The following case is fictitious but based on the types of calls we receive on the MDU advice line.

The scene

A consultant in emergency medicine received a written request from the police to disclose information about a female patient who had attended the emergency department.

The request was made under Schedule 2 Part 1 Paragraph 2 of the Data Protection Act 2018 and GDPR Article 6 (1) (d), and stated that the patient was a known victim of domestic violence who had told her family that she had "fallen down the stairs".

The police and her family believed that she had been assaulted by her husband. The police said the patient shouldn't be told about the request as this would prejudice their enquiry, which concerned 'the prevention and detection of crime' and the 'prosecution of offenders.'

The letter clarified that GDPR Article 6 (1) (d) provided a lawful basis for the disclosure of personal data to the police to 'protect the vital interests' of the patient.

The consultant was mindful of his duty of confidentiality and felt uneasy about disclosing the records without consent, but the letter appeared compelling. He had not received this sort of request before so decided to seek advice from the MDU.

MDU advice

The MDU adviser explained that the letter provided a reassurance that any disclosure made would be compliant with the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). The legislation would permit the disclosure if the records were released, but there was no obligation to provide the information.

The adviser agreed that the consultant was wise to exercise caution in considering a disclosure without consent, and discussed the GMC's guidance on confidentiality. The consultant and adviser agreed that the patient would have attended the hospital with the expectation that her records would be kept confidential, so making a disclosure without her knowledge and consent might lead to her feeling unable to seek medical attention in future.

The GMC guidance states that a disclosure without consent can be justified if that disclosure is necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person.

In this case it was the records of the victim that were being sought. The consultant and the MDU adviser discussed the fact that the police were already aware of the identity of the offender, so it wasn't clear how disclosing the victim's medical records was going to help. The disclosure needed to be balanced against the potential harm to the patient when she discovered her medical records had been disclosed without her consent.

The consultant was concerned that the police had indicated the patient could be at risk of serious harm. The MDU adviser agreed that her safety was potentially at risk, but noted that when considering victims of domestic violence, the GMC guidance states you should usually abide by a patient's refusal to consent to disclosure - even if their decision leaves them (but no one else) at risk of death or serious harm.

On the basis of the information provided, it appeared the patient had decided to continue living with her husband and was not helping the police in bringing any action against him.

The MDU adviser suggested that the decision on whether to disclose be shared with the trust Caldicott guardian and/or data protection officer. The final decision - and the reasons underpinning it - should be documented.

The outcome

Having discussed the issue with the MDU adviser, the consultant understood that he wasn't obliged to disclose the patient's information, and that this was a matter for his professional judgement - while being mindful of the GMC's guidance.

On balance, he felt the disclosure couldn't be justified without the patient's consent. He discussed the decision with the trust's Caldicott guardian, who supported the decision. He then responded to the police, explaining he wasn't able to give them the information without the patient's consent.