Confidentiality and privacy: beyond legal duties

The cases and discussion in the article by Braunack-Mayer and Mulligan in this issue of the Journal (page 277)1 provide informative examples of legal and ethical dimensions of confidentiality and privacy in doctor–patient relationships. It is important to clarify the foundations and scope of both legal and ethical duties.

In law, information provided to a medical practitioner by a patient becomes subject to a statutory duty to protect the patient's privacy and a common-law duty of confidence owed by the medical practitioner to the patient.

Statutory duty. The statutory duty* varies according to whether federal or state legislation applies.† The federal Privacy Act 1988 applies to health information used by a private organisation and permits use or disclosure of such information without the patient's consent in a specified list of circumstances.2 Those that relate to the examples given by Braunack-Mayer and Mulligan are (a) disclosure for purposes directly related to the purpose of collection in ways that the patient would reasonably expect;3 and (b) disclosure that is reasonably believed to be necessary to prevent or lessen a serious and imminent threat to a person's life, health or safety.4 The scope of the statutory duty is not yet clear, as guidelines5 and public interest determinations6 issued by the Federal Privacy Commissioner indicate.

Common-law duty. The common-law duty arises from a contract between patient and doctor or the presumption that the relationship is one of a class to which the law attaches that obligation. The duty is said to encourage patients to disclose full information so that medical practitioners can provide effective healthcare, a basis for a public interest in such duties of confidence.7 Correctly understood, it is not a duty to keep all information secret, but a duty to use the information only for the purposes for which it was provided and not for any other purpose.8

Medical ethics. In ethics, the duty of confidence in medical practice has strong historical origins in formal statements of medical ethics. Different translations of the Hippocratic oath recognise that the duty applies only to some and not to all information. These statements include "what should not be published abroad",9 "things shameful to be spoken about",10 and "things that should never be blurted out".11 Thus, its scope can be described by reference to the purpose of the disclosure.12 The justifications for this duty include a respect for patient autonomy and an expression of the professional virtue of fidelity.13

In Cases 1 and 2 presented by Braunack-Mayer and Mulligan, Ms X's and Mr Y's information was clearly provided for the purpose of providing diagnosis, advice and/or treatment to them. Their doctors' uses of that information to clarify a diagnosis, confirm decisions about treatment or seek additional advice could fairly be described as uses for that same purpose. As such, those uses would not be breaches of the common-law duty of confidentiality. However, the particular use described in Cases 1 and 2 may not conform to the Privacy Act, as it seems clear that neither Ms X nor Mr Y reasonably expected that use of their information. (There is no suggestion that the disclosure was reasonably necessary to prevent or lessen a serious and imminent threat to their life, health or safety.)

The legal and ethical implications of access to Ms Z's test results in Case 3 are less clear, because of the involvement of two medical practitioners and the lack of explanation as to how the second doctor had access to the test results. Clarification of these details is important. However, if there was an explanation of access, it is clear that the information was used for the purpose of diagnosis and treatment, the purpose for which it was provided. Ms Z's being unaware of that use remains relevant for the Privacy Act.

Thus, the common-law duty of confidence may not have been breached by any of the doctors in the three cases. The statutory duty to protect privacy may have been breached, depending on clarification of some uncertainties of interpretation. However, what remains important is that the patients all plainly felt that their information had been used in ways that surprised or troubled them. It could be said that the patients thought that an ethical duty had been breached.

It seems there were two main causes for their concern, both of which have ethical importance. First, they did not know about (and did not feel that they had consented to) the way their information was used, and, second, that use diminished their trust in their doctors.

Consent that is based upon an adequate and clear disclosure of how information will be used is the best response to the first cause of concern. Being given that information and, in turn, giving consent also respects a patient's autonomy. Routine advice as to whom a patient's information will be disclosed in the course of using it for diagnosis and treatment will probably also meet the requirements of the Privacy Act.3 Further, patients can, by their consent, agree to wider uses or disclosures of their information.

As to the second cause of concern, acting in order to generate and maintain a patient's trust is the best response. In doing so, a doctor expresses the virtue of fidelity. This lies at the foundation of the doctor–patient relationship: it extends beyond merely keeping promises (eg, to maintain confidentiality) and speaks to character and the establishment, and not the assumption, of a relationship of trust.14

The authors are correct to identify the ethical importance of attending carefully to patients' awareness of and understanding about how their information is used. Exceeding minimal legal duties by doing more than merely making patients aware of how their information will be used is important to building trust and to providing effective healthcare.