure on the part of organisations (such as hospitals or GP practices) to inform a patient or bereaved
relative of serious errors in treatment now constitutes a breach of a new legal duty. The Health and
Social Care Act 2008 (Regulated Activities) Regulations 2014 have created a statutory duty of
candour. It created a legal obligation on all NHS health care providers to disclose errors in treatment
that result in prolonged psychological harm, moderate or severe physical harm or death.
We will be discussing this issue in greater detail during Year 6 (CEL Workshop 11).

Non-disclosure to protect the patient: Clinical discretion

Consider this reflection (published in the BMJ) by consultant gastroenterologist & hepatologist Philip
Berry:

A young patient, well-known to me, had been admitted once again. She was severely jaundiced and
the cause, as usual, was heavy drinking. Just a few months before she had spent three weeks in
hospital being fed via a nasal tube and receiving steroids to calm down the dangerous inflammation
in her liver. Early one morning, I was called to see her urgently.

She lay on her side. A puddle of blood had collected in the depression she made in the mattress, and
extended from her head to her waist. It had spilled over in places, making the floor sticky. She was
groaning but still conscious and aware of the emergency. The curtains had been pulled around the
other patients’ beds so they did not have to witness the terrible scene.

Within 15 minutes she had been transferred to the intensive care unit and preparations were being
made to sedate and intubate her. This would allow me to perform an endoscopy without her
struggling and moving around.

I stood by the head-end of her bed and said her name. She looked up. She knew me; we had a rapport.
I explained what we were planning to do. She said: ‘Doctor, just tell me I’m going to wake up.’ I

4
hesitated and said: ‘Yes, we should be able to stop the bleeding and stabilise you, you should be
awake in a couple of days.’

An oxygen mask was put over her face and the first sedative was administered. Her eyes fell closed.
As the anaesthetist began to insert the endotracheal tube a dark fountain rose up from her mouth and
poured on to the already sodden pillow. Twin rivulets of blood flowed from her nostrils.

When I passed the endoscope into her oesophagus all I could see was blood. Red-out. I inserted a
balloon into her stomach to compress the engorged vessels from below but her blood had become too
thin and she continued to bleed. I tensed the balloon as much as possible but over the next hours she
lost more and more blood and her heart began to fail.

Her family arrived and I spoke with them. Death was now certain. She died half an hour later. It was
no surprise; not to me, not to the nurses, not to the other consultants who had looked after her in the
past.

However, I was troubled. I could not forget that one of her last human interactions was with me,
when I gave her reassurance, albeit couched in the semantic ‘should’, that she would survive. I
wondered if, as the sedatives kicked in and the meaning of my words drifted across her darkening
mind, they offered any comfort at all.

There is a clinical discretion to withhold information from patients when informing them would be of
little or no benefit and likely to cause significant harm. However, judging the benefits and harms of
disclosure and non-disclosure is difficult, as these will vary according to each patient's own personal
values. As a rule of thumb, it is usually reasonable to err on the side of disclosure. If you are unsure
whether this would be appropriate for one of your patients, progress gradually, drawing on your
clinical communication skills: check the patient's starting point, try to understand their information
needs, and monitor their response so that you can judge whether to continue to full disclosure. You
will have the opportunity to practice these skills in the CCS session on Breaking Bad News.

The use of deception in medicine is controversial. Kant argued against ever lying, as it undermines
our trustworthiness. However, sometimes omitting to tell the whole truth can bring comfort or spare a
patient distress. Daniel Sokol (Barrister & ethicist) has proposed an approach to determining whether
deception is justified:

5
6
Part 4. Confidentiality
Health professionals are responsible to patients for the confidentiality and security of the health
information they hold. The duty of confidentiality is regulated by professional ethical codes, by local
contracts and by the law.

The legal position is complex and ‘there remains a lack of a clear legal basis for confidentiality that
covers all patients’ (GMC website). Statutory and common law may be used to prevent or enforce
disclosure, or to prosecute a doctor who breaks the law.

The GMC has responsibility for the professional conduct of doctors and may take action if a doctor
breaches confidentiality without good justification. GMC Confidentiality guidance is underpinned by
the following eight principles of information governance:

Use the minimum necessary personal information.

•Use anonymised information if it is practicable to do so and if it will serve the purpose.

Manage and protect information

•Make sure any personal information you hold or control is effectively protected at all times against
improper access, disclosure or loss.

Be aware of your responsibilities

•Develop and maintain an understanding of information governance that is appropriate to your role .

Comply with the law

•Be satisfied that you are handling personal information lawfully.

Share relevant information for direct care

•in line with the principles in the guidance unless the patient has objected .

Ask for explicit consent

•to disclose identifiable information about patients for purposes other than their care or local clinical
audit, unless the disclosure is required by law or can be justified in the public interes t.

Tell patients
•about disclosures you make that they would not reasonably expect, or check they have received
information about such disclosures, unless that is not practicable or would undermine the purpose of
the disclosure.

Support patients to access their information

•Respect, and help patients exercise, their legal rights to be informed about how their information will
be used and to have access to, or copies of, their health records.

7
The duty of confidentiality

Scope
All data collected by doctors working in their professional capacity should be considered confidential,
because people have an expectation of confidentiality when consulting a doctor. Whether or not
doctors are engaging in their professional capacity depends to some extent on the perception of the
person giving the information. If a friend seeks your advice at a party, because they know you are a
doctor, then they may well have an expectation of confidentiality!

The confidentiality of deceased persons must be respected.

Anonymous information, which cannot foreseeably be used to identify a patient, is not treated as
confidential and may be used for legitimate purposes without consent. It can, however, be difficult
to make information truly ‘anonymous’ as you must consider both the data themselves and the
context in which they are shared. Data for research should usually be anonymised before use but it
may be impossible to do this effectively if we are dealing with rare conditions and the audience is
familiar with a large part of the community affected. Guidance on this complex area is available
from the Information Commissioner’s Office.

Responsibilities
The general position is that there should be no use or disclosure of any confidential information
gained in the course of professional work, for any purpose other than the clinical care of the patient to
whom it relates, unless:
a.The patient consents.
b.The disclosure is of overall benefit to a patient who lacks the capacity to consent.
c.The disclosure is required or permitted by law.
d.The disclosure can be justified in the public interest.
These exceptions are discussed in more detail in the following section s.

Disclosure on the grounds of consent or best interests

GMC guidance states:

Asking for a patient’s consent to disclose information shows respect and is part of good
communication between doctors and patients. Consent may be explicit or implied.
a. Explicit (also known as express) consent is given when a patient actively agrees, either
orally or in writing, to the use or disclosure of information.
b. Implied consent refers to circumstances in which it would be reasonable to infer that the
patient agrees to the use of the information, even though this has not been directly expressed.
You may disclose information on the basis of implied consent for direct care, and for local
clinical audit. In other cases, you should ask for explicit consent to disclose personal
information unless it is not appropriate or practicable to do so.

If a concerned relative rings a hospital ward to enquire about the health of one of your patients, there
is no reason not to tell them how your patient is doing, provided your patient says this is OK. As a

8
general rule, it’s sensible to ask your patients whether they are OK with you updating any friends and
family members who call. If a patient tells you that they don’t want a family member or friend
involved in their care and treatment, you must respect that (unless the public interest defence applies –
see below).

As we discussed in Unit 1, some people may lack the capacity to give consent to disclosure of
confidential information. Under those circumstances, you must consider two important questions:

1) Do I have an obligation to discuss this patient’s condition and treatment options with
someone, in order to have a legal justification for providing treatment? For example:
a. You need proxy consent for treatment from the parent of a child who is not
Fraser/Gillick competent.
b. You need a determination from the donee of a Lasting Power of Attorney that the
treatment you plan to give to an adult who has lost the capacity to consent is in that
person’s best interests.
c. You wish to treat an adult who does not have the capacity to consent and who has not
made a Lasting Power of Attorney – in order to determine whether the treatment is in
that person’s best interests, you must (if practical) consult someone who knows them
well.

2) Even if it is not necessary in order to obtain justification for treatment, would it be in the best
interests of this patient for me to disclose information under the current circumstances?
Examples where disclosure may be in the patient’s best interests include:
a. Disclosure is something they want and would consent to if they were able to (e.g.
someone brought into hospital unconscious will probably want their partner to be
informed).
b. Disclosure will aid their recovery and is not something they object to (e.g. an older
person develops delirium and is acutely confused and distressed but would be soothed
by the presence of their son or daughter).

Disclosure on the grounds of legal obligation or statutory permission

Court Orders - You are obliged to disclose information if required to do so by a court order, including
an order from a coroner’s court. Disclosure to statutory bodies such as the GMC is also obligatory
under certain circumstances. A police officer asking you to disclose information is not a court order –
you should not comply with such a request unless one of the justifications described in this section
(consent, statutory obligation or permission, or public interest) applies.

Statutory obligation or permission – In some situations, the provisions of an Act of Parliament

(statute law) will require you to disclose information that should otherwise be kept confidential. Acts
of Parliament may also create permission to set aside the duty of confidentiality under specific
circumstances. In addition to those discussed elsewhere in this unit (duty to consult under the Mental
Capacity Act, the statutory duty of candour) examples that apply to the way we practice medicine
include:

T HE NHS A CT 2006 ( S 251) grants powers to the Secretary of State for Health to set aside the
common law duty of confidentiality in specific circumstances where
 it is necessary to share information, and

9
  anonymised information is not sufficient, and
 it is not practicable to seek patient consent.
For example, a large retrospective cohort study may require access to data that identifies patients, in
order to allow linkages between different datasets. Seeking consent from the tens of thousands of
patients involved would be very expensive and time consuming and would require the disclosure of
more information than would be needed for linkage purposes.

Applications for s251 approval must be made to the Confidentiality Advisory Group, which is part of
the Health Research Authority. Applications must include explicit details about data flows; full
justification about why each identifiable piece of information is required and how this enables the
aims of the study to be achieved, and evidence that there is no reasonable alternative to disclosure
such as anonymisation or consent. See Unit 5 for more information on research governance.

T HE H EALTH P ROTECTION (N OTIFICATION ) R EGULATIONS 2010 (E NGLAND ). Registered

doctors in each of the UK countries have statutory duties to notify an appropriate person or body of
suspected cases of certain infectious diseases. In England, Scotland and Wales, doctors must also
notify the appropriate person of cases of any infection or contamination which they believe present, or
could present, a significant risk to human health. See the Improving Health course for more
information on notifiable diseases.

R OAD T RAFFIC A CT 1988 (E NGLAND , S COTLAND AND W ALES ): In certain circumstances, all
citizens (including doctors) must give the police, on request, any information which it is in their
power to give that may identify a driver alleged to have committed a traffic offence.

T HE C ONTROLLED D RUGS (S UPERVISION OF M ANAGEMENT AND U SE ) R EGULATIONS

2013 (E NGLAND AND S COTLAND ): Under these regulations, responsible bodies are required to
cooperate with each other in relation to the handling of, and acting on, shared information relating to
the management and use of controlled drugs.

C ARE A CT 2014 (E NGLAND ) requires ‘relevant partners’ to co-operate with local authorities
making enquiries about adults at risk of abuse unless to do so would be incompatible with their own
duties, or would otherwise have an adverse effect on the exercise of its functions. Relevant partners
include NHS trusts, foundation trusts and clinical commissioning groups in the local authority’s area.
See Unit 7 for more information on Safeguarding Vulnerable Adults.

T HE C HILDREN A CT 1989 (s47) obliges social services to make enquiries where there is
reasonable cause to suspect that a child is suffering, or is likely to suffer, significant harm and obliges
other agencies to assist with those enquiries, in particular by providing relevant information if they are
called upon to do so. See Unit 8 for more information on Safeguarding Children.

FGM A CT 2003, AS AMENDED BY THE S ERIOUS C RIME A CT 2015 Health professionals must
report to the police known cases of female genital mutilation of girls under the age of 18. This specific
statutory obligation does not apply to cases in women over the age of 18, or suspected FGM of girls
or women of any age. Professionals will follow existing safeguarding procedures in these cases and
may still have a justification (or even an obligation) for referring. See Unit 9 for more information on
FGM.

10
T HE A BORTION R EGULATIONS 1991 (E NGLAND AND W ALES ): A doctor who has carried out a
termination of pregnancy must notify the appropriate chief medical officer of that fact within seven
days of the termination. See Unit 9 for more information on the regulation of termination of
pregnancy.

Public Interest Justification

One of the reasons why we treat the duty of confidentiality so seriously is that, quite apart of the
effects of breach of confidentiality on the individual concerned, the public has an interest in knowing
that doctors can be trusted not to disclose personal information. However, this public interest must be
weighed against the public interest in being protected from preventable harm and serious crime. It is
this balancing act which gives rise to the ‘public interest justification’ for breaching confidentiality.

GMC guidance states:

Disclosures in the public interest may be justified when:

 failure to disclose information may put someone other than the patient at risk of death
or serious harm (you should not usually disclose information against the wishes of an
adult patient who has capacity if they are the only person at risk of harm)
 disclosure is likely to help in the prevention, detection or prosecution of a serious
crime.

Before relying on the public interest justification, you must be sure that the harm that you are trying to
prevent is serious (in this context, serious crime is usually crime that involves significant risk to
someone), that the person at risk is someone other than the patient, that the disclosure of confidential
information is necessary (in other words, the harm cannot be prevented without breaching
confidentiality), that you cannot obtain the consent of the patient and that you are disclosing the
minimum amount of confidential information needed to achieve your aim.

Where practical, get advice (from a senior colleague or your defence organisation) before you make
the disclosure. Make a careful record of what you have disclosed, to whom you have disclosed it, and
what your reasons for disclosure were.

GMC Confidentiality flowchart (the paragraphs referred to indicate the relevant sections of GMC
guidance:

11
12
Part 5: Privacy & the General Data Protection Regulations
Article 8 of the European Convention on Human Rights guarantees respect for private and family life.

We will look at the implications of Article 8 in more detail later in the course (CEL 10). For now, you
should be aware that States are required to have a legal framework defining who shall have access to
the information held about individuals, and an independent authority that can decide whether the
individual to whom the file applies should be granted access.

In the UK, the European General Data Protection Regulations (GDPR), which came into force in
2018, govern the way that personal information about individuals is collected, stored and shared.
Under the GDPR, there are six principles. Personal data must be processed (i.e. collected, stored and
used) following these principles so that the data are:

1. Processed fairly, lawfully and transparently - and only if there is a valid 'legal basis' for doing so
2. Processed only for specified, explicit and legitimate purposes
3. Adequate, relevant and limited
4. Accurate (and rectified if inaccurate)
5. Not kept for longer than necessary
6. Processed securely - to preserve the confidentiality, integrity and availability of the personal data

As a junior doctor you need to follow local guidance and keep in mind the fundamental principles:

 Only collect information that you need for a specific purpose, only hold as much as you need,
and only for as long as you need it.
 Ensure it is relevant and up to date.
 Keep it secure.
Reasonable measures that you should take to protect the security of data include:
 Don’t leave patient notes lying around where anyone can see them
 Shred all confidential paper waste
 Keep your password and login details for electronic patient records secure, and don’t let other
people use them.
 Encrypt any personal information held electronically that would cause damage or distress if it
were lost or stolen.
 If you send a sensitive email from a secure server to an insecure recipient, security will be
threatened. You may need to check that the recipients arrangements are secure enough before
sending your message.
 Don’t use instant messaging services to communicate patient information. The business
model of consumer messengers like WhatsApp is designed to make it as easy as possible for
their users to backup and share their media over their phone and with other apps. This is
contrary to how healthcare professionals must handle patient information. Furthermore, there
is no formal arrangement between users and messaging services such as WhatsApp in respect
of processing and storing of any patient information which is a fundamental requirement
under GDPR.

13
Under the GDPR, our patients have rights concerning the way we collect, store and use information
about them. Four of the most important rights for doctors to be aware of are:

The right to be informed – you must provide concise, transparent, intelligible and easily accessible
information to inform patients about the way you will collect, process and use data about them (e.g. a
Privacy Notice or Privacy Statement – you will often find these on noticeboards and websites of
hospitals and GP surgeries).

The right of access – if a patient wishes to see the data relating to them (personal data) that you have
in your records, you must comply within one month of their request, unless the request is ‘manifestly
unfounded or excessive’. This is known as a Data Subject Access Request. Before complying, you
must review the records to ensure there is no information relating to a 3 rd party to whom you owe a
duty of confidentiality and no information that would be likely to cause serious harm to the patient.
Any information falling into these two categories should be redacted (so that it cannot be read) from
the copy of the records provided to the patient.

The right to rectification – if the data in your records is found to be inaccurate or incomplete, your
patient may request to have this rectified and you must comply within one month (this can be
extended to two months where the request is complex)

The right to be forgotten – people have the right for personal data to be erased when it is no longer
necessary for the purpose for which it was collected, or if they object to its storage and processing
(provided there are no overriding legitimate interests to keeping the data). You can refuse to erase
personal data under certain circumstances, including where it is processed to comply with a legal
obligation or for the performance of a task of public interest; for the exercise or defence of legal
claims; or for purposes relating to public health, archiving in the public interest, scientific/historic
research or statistics.

Part 6. Digital hygeine

All of the principles of trustworthiness, confidentiality and privacy discussed in this unit apply
equally to on-line and real-life communication. Cambridge medical students have developed an
interactive e-learning module on digital hygiene to help you to use social media safely and
professionally. Please find the time to work through this resource, which will be available via MedEd.

Appendix A. Concerns about fitness to drive

14
All drivers are legally obliged to inform the Driver & Vehicle Licensing Agency (DVLA) if they have
an ongoing injury or illness that would have a likely impact on their ability to drive safely. The DVLA
advises doctors that they should:
 Advise the individual on the impact of their medical condition for safe driving ability.
 Advise the individual on their legal requirement to notify the DVLA of any relevant
condition.
 Treat, manage and monitor the individual’s condition with ongoing consideration of their
fitness to drive.
 Notify the DVLA when fitness to drive requires notification but an individual cannot or will
not notify the DVLA themselves.

Circumstances may arise in which a person cannot or will not notify the DVLA. It may be necessary
for a doctor, optometrist or other healthcare professional to consider notifying the DVLA under such
circumstances if there is concern for road safety, which would be for both the individual and the wider
public.

The General Medical Council and The College of Optometrists offer clear guidance about notifying
the DVLA when the person cannot or will not exercise their own legal duty to do so. The GMC
guidelines state:

1. The driver is legally responsible for informing the DVLA about such a condition or treatment.
However, if a patient has such a condition, you should explain to the patient:
a) That the condition may affect their ability to drive (if the patient is incapable of understanding this
advice, for example because of dementia, you should inform the DVLA immediately) and,
b) That they have a legal duty to inform the DVLA about the condition.

2. If a patient refuses to accept the diagnosis, or the effect of the condition on their ability to drive,
you can suggest that they seek a second opinion, and help arrange for them to do so. You should
advise the patient not to drive in the meantime.

3. If a patient continues to drive when they may not be fit to do so, you should make every reasonable
effort to persuade them to stop. As long as the patient agrees, you may discuss your concerns with
their relatives, friends or carers.

4. If you do not manage to persuade the patient to stop driving, or you discover that they are
continuing to drive against your advice, you should contact the DVLA immediately and disclose any
relevant medical information, in confidence, to the medical adviser.

5. Before contacting the DVLA, you should try to inform the patient of your decision to disclose
personal information. You should also inform the patient in writing once you have done so.

15
Appendix B. Disclosure of patient information for medical education
For most education and training uses, anonymised information will be sufficient and must be used
whenever practicable. If it is necessary to use identifiable information about a patient, or it is not
practicable to anonymise information, you should usually ask for the patient’s explicit consent before
disclosing it to anyone who is not part of the team that is providing or supporting the patient’s direct
care. You should make sure that the patient is under no pressure to consent. In particular, you should
avoid any impression that their care depends on giving consent.

Most patients understand and accept that the education and training of medical students, doctors in
training and other healthcare students and doctors in training relies on them having access to
information about patients. If doctors in training or medical or healthcare students are part of the team
providing or supporting a patient’s direct care,3 they can have access to the patient’s personal
information, just as other team members do, unless the patient objects.

If the doctor or student is not providing or supporting the patient’s care, anonymised information
should be used for education and training purposes whenever practicable. This may not be achievable,
for example, on ward rounds, but it will then usually be possible to seek the patient’s explicit consent
to disclosure.

In some cases it might be necessary to disclose personal information, or it might not be practicable to
anonymise it or to ask for a patient’s consent. In such cases you may disclose relevant personal
information to medical students, doctors in training and other healthcare students and trainees, as long
as you are satisfied that information has been made readily available to the patient about the
disclosure and of their right to object, and they have not objected. You must also be satisfied that they
understand that the information is given in confidence, which they must respect.

You should not disclose personal information for education and training purposes about patients who
lack capacity if you can use information about other patients instead.

If you wish to disclose personal information about a patient who currently lacks capacity (for
example, because they are acutely unwell), but who is likely to regain capacity, you should wait and
ask for their consent later if you can.

If you are asked, or want, to disclose information about a patient who lacks capacity, you should seek
the views of anyone the patient asks you to consult, or who has legal authority to make decisions on
their behalf,5 or who has a close personal relationship with the patient. They may be able to give you
an indication of the patient’s previously expressed preferences, views and beliefs.

In the absence of any indication about the preferences of a patient who lacks capacity, you should not
publish information that could identify that patient. In exceptional cases, however, you may disclose
relevant personal information to medical students, doctors in training and other healthcare students
and trainees if it is necessary for their education and training. You must be satisfied there is no
reasonably practicable alternative to using personal information, and you should have no reason to
believe that it is contrary to the interests of the patient to do so.

16
Appendix C. Reporting gunshot and knife wounds
The police are responsible for assessing the risk posed by a member of the public who is armed with,
and has used, a gun or knife in a violent attack. They need to consider:

 the risk of a further attack on the patient

 the risk to staff, patients and visitors in the emergency department or hospital

 the risk of another attack near to, or at, the site of the original incident.

The police also need statistical information about the number of gunshot and knife injuries, and when
and where they occur, to inform their own and their crime reduction partners’ operational and
strategic priorities.

For these reasons, the police should usually be informed whenever a person presents with a gunshot
wound. Even accidental shootings involving lawfully held guns raise serious issues for the police
about, for example, firearms licensing. The police should also usually be informed when a person
presents with a wound from an attack with a knife, blade or other sharp instrument.

The police should not usually be informed if a knife or blade injury appears to be accidental, or a
result of self-harm. There may also be other circumstances in which you consider that contacting the
police is not proportionate. For example, this might be the case if you consider that no one other than
the patient is at risk of harm, and that contacting the police might cause the patient harm or distress, or
might damage their trust in you or in doctors generally. If you are in doubt about the cause of an
injury, you should if possible consult an experienced colleague.

Making the report

If you are responsible for the patient, you should make sure that the police are contacted where
appropriate, but you can delegate this task to another member of staff. Personal information, such as
the patient’s name and address, should not usually be disclosed in the initial contact with the police.
The police will respond even if the patient’s identity is not disclosed.

Make the care of the patient your first concern

When the police arrive, you should not allow them access to the patient if this will delay or hamper
treatment or compromise the patient’s recovery.

If the patient’s treatment and condition allow them to speak to the police, you or another member of
the healthcare team should ask the patient whether they are willing to do so. If they are not, you, the
rest of the healthcare team, and the police must abide by the patient’s decision.

Disclosing personal information without consent

If it is probable that a crime has been committed, the police will ask for more information. In this
situation, the public interest principles outlined in this unit apply.

17