Freedom of Information – Disclosure of medical records

The case concerned Karen Davies, who died at Epsom General Hospital in 1988, aged 33. In 2003 it emerged that the hospital’s treatment had not been satisfactory, that it had admitted liability for her death and had reached a settlement with her widower, Richard Davies, on behalf of himself and the two children of the marriage, under which a substantial compensation payment had been made. Karen Davies’ mother, Pauline Buck, subsequently sought access to her daughter’s medical records to establish what had happened. The hospital refused to release them without the permission of her next of kin, Richard Davies, who refused permission.

Pauline Buck took her case to the Information Commissioner, who said that the information should not be released; she then appealed to the Information Tribunal, which has supported the Commission’s decision.

Freedom of Information Act 2000

This case confirmed that the medical records in question were not subject to the Data Protection act 1988 (DPA), which only covers information about living individuals. It agreed that Karen Davies’ medical records were exempt from disclosure under s.41 FOIA, which provides that public authorities may withhold information if its disclosure would constitute an actionable breach of confidence.

Section 41 provides that information is exempt information it was obtained by the public authority from any other person and the disclosure of the information to the public would constitute an actionable breach of confidence by that or any other person.

The parties did not dispute the fact that the medical records contain information obtained from a third person, namely Karen Davies. It was also agreed that the duty of confidence refers, on the facts of this case, to the equitable principle developed over many years, a point of law that must now be read in the context of the European Convention of Human Rights.

Duty of Confidence

The Tribunal was required to make a decision about whether the duty of confidentiality could survive a person’s death despite admitting that there was no case law or legal authority on which to base its decision. Despite the absence of any such authority, the Tribunal ruled that the duty of confidence must survive the death of a person to whom the information related.

“We agree with the Trust and the Information Commissioner that as a matter of principle, the basis of the duty in respect of private information lies in conscience,” said the ruling.

A witness in the proceedings from the General Medical Council confirmed that whilst the Council’s policy stated that there could be moral, ethical or professional duties compelling a doctor to maintain confidentiality after a patient’s death, there was no legal obligation to do so. It was heard that if the duty of confidence didn’t survive a patient it could undermine the relationship of trust between doctors and patients.

The Tribunal also ruled that should the information be disclosed otherwise than under the FOIA the personal representatives of the deceased could bring an action for breach of the duty, not for damages but for an injunction.

European Convention of Human Rights

In considering whether the public interest in disclosure outweighed that in maintaining confidence the European Convention of Human Rights was taken into account. The Tribunal held that the public interest did not outweigh that in maintaining confidence.

Although the Trust accepted that circumstances might arise where disclosure may be justified, including the need for public scrutiny of the activities of a public authority, in this case the factors in favour of disclosure are outweighed by the need to ensure that patients retain trust in the confidentiality of information they impart to doctors. The Tribunal accepted that it is frequently helpful for doctors to discuss the circumstances of a person’s death with his or her close relatives but believed that maintaining the confidentiality of the medical records will not impede the professional approach the doctors currently adopt in this area.

Comment

There is concern that if the courts adopt the definition of information belonging to a third party used in this case it could render most files held by organisations exempt from freedom of information legislation. If anything generated with information from somewhere else is exempt, the s.41 exemption will apply to more information belonging to an authority than was perhaps intended.

The Scottish Freedom of Information Act states “Information is exempt information if it constitutes … a deceased person’s health record" thus providing for cases such as Karen Davies’. Explicitly providing for this situation in statute would reduce any uncertainty that currently exists in England and Wales.