In Practice Guidance On Confidentiality June 2018
In practice:Guidance onconfidentialityRevisedJune 20181In practice: Guidance on confidentiality
The text of this document (but not the logo and branding) may be reproduced free of charge in anyformat or medium, as long as it is reproduced accurately and not in a misleading context. Thismaterial must be acknowledged as General Pharmaceutical Council copyright and the document titlespecified. If we have quoted third party material, you must get permission from the copyright holder.Contact us at communications@pharmacyregulation.org if you would like a copy of the documentin another format (for example, in larger type or in a different language). General Pharmaceutical Council 20182In practice: Guidance on confidentiality
ContentsAbout this guidance .4Confidentiality .61. The importance of maintaining confidentiality . 62. Duty of confidentiality . 73. Protecting information. 8Disclosure .94. Disclosing confidential information. 95. Disclosing information with consent . 116. Disclosing information without consent . 117. Disclosures required by law . 128. Disclosures made in the public interest . 12Other sources of information .133In practice: Guidance on confidentiality
About thisguidanceThe General PharmaceuticalCouncil is the regulator forpharmacists, pharmacytechnicians and registeredpharmacies in England,Scotland and Wales. As part ofour role, we set the standardsthat pharmacy professionalshave to meet throughout theircareers.This guidance explains to pharmacyprofessionals (pharmacists andpharmacy technicians) the importanceof maintaining confidentiality, andtheir relevant responsibilities.Pharmacy professionals should usetheir professional judgement inapplying this guidance.Pharmacy professionals should satisfythemselves that all members of the team arefamiliar with the issues raised within thisguidance and understand their ownresponsibilities in relation to confidentiality.If a pharmacy professional is not sure aboutwhat they should do in a specific situation, theyshould always ask for advice from theiremployer, professional indemnity insuranceprovider, union, professional body or otherpharmacy organisation, or get independent legaladvice.This guidance should be read alongside thestandards for pharmacy professionals whichall pharmacy professionals must meet. Thisguidance covers standard 7 of the standards forpharmacy professionals, which says:Pharmacy professionals must respect andmaintain a person’s confidentiality andprivacy4In practice: Guidance on confidentiality
Applying the standardPeople trust that their confidentiality and privacywill be maintained by pharmacy professionals,whether in a healthcare setting – such as ahospital, primary care or community pharmacysetting – in person, or online. Maintainingconfidentiality is a vital part of the relationshipbetween a pharmacy professional and theperson seeking care. People may be reluctant toask for care if they believe their information maynot be kept confidential. The principles ofconfidentiality still apply after a person’s death.There are a number of ways to meet thisstandard and below are examples of theattitudes and behaviours expected.People receive safe and effective care whenpharmacy professionals: understand the importance of managinginformation responsibly and securely, andapply this to their practice reflect on their environment and take stepsto maintain the person’s privacy andconfidentiality do not discuss information that can identifythe person, when the discussions can beoverheard or seen by others not involved intheir care ensure that everyone in the teamunderstands the need to maintain a person’sprivacy and confidentiality work in partnership with the person whenconsidering whether to share theirinformation, except where this would not beappropriateThis guidance is not intended to cover everyaspect of confidentiality and it does not givedetailed legal advice. However, it reflects the lawin Great Britain at the time of publication.Pharmacy professionals must make sure thatthey keep up to date and comply with dataprotection legislation, for example: UK domesticdata protection legislation, the General DataProtection Regulation ((EU) 2016/679) (GDPR)and the Human Rights Act 1998 (HRA) . Thecommon law duty of confidentiality also applies,as do any NHS or employment policies onconfidentiality that apply to their particular areaof work.UK data protection legislation covers personalinformation, including data about the physicalor mental health or condition of a person (calleda ‘data subject’ in data protection legislation).The Information Commissioner’s Office (ICO)enforces data protection legislation andproduces advice and guidance on it.The HRA incorporates the European Conventionon Human Rights (ECHR) into UK law. This, andthe Charter of Fundamental Rights of theEuropean Union, gives individuals a right torespect for their private life.5In practice: Guidance on confidentiality
Confidentiality1. The importance ofmaintainingconfidentialityThe charter also gives them a right to theprotection of their personal data1. These issuescan be complex and pharmacy professionalsshould get legal advice, if they need it.Pharmacy professionals providing NHS servicesmust also follow NHS codes of practice, and theguidance on handling information in health andcare.We have a range of guidance on our website tohelp pharmacy professionals apply ourstandards. In particular, when reading thisguidance, please also see our In practice:Guidance on consent.The rights under Article 8 of the HRA are complicated andthere are conditions and exceptions. For more informationon Article 8 see:161.1. Maintaining confidentiality is a vital part ofthe relationship between a pharmacyprofessional and a person under their care.A person may be reluctant to ask foradvice, or give a pharmacy professional theinformation they need to provide propercare, if they believe that the pharmacyprofessional may not keep the informationconfidential. When pharmacy professionalsdo not handle confidential informationappropriately it can damage public trustand confidence in the pharmacyprofessions and other private-and-family-lifeIn practice: Guidance on confidentiality
2. Duty of confidentiality2.1. Pharmacy professionals have aprofessional and legal duty to keepconfidential the information they obtainduring the course of their professionalpractice. The duty of confidentiality appliesto information about any person, whatevertheir age (see our In practice: Guidanceon consent), and continues to apply after aperson’s death.2.2. A duty of confidentiality arises when oneperson discloses information to another incircumstances where it is reasonable toexpect that the information will be held inconfidence. This duty applies to allinformation that pharmacy professionalsobtain during the course of theirprofessional practice.person disclosing it would expect to bekept confidential2.4. Confidential information does not include: anonymous information informationfrom which individuals cannotreasonably be identified pseudonymised information information from which individualscannot reasonably be identified, butwhich allows information about differentpeople receiving care to bedistinguished (for example, to identifydrug side effects) information that is already legitimatelyin the public domain2.3. Confidential information includes: electronic and hard copy data personal details information about a person’s medication(prescribed and non-prescribed) other information about a person’smedical history, treatment or care thatcould identify them, and information that people share that is notstrictly medical in nature, but that the7In practice: Guidance on confidentiality
3. Protecting information3.1It is essential that pharmacy professionalstake steps to protect the confidentialinformation they are given either in thecourse of their professional practice orbecause they are a pharmacy professional.They must: take all reasonable steps to protect theconfidentiality and security of informationthey receive, access, store, send ordestroy, including protection againstunauthorised or unlawful processing andagainst intrusion, destruction or damage take steps to make sure that, whenprocessing personal data, it is accurateand, where necessary, kept up to date take steps to prevent accidentaldisclosure of confidential information 8access confidential information andrecords only as part of providingtreatment and care for a person, or foranother permitted purpose that meetsone of the conditions for lawfullyprocessing personal data set out inlegislation make sure that everyone they work within their pharmacy, hospital, practice orother setting knows about theirresponsibility to maintain confidentiality raise concerns with the person who isresponsible for data control (the datacontroller) where they work, or with anyother appropriate authority, if they findthat the security of personal informationthere is not appropriate continue to protect a person’sconfidentiality after they have died,subject to disclosures required by law orwhen it is in the public interest (seebelow) store hard copy and electronicdocuments, records, registers,prescriptions and other sources ofconfidential information securely for nolonger than is necessary for the purposesfor which the personal data areprocessed not leave confidential information whereit may be seen or accessed by peoplereceiving care, the public or anyone elsewho should not have access to it not discuss information that can identifypeople receiving care if the discussionscan be overheard or seen by others notinvolved in their care not disclose information on any websites,internet chat forums or social media thatcould identify a person (see our guidanceon demonstrating professionalismonline)In practice: Guidance on confidentiality
Disclosure4. Disclosing confidentialinformation4.14.2Decisions about disclosing confidentialinformation can be complex. In mostsituations pharmacy professionals will nothave to disclose information immediately.However, there will be limited situationswhere to delay is not practical, for exampleif this may cause a risk to another person.Pharmacy professionals should take thenecessary steps to satisfy themselves thatany disclosure being asked for isappropriate and meets the legalrequirements covering confidentiality, andthe conditions for lawfully processingpersonal data in data protection legislation.If it is practicable, pharmacy professionalsmay find it useful to get advice on what todo from appropriate sources (withoutidentifying the person under their care).example if a patient needs immediateurgent medical attention4.3In the course of their professional practicepharmacy professionals may receiverequests for confidential information aboutpeople under their care from a variety ofpeople (for example a person’s relative,partner or carer) or organisations (forexample the police or a healthcareregulator). Decisions about disclosinginformation should be made on a case-bycase basis and after fully considering allrelevant factors.4.4If a person with capacity (see our Inpractice: Guidance on consent for moreinformation on capacity) refuses to giveconsent for information to be shared withother healthcare professionals involved inproviding their care, it may mean that thecare they can be provided with is limited.Pharmacy professionals must respect thatdecision, but tell the person receiving careabout the potential implications for theircare or treatment.4.5Pharmacy professionals must respect thewishes of a person with capacity undertheir care who does not consent toinformation about them being shared withothers, unless the law says they mustdisclose the information or it is in thepublic interest to make such a disclosure.Maintaining confidentiality is an importantduty, but there are circumstances when itmay be appropriate to disclose confidentialinformation. These are when a pharmacyprofessional: has the consent of the person undertheir care has to disclose by law should do so in the public interest,and/or must do so in the vital interests of aperson receiving treatment or care, for9In practice: Guidance on confidentiality
4.6If a pharmacy professional decides todisclose confidential information about aperson, they should:– whether they obtained the consent ofthe person under their care, or theirreasons for not doing so pseudonymise information or make itanonymous, if they do not need toidentify the person receiving care– whether consent was given orrefused get the person’s consent to share theirinformation. But they do not need to dothis if:– disclosure is required by law, or– the disclosure can be justified in thepublic interest2, or– to do so is impracticable, would putthe pharmacy professional or others(including the person receivingtreatment or care) at risk of seriousharm, or would prejudice the purposeof the disclosure, for example toprevent a crime disclose only the information needed forthe particular purpose– what they disclosed– how it was ensured that thedisclosure was made securely, and– what the lawful authority or provisionwas under which the request and/ordisclosure was made be prepared to justify the decisions andany actions they take release the information promptly oncethey are satisfied what informationshould be disclosed and have taken allnecessary steps to protectconfidentiality retain a copy of the disclosure made make sure that, if they discloseconfidential information, the peoplereceiving the information know that it isconfidential and is to be treated as such make appropriate records to show:– who the request came fromWhen considering whether disclosing confidentialinformation without consent may be justified in the publicinterest, pharmacy professionals must be satisfied that the210disclosure would comply with data protection legislation.Please see the ICO’s website for more information.In practice: Guidance on confidentiality
5. Disclosing informationwith consent6. Disclosing informationwithout consent5.1Pharmacy professionals should get theperson’s consent to share their informationunless that would undermine the purposeof disclosure (see 4.6 above).5.2They should make sure the person in theircare understands:6.1. Pharmacy professionals should make everyeffort to get consent to discloseconfidential information. However, if thatwould undermine the purpose ofdisclosure (for example, when there is arisk to others) or is not practicable, thenthey should use the guidance in thissection. what information will be disclosed why information will be disclosed who it will be disclosed to the likely consequences of disclosingand of not disclosing the information5.3When the reason for sharing confidentialinformation is one that the personreceiving care would not reasonablyexpect, pharmacy professionals must gettheir explicit consent before disclosure.5.4If a pharmacy professional is unsurewhether they have the person’s consent toshare their information, they shouldcontact them and obtain their consent.5.5Pharmacy professionals should also takedata protection legislation into account inthese circumstances, as thoserequirements also need to be followed.Under data protection legislation,information can be shared when expressconsent (specific permission to dosomething) is given. Consent to shareinformation under the duty ofconfidentiality may not be valid for thepurposes of data protection legislation.6.2. Before disclosing information without theconsent of the person receiving care, apharmacy professional should: be satisfied that the law says they haveto disclose the information, or thatdisclosure can be justified as being inthe public interest and also meets therequirements of data protectionlegislation. (This would be through anexemption or condition that wouldapply for the information to beprocessed and disclosed.) if they are unsure about the basis for therequest, ask for clarification from theperson making the request ask for the request in writing6.3. If necessary, pharmacy professionalsshould get advice from a relevant body, forexample their indemnity insuranceprovider, union, professional body or otherpharmacy organisation, or an independentlegal adviser. The ICO can give advice, andhas issued guidance, on the requirementsof data protection legislation.11In practice: Guidance on confidentiality
7. Disclosures required bylaw8. Disclosures made in thepublic interest7.1. There are circumstances when the law saysa pharmacy professional must discloseinformation that they hold. Thesecircumstances include when a person orbody is using their powers under the law toask for the information, for example:8.1. These decisions are complex and must takeaccount of both the person receiving careand public interest in either maintaining orbreaching confidentiality. the police or another enforcement,prosecuting or regulatory authority a healthcare regulator, such as the GPhCor the GMC a serious crime an NHS counter-fraud investigationofficer serious harm to a person receiving careor to a third party, or a coroner, procurator fiscal, judge orrelevant court which orders that theinformation should be disclosed serious risk to public health7.2. These individuals and organisations do nothave an automatic right to access allconfidential information about peoplereceiving care. Pharmacy professionalsmust be satisfied they have a legitimatereason for requesting the information.7.3. If necessary, pharmacy professionalsshould get advice from a relevant body, forexample their indemnity insuranceprovider, union, professional body or otherpharmacy organisation, the ICO, or anindependent legal adviser.128.2. A pharmacy professional may discloseconfidential information when theyconsider it to be in the public interest to doso, for example if the information isrequired to prevent:8.3. Pharmacy professionals must carefullybalance the competing interests ofmaintaining the confidentiality of theinformation and the public interest benefitin disclosing the information.8.4. Pharmacy professionals must consider thepossible harm that may be caused by notdisclosing the information against thepotential consequences of disclosing theinformation. This includes considering howdisclosing the information may affect thecare of the person and the trust that theyhave in pharmacy professionals.8.5. When considering whether disclosingconfidential information without consentmay be justified in the public interest,pharmacy professionals must be satisfiedthat the disclosure would comply with therequirements of data protection law.In practice: Guidance on confidentiality
8.6. If necessary, pharmacy professionalsshould get advice from a relevant body, forexample their indemnity insuranceprovider, union, professional body or otherpharmacy organisation, the ICO, or anindependent legal adviser.If you have questions or commentsabout the content of this guidance,please contact our Policy andStandards Team:Policy and Standards TeamGeneral Pharmaceutical Council25 Canada SquareLondonE14 5LQ0203 713 8000standards@pharmacyregulation.orgWe have also produced guidance onother topics that you may find ce13In practice: Guidance on confidentiality
Other sourcesof information The Information Commissioner’s Office:Head office:Wycliffe HouseWater LaneWilmslowSK9 5AFPhone: 0303 123 1113 or 01625 545 745 or029 2067 8400 (Welsh language line)Scotland Office:45 Melville StreetEdinburghEH3 7HLWales Office:2nd FloorChurchill HouseChurchill WayCardiffCF10 2HHEmail: casework@ico.gsi.gov.ukWebsite: http://www.ico.org.uk ICO guidance:Overview of the General Data ProtectionRegulation (GDPR) NHS codes of practice for handlinginformation in health and care:Confidentiality: NHS Code of Practice supplementary guidance: public interestdisclosures (England)Protecting Patient confidentiality NHSScotland Code of PracticeConfidentiality: Code of Practice forHealth and Social Care in WalesOther useful links: NHS Digital website (England):https://digital.nhs.uk/home Information governance for Summary CareRecords ds/information-governance Pharmacy Care Record (PCR) r/pharmacy/pharmacy-care-record-pcr/ Choose Pharmacy rd.wales.nhs.uk/home The National Data Guardian al-data-guardianConfidentiality: NHS Code of Practice(England)14In practice: Guidance on confidentiality
pharmacy organisation, or get independent legal advice. This guidance should be read alongside the standards for pharmacy professionals which all pharmacy professionals must meet. This guidance covers standard 7 of the standards for pharmacy professionals, which says: Pharmacy professionals must respect and maintain a person's confidentiality and
Confidentiality and anonymity are related but distinct concepts. The Concise Oxford Dictionary defines confidentiality as: ‘spoken or written in confidence; charged with secrets’ while anonymity is defined as: ‘of unknown name, of unknown authorship’. In the ethics literature, confidentiality is commonly viewed as akin to the principle ofFile Size: 210KB
CONFIDENTIALITY Our clients' industries are extremely competitive, and the maintenance of confidentiality with respect to our clients' plans and data is critical. MMC rigorously applies internal confidentiality practices to protect the confidentiality of all client information. Similarly, our industry is very competitive.
examples of a confidentiality agreement that may be used when one or both of the parties are non-US entities or if the transaction takes place outside of the US, see Confidentiality Agreement (US-Style, Unilateral, Pro-Discloser): Cross-Border Commercial Transactions ( w-006-7778) and Confidentiality Agreement (US-Style,
Forensic Science Regulator GUIDANCE - GUIDANCE- GUIDANCE- GUIDANCE- GUIDANCE- GUIDANCE- GUIDANCE- GUIDANCE- FSR-G -206 Consultation Version Page 4 of 34 1. INTRODUCTION 1.1.1 For the purposes of this appendix, contamination is defined as "the introduction of DNA, or biological material containing DNA, to an exhibit at or after the point
Best Practice Guidelines for Drug Helplines Adapted from a document produced by the FESAT Best Practice Exchange Partnership, a European membership network of drug helpline services (www.fesat.org) A. Policy and Practice 1. Anonymity and Confidentiality Best Practice More drug helplines stick to the principles of anonymity and confidentiality.
Adolescent & Young Adult Health Care in Texas A Guide to Understanding Consent & Confidentiality Laws Adolescent & Young Adult Health National Resource Center Center for Adolescent Health & the Law March 2019 3 Confidentiality is not absolute. To understand the scope and limits of legal and ethical confidentiality protections,
Frequently Asked Questions (FAQs) 5 Other Sources of Information 7 Starting a Certificate of Confidentiality Request 8 . page to display a printer-friendly form with all questions and answers entered thus far. The browser's print dialog also opens. To start the CoC request: 1. Go to the How to Get a Certificate of Confidentiality? page.
Adopted by the Council of The American Society of Mechanical Engineers, 1914; latest edition 2019. The American Society of Mechanical Engineers Two Park Avenue, New York, NY 10016-5990
