17 May 2017
The Right Stuff:
Information, Privacy and the Ethics of Disclosure
Professor Gwen Adshead
In my last lecture, I set out some basic ideas about how people make moral decisions; decisions that involve issues of value and emotional importance, that cannot be reduced to logical analysis. I applied these ideas to medicine and medical ethics, and wondered how we might teach the doctors of the future to make good quality decisions that involve personal values and identities. In this talk, I want to apply some of these ideas to handling personal information in medical practice, and the ways that we think about personal data sharing.
Traditions in Medicine: Back to Hippocrates
As many will know, the Hippocratic corpus contains one of the earliest accounts of the doctor’s duty of care for their patient’s confidentiality:
“.. whatsoever I shall see or hear in the course of my profession, as well as outside my profession in my intercourse with men, if it be what should not be published abroad, I will never divulge, holding such things to be holy secrets”
This duty to keep secrets in medical care has been the subject of debate since first articulated (Ferguson, 2016). The duty of confidentiality has been described as ‘an intransigent and absolute obligation’ (Kottow, 1986); as a ‘fundamental tenant (sic) of the physician-patient relationship (Self, 2011); and as ‘a decrepit concept’ (Siegler, 1982). Moskop et al (2005) link confidentiality with privacy, defined as the right to be left alone; Saunders (2016) states that confidentiality ‘means restricting the circulation of information’. The Hippocratic passage itself implies a distinction between information that ‘should be published abroad’ and information that resembles a ‘holy secret’.
The justification for the duty of confidentiality is not set out in the Hippocratic Corpus. We are left to infer that the keeping of secrets is beneficial to the patient in some way, although it is not immediately clear how. One possibility is that disclosure of information about sickness may have had a negative impact on the value of slaves or women in the household; or (given that the heads of households owned their families) that people who were sick might be actually at risk from a brutal master if their illness was discovered. Unwanted or unanticipated pregnancies might have considerable social impact in terms of a woman’s value in terms of marriageability. Some diagnoses, like leprosy, might be particularly stigmatising in society; one thinks here of the modern equivalent of the discovery of HIV and the effect of AIDs on communities in different countries.
Ferguson (2016) describes the history of the debates about confidentiality in medicine; and comments on the tension between duties to individual patients and the duty to public health and communities. This tension grew in the nineteenth centuries with greater attention to infection control and the prevention of communicable diseases like venereal disease. Ferguson reviews the role of the law in both protecting and undermining medical privilege in relation to information obtained in a therapeutic context; and observes that most doctors accept that the duty to preserve confidences should yield to the duty to support the process of law.
The key arguments in favour of confidentiality rely on the value of trust and transparency in medical consultations. Many diseases involve body parts or function which are thought of as unclean or shameful, and the medical consultation is one transaction where normal social rules about shame do not apply. If people know that doctors will keep their private vulnerabilities to themselves, then they may feel confident (that same word!) to share important information with the doctor, and such sharing is vital for the clinical process to be accurate and function properly.
The establishment of trust is also crucial in those situations where there are significant discrepancies of power and mutuality of need. The doctor has specialist knowledge that the patient does not; the patient takes a risk to expose their vulnerabilities, both physical and mental with a person who then has the power to exploit that vulnerability. Someone who is suffering and seeks care must put themselves in some degree of vulnerability, vis-à-vis the doctor, but this process is eased and enabled by a relationship of trust that the doctor will not exploit any vulnerability or private knowledge for personal gain. Establishing a professional duty to keep secrets might control any tendency to exploit others in unscrupulous doctors; it might also control a very human tendency to tell stories and gossip about the people they have seen. In small communities, such stories are currency which has emotional heft; gossip can cause real damage and distress in a short time and a duty to keep secrets helps limit the risk of this.
The duty of medical confidentiality has endured down the centuries and it is one of the few ethical principles that nearly everyone is aware of. It is often used as a key plot point in many novels and dramas, and it is an ethical duty that marks doctors out, along with lawyers and priests. However, modern approaches to information management have challenged and changed traditional ways of thinking about confidentiality.
Information as a Commodity
In the late twentieth and early twenty first centuries, there has been a massive change in the ways that communities think about personal information. The development of the internet and social media means that personal information can be shared instantly in a variety of ways with others; but can also be misused in different ways, criminal and non-criminal.
In response, there have been legal developments that have sought to characterise personal information as a possession, over which individuals have a right of control. For example, Article 8 of the European Convention on Human Rights provides for a right to a private life, which includes a right to control personal information about oneself. In Campbell vs MGN Ltd, the court found that disclosure of private medical records was a violation of Article 8 because medical information is part of a person’s private identity, which is owned by that person.
Information as a personal possession has become a key feature of information governance and the exercise of the Data Protection Act, which regulates how personal information is shared and stored. We each of us ‘own’ our data about ourselves, and this cannot be shared without our consent. Hospitals and GP clinics secure this data on our behalf; and they are bound to keep it safe and not disclose it without our express consent. We can access this data on demand; although we may not automatically access third party data about other people, even if it is on our record.
Information has become a commodity to be traded and sold, and it can have commercial value in its own right, not just personal value to its owner. For example, the UK government recently sought to get access (without express consent) to all patient data held by GPs to use for research and service planning purposes. Although there was support for the use of unidentifiable data for research purposes, there was considerable opposition to the plan when it became known that the government intended to charge those services and groups who wanted to use the data.
Challenges to Confidentiality: Risk and Risk Management
Debates about the limits of confidentiality have become more vigorous and more nuanced as public health has developed as a specialty, and as medical services operate in communities, and not just as private transactions. The first and most obvious challenge is when the doctor learns something in the medical consultation that suggests that the patient’s condition could put other people at risk of physical harm. The risk of harm may be uncertain, indirect and unintended (such as contagion) and the inference is that the patient is an unwitting source of risk to others. Ideally, the doctor explains to the patient that others might be at risk and seeks permission to let those others know so they can be kept safe; and ideally the patient says ‘Of course, I understand they need to know: will you tell them or shall I?’ The doctor and patient arrange what information is to be shared and how; the patient and/or doctor is kept abreast of all discussions; the risk to others is reduced; and all is well.
But as will be obvious, the discussions do not always go this way. People may decide that they do not want to share information even if it would reduce risk to others; and they may expressly forbid doctors to share the information. The patient continues to present a risk to others; yet the public has no apparent claim on that information, even though the risk materially affects them. The doctor must manage an anxiety about the knowledge about risk of harm to others, and an anxiety about the patient’s attitude to risk sharing; so that the duty to respect patient confidentiality leads to an anxiety about how to deal with a real clash of values in the domains of professional and public interests and duties.
In the 1980s, in response to the concerns about the impact of HIV and AIDs on the community, the GMC issued guidance to doctors, stating that they could disclose patient information to other identified individuals who might be at risk, even in the face of a flat refusal by the patient; if that disclosure would reduce the risk of harm to that individual. The ethical argument appears to be a trumping of one value over another; the value of reducing risk of harm outweighs the value of preserving confidential information. But I wonder if the GMC was also expressing a position about respect for human dignity and compassion by suggesting that doctors are not obligated to respect a decision which is unreasonable insofar as it costs little to the individual, but is high cost to others in terms of risk of harm, and deception by omission.
This example echoes Judith Jarvis Thompson’s defence of abortion (1976); in which she famously makes an analogy between pregnancy and a thought experiment about body sharing. In the experiment, she imagines the experience of a person who wakes up one day to find they are in hospital, and that a famous and valuable violinist is sharing their kidneys via a dialysis machine. The hospital authorities explain that the arrangement will only be for a few months, but without it, the violinist will die. Jarvis Thompson suggests that arguments against abortion force pregnant women to be Good Samaritans, especially where the pregnancy is unplanned or the result of coercion. However, she does suggest that there may be a duty to be a Minimally Helpful Samaritan; and a refusal to be minimally helpful to others may be seen as morally unacceptable i.e. if you can help someone with little cost to yourself, then you should do so.
This argument resembles the one advanced above in relation to refusal to disclose information that might reduce risk to others. If disclosure of personal information has little personal cost to the individual patient but might preserve another person’s wellbeing, then refusal to disclose seems unreasonable. On this argument, the duty to respect confidences needs to give way to the duty to be a Minimally Helpful Samaritan.
Jarvis Thompson’s example describes a common situation in medicine which challenges the traditional concept of the therapeutic consultation as purely a relationship between two parties, the doctor and the patient. It is rare for medical consultations not to involve the patient’s wider circle of relationships. In practice, many (if not most) medical consultations involve thinking about the matrix of relationships in which people live and function. Those who work in obstetrics must address a context where two people’s lives are bound up together in a complex and on-going way; those who work in paediatrics or old age medicine must consider the other adults on whom the index patient depends for their wellbeing and flourishing. I want now to consider the dilemmas that arise when therapeutic consultations make doctors aware that another person in the patient’s social circle is at risk from them.
Clear and Present Danger: Direct Risk of Harm
What should a doctor do if a patient discloses to them that they want to harm another person; or are acting in ways that are harmful to others? Traditional accounts of confidentiality suggest that doctors cannot disclose it to anyone; unless they have the patient’s consent to do so. If the patient refuses to disclose, then the doctor must engage in ethical reflection about what to do for the best; while aware that in these situations there may be no single or obvious ‘good’ outcome.
Making a decision here is complex because there is often real uncertainty about the nature of the risk; and the uncertainty itself makes people anxious; and when people are anxious they do not make good decisions. The statement ‘He has threatened to harm X’ is one that can be understood and interpreted in different ways depending on the context and the way the content is communicated. I am often asked to see young men who describe having violent thoughts and images in their minds; and who have been seen with weapons or behaving oddly. In one case, I heard the young man express anxiety about his thoughts and a wish not to harm anyone, and there was a rational explanation for his possession of a weapon: he was an apprentice chef. In another case, the young man was ex-military, he did not seem at all concerned about his thoughts, and he had no explanation for why he was wandering near his mother’s house with a knife. It may seem blindingly obvious, but context and meaning are crucial here in terms of talking to a person about risk and disclosure of risk.
This issue was legally addressed in the USA in a case involving a girl called Tatiana Tarasoff, who was a student at Berkeley. She had a brief relationship with a young student from India, called Mr Poddar; but she broke it off when she realised that he had fallen deeply in love with her. Mr Poddar began to stalk Miss Tarasoff; he also fell into a deep depression and went for therapy to the University counselling service. There he told the therapist that he wanted to kill Miss Tarasoff if she would not reciprocate his love. He then dropped out of therapy; and the counsellor contacted the campus police, sharing concerns about the risk Mr Poddar might pose to Miss Tarasoff. The police spoke to Mr Poddar, who denied any intent to harm Ms Tarasoff; which sadly turned out not be true when he stabbed and shot her three weeks later. He was found not guilty by reason of insanity and returned to his native country after some time as a patient in a secure hospital in the USA.
Ms Tarasoff’s parents sued the University, saying that it had a duty of care to their daughter which was breached by failing to disclose to her the risk she faced from Mr Poddar. The California Supreme Court heard the case twice because the issue was so important. The question before them was whether the duty to prevent harm to others outweighed the public interest in preserving the duty to protect medical confidences. The answer was a qualified yes: a health care professional who came to know of a risk to an identifiable person acquired a duty of care to them by that knowledge. Failure to warn or take steps to protect that identifiable victim would constitute a negligence in law, and damages. As one of the judges put it, ‘the protective privilege stops where the public peril begins’.
Health care professionals and therapists of all kinds were made very anxious by the Tarasoff ruling; perceiving accurately that it undermined any claim that the duty to preserve confidences was an absolute ethical rule. Doctors and therapists could no longer claim a privilege to keep dangerous secrets; they would have to consider whether they had a duty to disclose information, perhaps without the consent of the patient. The NHS code of confidentiality (2003) states that NHS employees have a duty to disclose information in the ‘detection, prevention and punishment of serious crime’; but does not discuss the ethical implications of the harms that might be caused by that disclosure, such as loss of liberty and detention without due legal process.
Although the Tarasoff case has no legal standing in the UK, there have been similar cases that have raised professional anxiety about the scope of the duty to warn and protect potential victims of violence. The English courts have been reluctant to impose a duty on medical professionals that might fundamentally change the nature of their work into more defensive practices. For example, in the case of Palmer vs Tees HA , a patient detained in a mental hospital disclosed that he had fantasies of harming children. He was later released into the community, and sadly went on to abduct and kill a child called Rosie Palmer. Her family sued the health authority, saying that they had a duty of care to Rosie which the authority had failed to meet; but the court found that there was no duty of care to unidentifiable classes of persons. This ruling implied that if there an identifiable person at risk, then there might be a duty of care to that person.
Another recent case at the Court of Appeal supports this view. The case involved a social worker called Ms Selwood who worked for a Local Authority in a child protection service and for a mental health trust in a community mental health team. A man (GB) whose child was being taken into care made threats towards Ms Selwood who was involved in the case; these threats were at least in part related to his mental illness, and he was detained in hospital for treatment; during which time, he made more threats to kill Ms Selwood, which were not shared with her. When GB was released, he attacked Ms Selwood, seriously harming her. The initial hearing found that the Local Authority and Trust had no duty of care to Ms Selwood; but the Court of Appeal reversed this finding . In judgement, they indicated that there was a strong argument in favour of both the Local Authority and the Trust having a duty of care towards Mrs Selwood; and that failure to warn her of the risk from GB could be seen as a breach of that duty.
It might be argued that the prevention of serious to others is a public good that doctors can support as consistent with the values of good medical practice generally. From a utilitarian perspective, reducing harm is a benefit that should be pursued; even if the disclosure causes some harm, it is justified if the benefit is significant and the harm is small. There are well argued points of view (Shepherd & Farrington 1995) that violence prevention is a reasonable public health goal for doctors, given the costs to the NHS of injuries inflicted, and the costs to the criminal justice system of dealing with violence.
Unfortunately, there is no good way of assessing whether information disclosure actually does prevent a harm to others. Nor is there a good way of assessing the harm caused by the disclosure is small. Consider the case of Mr A*, who killed his wife when he developed a psychotic depression. He was sent to a secure hospital where he spent twenty years having treatment. He makes good progress with medication and therapy; and is assessed as sufficiently well to leave the secure hospital and be rehabilitated back in the community. His risk to others is assessed as low; he has good insight and is remorseful about his offence. He wishes to return to the area where he used to live, and which would usually be clinically indicated as best for him to start rehabilitation.
Unfortunately, legislation that supports the rights of victims of crime required the hospital to inform Mr A’s adult children about the proposed plans for transfer. Mr A’s adult children violently opposed his move, claiming that they feared him still. They threatened to go to the press if he were returned to his local area, and even threatened to kill him if he is released into the community. Mr A was subsequently rehabilitated in another part of the country. In this case, the disclosure of information to others has caused harm to Mr A, in terms of distress and blocked rehabilitation plans; but did not prevent any serious harm to others.
The GMC state that the first duty of the doctor is to ‘make the welfare of my patient, my first concern.’ But it is hard to see how Mr A’s welfare has been anyone’s first concern. It appears that his welfare is less of an ethical priority than the feelings of his family. It is not that the family’s views are wrong or irrational; we can understand them and feel compassion for them. But it appears that concern for their views and experience trumps any concern for Mr A’s experience; and that furthermore, Mr A is expected to sacrifice some major goods to benefit his family. Using Jarvis Thompson’s example, Mr A is expected to be a Good Samaritan and make a sacrifice, perhaps because of the harm and wrong he did two decades ago. Yet in theory he has made reparation for that wrong by his deprivation of liberty; to extend that detention, or deprive him of what released prisoners are usually entitled to, is to treat Mr A unjustly. Treating people unjustly is both a harm and a wrong; and presumably incompatible with making the ‘care of my patient my first concern’.
The GMC has recently updated its guidance for doctors about how and when to disclose patient information in order to prevent harm to others; for example, there is guidance about the actions that doctors should take to prevent harm to a child, which not only includes disclosure of information, but making contact with social services. However, the guidance is silent about the how doctors should think about the harm they may cause by information sharing; the infliction of which may be entirely justifiable, but is nonetheless real and distressing. I am not suggesting that disclosure of patient information to prevent harm to others should not happen; in my own practice with ex-offenders, we make it clear from the start of our work together that violence/crime reduction is a valuable goal for everyone, and we will act to make that a priority. We ideally want to make that goal a joint venture between the patient, and all the parties involved in their care, and who are affected by their story. By doing so, we try to create with offenders a pro-social narrative in which all parties have a voice; and we can explore the potential clash of values between their needs and how others might view them.
The Extended Self: Relational Autonomy and Risk
So far, I have set out some rather dramatic examples of ethical tensions and emotional distress associated with information sharing. I want now to discuss more mundane but no less painful tensions which can arise when personal information is seen as a private commodity that needs to be secured at all costs; and when sharing health information is set up as a tense and competitive conflict between individuals and their rights.
The chief problem (as I see it) is that human relationships are built on trust that is based on information shared, received and considered. Information about me can be highly individual and personal, but may also be relational, and exists only because of the relationships that I have with others. For example, in my role as a parent, I have information about myself and my children that does not just ‘belong’ to me; it is shared as part of our family narrative. My identity as a parent is located in the history of my relationship with my children over time, and the same is true of other human relationships. Bereavement is a good example of a situation when one person’s identity is called into question by information about another’s change of identity by illness and then death.
As I described in my first talk, autonomy and choice about medical decisions may be located in a web of relationships that exist over time, especially for those who have long term conditions and dependency needs. In these circumstances, it makes little sense to think about information about a dependent person as being ‘property’ that must be jealously guarded against theft or exploitation. I am thinking here of elderly people who still have capacity but need help to articulate their medical experience, and want their adult children to assist them; but their adult children may be told that doctors or nurses cannot discuss their parents’ care needs ‘because of confidentiality’.
Even more concerning are those cases that involve young adults (over 16) who are autonomous agents for the purposes of medical consultations, but who have significant mental illnesses, like depression or eating disorders. Their claims to confidentiality are often seen to over-ride any claims that their families have to want to know about their welfare and assist them. It might be argued that the duty to preserve confidences protects vulnerable young adults from pressure from parents or adults who might be abusive or controlling; but protection from this situation also prevents young adults sometimes from getting support from their families, or deters medical professionals from letting families know how unwell the young adult is, and how fragile their well-being.
I do not wish to suggest that the medical duty to respect confidences be completely abandoned for older and younger adults; nor that people are not entitled to their privacy, especially at times when they are vulnerable and need help. What I am asking for is a more nuanced approach to information sharing, especially between people who are in close and enduring relationships. I am suggesting that personal information is not a precious commodity that is hoarded by doctors on behalf of people who seek help, but a medium of communication between people that has to be practically useful and personally meaningful.
I am aware that this argument is not likely to be favourably heard because of anxieties about identity theft and manipulation of data. But I am concerned that there is a type of rigidity to the management of medical information sharing that is not helpful to patients and does not reflect the realities of human interaction. Dame Fiona Caldicott’s most recent advice on information sharing (National Data Guardian 2016) encourages those who handle information to be more ready to share information in the sphere of health care; and as I have described above, there appears to be little privacy offered to any person who is suspected of posing a risk of violence to others. Threats of violence trump claims to privacy but claims of affection do not.
A perfect clinical example is the discussion of genetic risk in families. Dheensa et al (2017) discuss how health care professionals address dilemmas about what to do when people refuse to share information about their genetic conditions with other family members; despite knowing that the information may directly or indirectly affect those family members. In Dheensa’s study, professionals were reluctant to disclose in the face of a flat refusal because of concerns about interfering in complex family dynamics and causing distress.
It is of interest in light of my earlier arguments that this study seems to articulate a professional view that there is no obligation on professionals to make people behave well towards others; that they should respect even somewhat antisocial decisions; and that patients’ relatives might have ‘a right not to know’ information that might be distressing. Note that this approach is at odds with both Tarasoff and Palmer, in terms of identifiable victims; and seems to make a distinction between disclosure to prevent an action that causes harm, and failure to disclose an omission that causes harm. It is also noteworthy that the professional view appears to contrast with the views of patients interviewed in a similar study (Dheensa et al 2016); patient participants took a different view of their genetic risk, and saw the information as more relational, and not as their possession.
Risk and Relationships: A Contemporary Case
I want to end with a discussion of a legal case (ABC vs St George’s NHS Trust) that neatly exemplifies the issues raised above. The case is about to go to the Court of Appeal at time of writing; and may be heard by the time the lecture is given.
Mr B killed his wife when mentally ill and was sent to a secure psychiatric hospital for treatment. During his time in hospital, it emerged that he had Huntington’s disease, which is a severe brain disease that causes fatal dementia; and almost certainly contributed to Mr B’s actions in killing his wife. Huntington’s disease is a genetically dominant condition; if a person has the gene, they will get the disease, and their offspring have a 50: 50 chance of acquiring the gene and so developing the condition.
Mr B has a daughter, Ms C, who was recently pregnant. She came regularly to family therapy sessions with her father to discuss his offence and its impact on her. Mr B told his brother about his condition, but refused to allow doctors to disclose his condition to Ms C, saying that he was concerned that she might have an abortion. Ms C discovered the information about her father’s condition by accident; and she brought an action in negligence against the hospital, arguing that they had a duty of care towards her and that her right to a private life under Article 8 had been breached. Ms C has subsequently discovered she is positive for Huntington’s disease; she does not yet know if her little daughter has the gene.
At the original hearing, the judge found that there was no case to answer because the Trust had no duty to Ms C, only to her father, who was the patient. This decision is under Appeal; one argument being that Ms C was arguably a patient of the Trust insofar as she was attending family therapy with her father. But what I think this case exemplifies is the relational context of medical information, and the importance of thinking about confidentiality in terms of communication in relationships. It seems hard to argue that Mr B’s genetic status was irrelevant to his relationship with his daughter, and her future welfare; or that painful truths and honesty might be crucial to a therapeutic process that was looking at his offence and its impact. In allowing him to control his daughter’s future, it could be said that the medical team allowed him to sacrifice his daughter’s welfare to address his anxiety; in some ways, a replication of his original offence. Discussion of competing rights seems insufficiently nuanced for a tragedy of this order.
Space does not allow for discussion of the many other contemporary questions about privacy and confidentiality in medical practice. What I hope to have made a case for is a richer, more complex and more uncomfortable type of discussion that remain to be discussed; one that is ‘thicker’ (Geertz, 1994) and which reflects the ambiguities and uncertainties of human moral reasoning.
*The duty to preserve confidences requires me to state that the case of Mr A is fictitious but clinically accurate. There is an interesting debate to be had about the use of fictitious case material and/or the use of real unidentifiable details in fiction and creative writing; but space does not permit discussion of this here.
© Professor Gwen Adshead, 2017
ABC vs St George’s NHS Trust  EWHC 1394 QB
Campbell vs MGN Ltd  2AC 457
W. vs Egdell: CA  1 Ch 359  2WLR 471
Palmer vs Tees Health Authority  EWCA Civ 1533
Selwood vs Durham County Council; Tees Esk & Wear NHS Trust & North Tyneside NHS trust  EWCA Civ 971
Tarasoff vs Regents of the University of California