The following case is fictitious but based on the types of calls we receive to the MDU advice line.

The scene

The mother of a patient in his 20s emailed his GP, as her son had been experiencing mental health problems since moving to the area a year earlier.

The email explained that she was currently undergoing chemotherapy for breast cancer and so was unable to travel to see her son, but that based on recent conversations with him, she was worried he was having a recurrent psychotic episode. She said that she believed he had been arrested recently by the police but wasn't sure what kind of trouble he might be in.

The GP practice receptionist who received the email noted that the information seemed important and clinically relevant, and that it was provided by a third party and contained information about the mother as well as her son. The receptionist scanned the email onto the patient's record, ensuring that it was coded 'third-party information' and was hidden from online view, and then alerted the patient's usual GP.

The GP was concerned on reading the email, as he hadn't seen the patient for some months. After checking the records, it appeared the patient hadn't collected his repeat medication, so the GP called him to arrange an appointment.

During the consultation the patient initially insisted all was well, so the GP explained about the concerns raised by the mother's email and asked him directly if he had recently been in trouble with the police.

The patient was annoyed that his mother had contacted his GP, saying the police had been called to his flat by a neighbour after a loud argument with his girlfriend but that this had been resolved. The GP was content that there was no evidence of recurrent psychosis, and the patient accepted a repeat prescription for his usual medication. The patient also agreed to the GP arranging follow-up with his mental health care coordinator.

At the end of the consultation the patient asked for a copy of the email. The GP said he couldn't provide this and suggested he contact his mother directly and ask her for a copy. The patient somewhat reluctantly said he would 'consider his options.'

After the end of his session, the GP discussed the issue with his practice manager, as he had a feeling the patient was likely to make a more formal subject access request (SAR) for a copy of the email. The practice manager suggested the GP seek advice from the MDU.

MDU advice

The MDU adviser and the GP agreed that the patient might make an SAR for a copy of the email contained within his medical record. They also agreed that this contained third party information, so would usually be withheld unless the GP had consent from the mother to share it.

The difficulty was that the email contained sensitive personal information about the mother, and following the conversation with the patient, it appeared she had disclosed information about her son without his knowledge. While the mother hadn't indicated the GP ought not to share the content of the email with the patient, she hadn't given consent either.

The MDU adviser explained that difficulties like this often arise when relatives contact doctors with concerns about others. They often provide detailed sensitive information about their experience of a patient's health, but rarely give explicit consent for doctors to share this information with the patients concerned.

The adviser noted that where practicable, it was usually helpful to contact the relative, ideally before making any contact with the patient. This lets the doctor explain that to pursue the concerns effectively, they need to be able to be open and honest about what information has been given to them and by whom. Consent can then be sought from the relative to share the content of any communication. The adviser commented that in this situation, it is unusual for consent to be withheld.

The GP told the adviser that with the benefit of hindsight, he wished he had contacted the mother before speaking with the patient to explain the situation, and to seek her consent to share a copy of her email. He would now contact the mother and ask her consent to share it, either in full or in part and withholding the information about her own health. He would also be open and honest with the mother and explain to her that he had already let her son know who the information had come from and apologise if this has caused her any distress.

The adviser agreed with his approach, highlighting the importance of not disclosing any confidential information about the patient to the mother during any communication with her. They agreed that if an SAR was received in the absence of the mother's consent, then the GP should seek further advice from the MDU.

The adviser reflected on the fact that these situations were often challenging for GPs and practice managers, and reassured the member that he was always able to discuss individual cases with an MDU adviser if needed.

• The MDU also provides guidance on redacting third-party information from notes

The outcome

After discussing the case with the MDU adviser, the GP contacted the mother explaining that the patient had asked him for a copy of her email and asking her consent to share this with him. She replied, thanking him for his concern and providing consent to share the email in full, explaining that her son knew all about her cancer diagnosis.