Your medical records and confidentiality
In order to comply fully with the Data Protection Act 1998 (DPA98), we need to make sure that our patients are aware of how we handle their medical records, both as paper files and electronic databases.
Please read the rest of this leaflet in order better to understand how we use medical information.
Medical Files
Doctors need to keep notes about any diagnoses, test results, treatments, including drugs prescriptions, etc. to provide better healthcare in the future, and also in case of legal dispute.
These notes are usually paper files, stored in a records room, but are now often held as electronic records, which are more flexible and easily found, but raise new issues of security and confidentiality.
Nurses and other health professionals may also need access to these records, and will add their own notes as part of the overall healthcare provision. Secretaries, receptionists, and other clerical staff will need access to some of the records in order to do administrative tasks, such as: booking appointments and communicating with patients and other parts of the NHS. Many patients would not be aware of this.
We provide information by law (e.g. the Communicable Diseases Act I978 - to prevent the outbreak of certain highly contagious diseases) to protect patients and the public at large.
How we protect the information
The sensitivity of patient information should be well understood within the NHS. All staff and contractors are trained to understand their duty of confidentiality to patients, and have this written in their contracts.
We keep paper and electronic records securely to prevent unauthorised access or misuse.
Wherever practicable, we also remove references to personal details such as name and address, and often restrict it further to reduce the chances of anyone identifying a record as relating to an individual.
Staff Relatives and Friends
We have the ability to limit access to individual medical records. This means that the doctor can only access your medical information. Please discuss this with the doctor.
Activity and Accounting information
In order to manage the NHS, information concerning treatments, drugs prescribed, numbers of patients seen, etc. is needed, and hospitals and general practices provide this information in returns to various central bodies.
Such information normally has personal details such as name and address removed wherever possible.
These returns are checked against patient files to prevent fraud as part of the NHS's statutory obligations. NHS Fraud Office will contact patients to get their consent before records are checked.
Planning
We need to be able to plan ahead about treatments patient numbers, etc., but this uses summary information, not personal information.
Medical research
Some medical research will involve patients directly (especially if taking part in clinical trials) when the circumstances will be fully explained, and the patent's express consent required. If they do not consent, then they will not he included in the trial.
Other research only requires access to medical statistics, and can greatly improve our understanding of health, and how to treat patents more effectively.
Generally, researchers only need information about groups of people, so that no individual information is apparent. In some cases, they need individual records, but wherever possible these are provided in an 'anonymised' form (so individuals cannot be identified).
If researchers need access to individual medical files, then we will contact patents first for their consent (and before this the researchers must present their case before an Ethics Committee to check that their research is appropriate and worthwhile).
Rarely, it may not be practicable (or even possible) to contact individuals for their consent, in which case the researchers must make their case before a Confidentiality Committee to show that there is enough benefit to the public at large to justify this.
Teaching
Some medical files are needed to teach student clinicians about rare cases.
Managing the data
We need to move electronic information between systems, extracting the data and modifying it for the next system.
Occasionally, tests will need to be made on the data to check that it has been transferred correctly. This will only be done under carefully controlled confidentiality.
Other Agencies
The NHS is not the only government service to provide care, e.g. Social Services, and it will be necessary for us to provide other agencies with appropriate information, but only with patients' express consent (or that of their relatives if the patent is too ill).
Reference: Donovan C, Hadley A, Jones M, Martin J, Mawer C, McPherson A, Romano-Critchley G. Confidentiality and Young People. Royal College of General Practitioners and Brook. London. 2000