Principles of Confidentiality

Introduction

Privacy, autonomy and confidentiality are interrelated concepts that are crucial to rehabilitation practice.  Privacy refers to an individual’s right to control access to their personal information. Autonomy conveys an individual’s right to make decisions about their treatment and care.  Both privacy and autonomy are closely related as they involve an individual’s control over their own information and choices. Confidentiality signifies the obligation to keep personal information private and secure in accordance with legal and ethical principles.

Confidentiality encompasses not only keeping information private but also taking steps to ensure the information is secure and protected from unauthorised users.  There are a number of ways healthcare providers can prevent electronic breeches in confidentiality:

• Electronic Records:
  • use password protection
  • store securely
  • have protocols in place to prevent unauthorised access
  • using encryption
  • maintain regular backups
  • secure deletion of records when they are no longer required
  • have periodic audits to make sure they are being accessed appropriately and to detect any unauthorised users
• Mobile Devices:
  • use password protection
  • remote wipe capabilities in the situation where they are lost or stolen

Healthcare professionals are ethically obligated to maintain patient’s privacy and protect their autonomy. Keeping patient information confidential is not just an ethical issue, but also a legal one in many countries.  Maintaining confidentiality protects patient’s from negative outcomes such as ruining personal relationships, employment discrimination and insurance coverage issues.

Respecting confidentiality demonstrates the commitment by the provider for the patients well-being.[1] In addition, it builds trust permitting the patient to disclose sensitive information to their provider.  Confiding this information generates a positive provider-patient relationship.   If patients do not trust their provider and withhold relevant information, the quality of care and outcomes will decrease.

There are a few exceptions where maintaining patient confidentiality is not possible. Those few deviations are listed below:

1. When there is a risk of harm to themselves or others
2. Exceptional situations that may cause major harm to another
   • partner notification in HIV disease
   • epidemics of infectious diseases
   • relative notification of certain genetic risks
3. When they are legally required to reporting the information:
   • gunshot wounds
   • sexually transmitted diseases.

Breach

Breaches of confidentiality can be accidental, intentional or have a systemic causes.  Accidental breaches may occur from technical malfunctions, human error, inadequate training or lack of awareness about the importance of confidentiality.  Intentional breaches are acts performed by individuals seeking personal gain. They can be committed by insiders, hackers or unauthorised individuals. Insiders can be motivated by personal reasons or financial gain while outsiders may be driven by political reasons, financial gain or other factors  Lastly, systemic breaches refer to inadequate security measures or insufficient protocols for managing confidential information.

The most common occurrences of confidential breech are the following:

• Discussing patient information in public areas
• Discussing patient information with the providers family members
• Leaving electronic or paper health records unattended
• Incorrectly disposing of patient records
• Providing care with open doors
• Disclosing patient data to third parties

Consequences of Breach

Breeches in confidentiality can have negative consequences on the provider-patient relationship.  When confidential information is leaked, the patient loses trust in their provider.  As the relationship deteriorates, the patient may be hesitant to seek help, attend follow-up visits or disclose information necessary to establish an efficient treatment plan which may lead to negative outcomes.

Confidential breaches can also have negative consequences for healthcare providers.  Healthcare professionals can be held liable for breaches in the form of fines, lawsuits and criminal charges.  If the breach becomes public knowledge, the providers’ reputation along with their organisation can be damaged.  This can lead to loss of business and difficulty in finding a job in the future.

**If a breach does occur, it's important to report it immediately and take steps to mitigate any potential harm.

Resources

• Informed Consent
• Informed Consent with People who have Dementia
• Section 8: Informed consent and medico-legal framework