Key messages

• Where people have decision-making capacity under the MCA, doctors have no legal authority to make decisions on their behalf.
• Patients should be able to expect that the information they give about their health will be kept confidential.
• Whenever doctors seek to discuss confidential information about adults with capacity, they should consider in the first instance whether they can obtain consent.
• Information relating to adults with capacity should only be shared without consent where it is in the public interest or where there is other lawful authority such as a court order or statute.
• Adults with capacity have the right to make decisions about how they manage the risks to which they are exposed.
• Where healthcare professionals have serious concerns about whether an adult with capacity who is at risk is being coerced into a decision they should consider taking legal advice.
• Where adults lack capacity, decisions can lawfully be made on their behalf, based on an objective assessment of their best interests (benefit in Scotland).

The moral dilemma

Challenging situations can arise for healthcare professionals where adults who are subject to abuse do not want confidential information disclosed, even where this would be the best way to ensure they are protected from harm.

Decisions can be particularly difficult where adults retain capacity under the terms of the Mental Capacity Act (2005) (MCA) but healthcare professionals believe they are not making a free and informed choice as a result of pressure from, or fear of, the abuser among other possible reasons.

In such circumstances, doctors have no legal authority to make best interest decisions on their behalf, including decisions about the disclosure of confidential health information, and they can be uncertain how to proceed.

Doctors can also be genuinely concerned that, should they fail to disclose information necessary to protect adults at risk of harm, they may be subject to criticism.

We start from the basic position that adults with capacity are usually in the best position to understand how to promote their own interests and, ordinarily, confidential patient information should not be disclosed without the consent of the patient.

Some exceptions to this are discussed below.

Adults at risk, confidentiality and the disclosure of information

Confidentiality is essential to the development of a trusting professional relationship between doctors and patients. It is subject to both legal and ethical safeguards and inappropriate breaches of confidentiality can lead to legal action and to censure by the General Medical Council. Patients should be able to expect that the information they give about their health will be kept confidential.

Although the duty of confidentiality is owed to all patients, it is clearly important to people who may be at risk of harm. If people subject to abuse do not feel they can trust their doctors to keep their confidences, they may be less likely to visit them. Vital opportunities to help and support them may therefore be lost.

This guidance stresses the legal and ethical requirement to respect the choices of adults with capacity. Victims of domestic abuse are frequently vulnerable, sometimes extremely so, even though they may retain the cognitive abilities to make decisions on their own behalf.

Where adults consider themselves to be at risk from those close to them, they may also be concerned that a disclosure of information may put them at greater risk. If an abusive partner is interviewed by the police or social services for example, abuse may be intensified. The importance of adults who may be at risk of harm being able to control the disclosure of their own information is therefore clear.

Consent and the disclosure of confidential information

The duty to keep patient information confidential is not absolute.

Most obviously, information can be disclosed where the patient consents to its disclosure. Wherever doctors or other healthcare professionals seek to disclose confidential information about adults with capacity they should consider in the first instance whether they can obtain consent. Ordinarily, where a patient with capacity refuses consent to disclosure this should be respected. This principle is reflected in GMC guidance on confidentiality which states at paragraph 59: 

‘You should, however, usually abide by the patient’s refusal to consent to disclosure, even if their decision leaves them (but no one else) at risk of death or serious harm.’

As we have seen though, competent adults can at times be put under external pressure to such an extent that decisions not to disclose information may not be entirely voluntary. If it is not possible to address this issue at the point of consultation, consideration should be given to seeking legal advice or input from adult safeguarding services.

Disclosure to the police, social services and partner organisations

Some legislation permits - although it does not require - the disclosure of confidential information in certain circumstances.

The UK General Data Protection Regulation, Data Protection Act 2018 and the Crime and Disorder Act 1998, for example, all permit disclosure of information to other organisations such as the police, local authorities, social services and government bodies.

If healthcare professionals are contacted by police, social services or their partner organisations and they are uncertain as to whether disclosure is a statutory requirement, they should ask the person or body applying for the information to specify the nature of their lawful authority.

In the absence of lawful authority, ordinarily, healthcare professionals should only disclose information where the patient has given consent or there is an overriding public interest in disclosure.

For police requests, some police forces may use a standardised form developed by the National Police Chiefs' Council when requesting information from healthcare organisations (the form will not be used where there is a court order). The police do not have to use this form, but its use may help make the process of dealing with police requests more straightforward for healthcare professionals by ensuring the right information is included in the request and that the request is proportionate. The form will specify whether consent has been obtained. All requests should be in writing and signed off by a senior officer. 

An example of a partner organisation is a Multi-Agency Risk Assessment Conference (MARAC). This is a meeting convened to discuss the highest risk domestic abuse cases in any given area with a view to creating a safety plan for each victim. MARACs operate in England, Wales and Northern Ireland. Information will usually be shared amongst a number of local agencies including health, police, housing and social services.

A disclosure in the public interest is likely to be justified where it is essential to prevent a serious and imminent risk to public health, national security, to protect other people from risks of serious harm or death, or to prevent or detect serious crime. Other people here may include, for example, children in the house who may be at risk of serious harm.

A public interest disclosure will only be justified where it is necessary and proportionate. Any healthcare professional disclosing information in these contexts must have a reasonable belief that it is likely to achieve the desired result and must only disclose as much information as is necessary to achieve it.

As part of the consent-seeking process, where an adult at risk is making a decision that is seriously at odds with an objective assessment of their interests, healthcare professionals should sensitively explore the reasons behind the decision. This could include exploration of the possibility of confidential referrals to groups or organisations that offer support to adults at risk.

It is only when the health professional has properly explored the patient's circumstances and the reasons behind the apparent refusal that they should consider some of the options discussed below. 

Public interest and the competent adult

We have seen that a refusal to disclose information by an adult with capacity can be overridden in order to protect a third party, such as a child who may be in the household, from a risk of serious harm. It becomes more difficult where an adult refuses to disclose information in order to protect themselves.

A refusal of disclosure by a patient should not result in them being abandoned by services. Care and support should continue to be offered.

Doctors can themselves feel vulnerable to future criticism where they have a genuine belief that a patient is at risk of harm but are uncertain whether, legally and ethically, they can disclose information. Discussion with colleagues, with medical defence bodies, and with the BMA and the GMC can all help doctors work through their concerns.

Doctors should make clear contemporaneous notes of the decision they make and the reasons behind it and should also make a note of any discussion with colleagues or supporting organisations.

In some circumstances healthcare professionals may seek to disclose information on the basis of the public interest in order to protect adults with capacity where they have a reasonable belief that the individual will be the victim of serious crime such as violent assault. Here a difficult balance will need to be found between respecting a patient's decision-making rights and an assessment of the likelihood of a serious crime being prevented by disclosure.

Although in the BMA's view disclosure here may be justified, healthcare professionals should keep in mind the difficulty of prosecuting a crime where the victim refuses to participate with the criminal justice system, as well as the impact of disclosure on the patient's trust in the profession.

Given the difficulties associated with preventing crime where the victim refuses to co-operate, disclosure of information without consent in these circumstances is likely to be exceptional. This is likely to be where there is strong evidence of a clear and imminent risk of a serious crime likely to result in serious harm to the individual, and the disclosure of information is likely to prevent it.

Any healthcare professional considering disclosure in these circumstances should take advice from appropriate professional, regulatory or medical defence bodies.

Adults at risk and jurisdiction of the High Court

We have seen that where patients retain capacity under the terms of the MCA, legally, decisions cannot be made on their behalf. In the past, healthcare professionals have expressed great frustration at not being able to intervene where patients are clearly at risk. Although healthcare professionals do not have lawful decision-making authority here, a court may have authority to intervene under its inherent jurisdiction. 

The court will not use its inherent jurisdiction to override a considered decision by an adult with capacity who may be at risk or vulnerable. Rather the court will intervene in order to ensure, as far as possible, that the individual can make an informed decision unencumbered by external coercion.

Where healthcare professionals have serious concerns about whether an adult who is at risk but has capacity is being coerced into a decision, including a decision not to disclose information when it would clearly be in their objective interests to do so, they should consider seeking legal advice.

Adults who lack the capacity to consent or disclose information

In the absence of a legal requirement, where adults lack the capacity to make a decision about whether or not to disclose information relating to harm or abuse, decisions need to be made on their behalf. Healthcare professionals can make a decision based upon an assessment of the individual’s best interests (benefit in Scotland).

When considering a disclosure of information, any assessment of best interests will ordinarily involve discussion with those close to the individual. However, care must be taken to ensure that anyone consulted who is close to the individual is in fact acting in the person’s interests. Healthcare professionals must disclose information to the appropriate authority where there is a belief that an adult lacking capacity is at risk of abuse or other serious harm, unless it is not in the overall best interests of the patient to do so.