Credit: ©iStockphoto/Thinkstock

Patient information should only be disclosed to other people with the patient's consent or if there are legally permitted circumstances, and there can be quite a few circumstances that justify the disclosure of information. You need to be aware of when these could apply in your dental practice.

The Data Protection Act protects the confidentiality of sensitive personal data. For patients, this includes information on their physical or mental health. Dentists must not disclose information to a third party, apart from in the specific circumstances outlined in the Act. Generally, patients should understand that their data will be discussed with other dental professionals and administrative staff within the practice but this should only be as far as is necessary and only in accordance with the provision of care to that patient. Similarly, NHS officials or NHS administrative staff will need some data so they can process payments. By seeking treatment, patients are in effect agreeing to these necessary disclosures, but make this clear to them when you collect their details and in your practice's data protection policy.

In a limited number of clinical circumstances, disclosure of information may be made to the appropriate authorities without the need for a patient's consent. Key circumstances include: if you suspect abuse of a child or vulnerable adult; if there are risks to the health and safety of others; where a patient's health and safety are at risk; or for certain infectious diseases. A number of other more routine circumstances can also arise: research, legal proceedings, police enquiries, statutory obligations, missing or deceased persons, and tax enquiries.

Health research

Dentists should consider carefully any request to disclose personal data about patients for the purpose of health research. Where information is unmistakably anonymised by the dentist or, more likely, collected by an accredited research organisation in a way to ensure individual patients cannot be identified, then there is no requirement to obtain additional patient consent. But when patient data is provided to researchers in a form where personal information is included then specific patient consent must always be obtained.

The distinction between identifiable and non-identifiable data type is critical and there is now a presumption that information will generally be provided to reputable research organisations where individual patients cannot be identified. The data should not be traceable to an individual. Personal details should obviously be removed but data should be released only in groups large enough so patients cannot be identified on the basis of factors such as, for example, locality, age range and rare condition.

In all cases, the researchers involved will still need to obtain specific ethical approval to examine the data and this consent will only cover a specific research project. There may be some instances where data that contain identifiable information to allow linkage to other healthcare records is collected. Only specific recognised organisations, like the Health and Social Care Information Centre (HSCIC) and Clinical Research Practice Datalink (CPRD), would be able to collect this type of data.

Access to linked patient records would only ever be provided by them to researchers in a completely anonymised form.

Legal proceedings

Personal information may have to be disclosed during legal proceedings. The overriding interests of justice generally require that all relevant information is made available to all parties (and potentially the court) so that a fair and transparent outcome can be reached.

Dentists may be on the receiving end of claims (from patients, suppliers or employment tribunal proceedings by staff) and some of your records could be important to the case. If a patient has been unhappy with the treatment provided and is seeking to bring a claim against a dentist then the patient's solicitor may ask for copies of records and treatment plans. You should ask for a signed consent form by the patient to say such information can be released to the patient's representative, although their solicitor would normally provide their client's written consent.

On the other hand, you may need to rely on patient records to prove your defence to their claim. They may say that the records are inadmissible and here the judge would have to balance their rights to confidentiality against the interests of justice in having all information available for assessing the case. Similarly, staff records could be used in employment tribunal claims. Where a dentist pursues a patient for non-payment of an account through the courts the records of the treatment done would be relevant.

Police enquiries

The police can be insistent when asking for information. They will understandably be concerned to progress an investigation. You must, however, maintain a degree of perspective and weigh up your obligations to your patients. You must consider the seriousness of the crime and potential danger to the public if the information is not disclosed. Is it likely that the suspect will cause serious injury to another person? While having a duty of confidentiality to the patient, dental professionals also have a duty to society and this may, in certain circumstances, outweigh the duty to the patient.

Generally, if the crime is less serious or the matter is non-urgent, dental professionals should ask the police to produce a court order. This is not being obstructive. Explain the obligations you are under. The police officer should know the procedure for getting one. It could be in the interests of the police enquiry to obtain information in the proper way because a future defendant could ask the court to rule evidence obtained incorrectly as inadmissible.

Statutory obligations

A couple of laws make it compulsory to disclose information to the police. You have to provide the name and address of the driver involved in a road traffic collision and incidents have arisen where patients have been involved in crashes driving to or from the practice, although there will obviously be no need to disclose any clinical information in these situations. You may think further information about the patient, say from their medical history form, is relevant but you should not disclose this information unless formally requested as part of the police investigation, as discussed above.

Potentially the most serious situation concerns acts of terrorism: sometimes the public interest outweighs the breach of confidentiality. The Terrorism Act 2005 imposes the duty that anyone who has information about a planned or actual terrorist act must inform the police.

Missing or deceased persons

Be cautious where a case involves a missing person. Here, it is likely the police will be seeking information about a person's movements. If the individual is still alive, it is not an offence to go missing so you do not need to provide such information. But where foul play is suspected or the individual may be at imminent risk, you should disclose information to the police.

If there is the discovery of a body, dentists may be asked for patient records, including relevant charts, models or other information to help with identifying the body. The police or the coroner should make a formal request for details to be handed over for identification purposes. You should comply with these requests promptly, although you should reassure yourself that there are reasonable grounds to believe that the body is the patient in question.

Tax enquiries

Her Majesty's Revenue and Customs (HMRC) tax inspectors may, at some point in your career, investigate your tax returns in detail. It is routine but as part of their inspection HMRC may ask for copies of appointment books, patient records and supporting documents. Patients' names should be blanked out or consent should be obtained from the patients where possible. If a tax inspector has reasonable grounds to suspect serious fraud they can require the dentist to produce the information if they have a statutory notice of inspection, in which case you must seek independent financial advice.

Employers and schools

Sometimes a fed-up employer may contact you because one of their employees has been taking time off for dental appointments and they want to check this is true. It is important for dentists not to get involved in a patient's workplace issues. Before disclosing any information the patient's consent should be obtained. If they were seeing you they will probably be happy for you to confirm this with their boss. The same principle applies if you are contacted by a school about a pupil's attendance.

Be sure

Releasing confidential information is always a heavy decision. So, as far as possible, only the information that is needed should be released. Remember that you may be required to defend any disclosure you make. Think it through carefully and where you have doubts make sure that you get advice from your protection society, a lawyer or (if your principal is an Extra or Expert member) BDA Practice Support.