Information about patients often leaks out because of carelessness.  Yet the fix is often very simple and easy!   Here are some examples of how patient information commonly gets accidentally leaked out.    Please pay attention to the advice given.

1. Patient summary printouts for home visits not being discarded properly.   After home visits, all summary printouts should be shredded.  Any left in the ‘home visits box’ (after the visit date) should also be shredded.  Doctors – please note that you should keep your home visit summary printout in your doctor’s bag and it should not be left lying around in your car!
2. Carrying a bunch of patient letters without a folder and one drops out in the patient waiting area or the corridor.  If you carry letters in a folder box, they are less likely to fall out.
3. Prescriptions or other information being left lying around – on desks etc.   This is a particular problem on doctors’ desks.   Doctors – please remember that your rooms might be used by other workers and therefore keep your desk tidy and free of patient sensitive information.   Admin staff – if you find patient sensitive information in a doctor’s room when they are not there, please transfer to that doctor’s pigeon hole.
4. Talking to patients or their relatives in front of other people.    Use ‘stand behind this line’ notices to provide better confidentiality for patients and their relatives speaking at reception.   See section below about what information you can and cannot disclose to relatives.
5. Computer screens on full display to anyone!   Remember, if you need to leave your desk ensure your screen is away from public view.   Again, if you have to leave your computer, take out your smart card so that the computer goes into security mode.
6. Doctors and nurses talking to reception staff about a patient in the waiting area.   Try and talk to staff outside of the reception area.
7. Sending patient information (including search results) via personal email – this is forbidden!  Only send through NHS secure email.
8. Storing patient information (including search results) on a non-encrypted NHS USB stick or any other storage medium – this is forbidden!   It’s probably safest to generally say, don’t use USB sticks in general.  If you desperately need to, ask yourself why you need it and ensure it is an NHS issued encrypted one.

Remember …. Information Security is everyone’s responsibility. So, if you see something sensitive lying around, like a patient letter , pick it up and hand it to Claire Revitt and explain where you found it.

• The Police – just because a police officer requests information DOES NOT give them automatic right to get that information.  They still need to obtain consent from the patient.
• A solicitor – a solicitor cannot demand information without a consent form.   All requests from solicitors should be in writing and never over the phone – even for little things.  Information must NOT be released until the consent form has been seen.   Currently, we have a practice procedure whereby Christine Serrant checks all solicitor request letters for consent forms before passing anything onto the doctor.
• A relative – just because the person asking for information is the husband, wife, daughter or son DOES NOT give them automatic right to get that information.  Again, they need to have a consent form signed or alternatively, if for example their relative has dementia, needs to have obtained a Power of Attorney or Enduring Power of Guardianship form signed (which they do via a solicitor).
• Another doctor or GP practice requesting information over the phone – pass this onto Mr Claire Revitt or one of the doctors – one must be careful with telephone conversations because one needs to be certain that the other person is who they say they are (e.g. not a relative pretending to be a hospital doctor or another GP elsewhere).
• Always check with telephone calls and make sure the person is who they say they are.  For instance, if the person is claiming to be a doctor, call them back on the hospital or practice where they say they work.  Same for people claiming to work for a particular organisation – ring them back.

• Even information about attendance at surgery or clinics is confidential!  Please do not tell relatives if their patients had attended the surgery recently!
• Results should only be given to the patient directly unless there is explicit consent.
• Where information about a minor (i.e. under 16) is sensitive, for example regarding contraception, pregnancy testing etc, discretion should be used regarding the giving of results or information to a guardian. Reception staff should discuss this with a doctor where there is any doubt.
• Where information regarding a patient’s medical record is requested from a third party, e.g. insurance company, solicitor, social services etc, written consent must always be obtained. This must be seen prior to any information being released from the practice.
• There are some rare circumstances in which it is appropriate to disclose medical records without consent, e.g. suspicion of child abuse, public safety interest. If such a circumstance is suspected, the GMS guidance on confidentiality must be followed (Confidentiality: Protecting and Providing Information. April 2004. GMS website) and/or the situation discussed with the Caldicott guardian at the PCT.

Please thing about your consulting room….

• Do not leave patient identifiable material lying around.   You should leave your surgery at the end of the day with no patient identifiable material on your desk.   Remember, you may not be working in your room the next day and someone else might be!  If you have got patient identifiable material that you need to hang on to – stick it in your secure pigeon hole.  Or put it in a lockable draw – then lock it.
• Don’t leave computers on when leaving your room for a prolonged period of time.  If you are leaving your room for a while, take your Smart Card out as this will lock down SystmOne.  Consider locking your door if you are going to be out of it for any length of time.
• If a patient comes in with a third party, please remember that their presence does not mean the patient has given the third party permission to hear everything. They might want to talk to you about something which they are happy for their third party person to hear.  But they might not be happy if you start talking about other problems in the records that the third party is a) unaware of and b) has not been given permission to hear.  If you do want to talk about other matters, ask the patient if it is okay or whether they would like to have some privacy – give them that choice explicitly.  Use your head.
• Again, if a patient comes in with a third party, remember to turn your computer screen away from the patient to directly face you.   The third party may have been given permission to hear the presenting complaint (of course – check), but not to be able to read things off the computer screen.
• Confidentiality still exisits when a patient dies.  If someone dies and, say, an insurance company wants further information – seek consent of the executor of the will or ask the company to make a claim via court.
• Parents who have split or divorced – the parent the child resides with the most (or who has custody) is the parent who has a right to the information on that child.  The other parent does not.   So check with the parent and ask them to provide evidence by way of a parental order.  Of course, use your head… especially if an acutely unwell child comes in with the non-custody parent.   Patient safety overrides everything.
• The child who comes in with grandma for vaccinations.  Again, consent has to be sought from the parent, not the grandma.

The most important thing to remember is that information that can identify individual patients, must not be used or disclosed for purposes other than health care without the individual’s explicit consent.   In some specific situations, consent can be overridden (but check with the Information Leads above).  For example, consent can be overridden where

1. there is a robust public interest to do so (e.g. to protect the public from terrorism or other harm)
2. there is a third party involved who is also at risk if information is not shared (e.g. a child)
3. there is a legal requirement to do so (e.g. the courts demand you release the information).    Note: Don’t confuse the courts with the police.  A police officer requesting information cannot do so without consent from the patient.  Do NOT release information to the police without talking to your Information Governance Deputy Lead, Mr Claire Revitt.

When sending information about patients to other people or organisations, please think about the nature of what you are sending.  You need to check that the recipients are authorised to recieve that information.  If it includes patient identifiable information, then it needs to be dealt with carefully.  Sending information by different methods may need additional requirements like marking ‘private & confidential’, use of courier or NHS delivery services rather than regular post, etc. Disposal of information also needs careful management e.g. for paper use a cross cut shredder.

You can disclose information to other staff and doctors (within or external to the practice) PROVIDING

1. the recieving person needs to know that information (inorder to provide better care/treatment) AND
2. the expectation is for this information to be used for the sole care and treatment of that particular patient only.
3. Remember it is important to use your judgement to strike a balance between the harm that could be done to a patient’s health if information is not used or shared and the risk of breaching confidentiality if information is shared.  If you feel sharing information is necessary to avoid or reduce harm or distress to anyone, then the legal framework in the UK will generally support it.

When sending information about patients to other people or organisations, please think about the nature of what you are sending.  You need to check that the recipients are authorised to recieve that information.  If it includes patient identifiable information, then it needs to be dealt with carefully.  Sending information by different methods may need additional requirements like marking ‘private & confidential’, use of courier or NHS delivery services rather than regular post, etc. Disposal of information also needs careful management e.g. for paper use a cross cut shredder.

• You need to ask the patient to identify themselves by asking for two pieces of additional information – like their date of birth and address or phone number.
• Listen to the dialogue, if there is any hint of suspicion on your part, hold back, even if they are able to provide two pieces of additional information.
• Remember, patients are only entitled to information about themselves – not their relations.

• Only leave the minimum of information.
• So, ‘Mrs. Brown, please can you call the surgery back and ask to speak to Sam.  It’s nothing urgent.’ is ok.
• But ‘Mrs. Brown, just wanted to let you know that your urine result was okay’ is not okay.
• ‘Mrs Brown, just ringing up because you were meant to attend to have your coil changed.  Anyway, please ring the surgery and ask for Sam’ is also not okay.
• In the last two examples, you have divulged unnecessary information that another household member can pick up on. And then you will have breached confidentiality.

• Always send a a fax header with all other documents sent via fax.  Ashcroft surgery has one here  http://www.ashcroftsurgery.co.uk/staff/secure-area/
• The Fax Header must have a message to return (if incorrect recipient)  which says something like ‘This information is confidential and should be returned without the recipient reading any further if the recipient is not the intended recipient’.

• If your system does not give much information other than the patient’s name, then that is fine.  So, ‘Mrs. Broom to room 8 please’ is fine.
• However, something like ‘Mrs. Broom to the Diabetic Clinic Room 8 please’ is breaking confidentiality because other people in the waiting room now know that Mrs. Broom has diabetes.  They have no right to know that information.

Absolutely not.  You must not tear up paper with sensitive information.    Instead, shred it.  In fact, even if you are unsure as to whether something that needs disposing of contains confidential information or not – shred it.  Ashcroft surgery employs a specialist contractor to help dispose of confidential paper waste securely.   A lockable ‘shredding’ box/console can be found near the emergency exit area of the staff common room on the ground floor.   The specialist contractor will come in and securely shred paper in this box.   So….

• Please do NOT tear up paper with sensitive information and throw it in the bin
• Instead, stick it in the shredding box.

As many of you will know, most internal doors at most surgeries have digital keypads to help with security zoning of the different areas of the building – including areas where medical records are held.    These doors must be kept secure for two reasons 

1. to keep areas where medical information may be lying around cordoned off, 
2. Because all our doors are fire doors and fire doors must be kept closed to limit the spread if a fire was to happen.  

Therefore,   NEVER turn off the digial keypads and NEVER keep the doors propped open.   It’s not only a confidentiality risk but also a fire safety risk.