15.3 Confidentiality, Statutory Reporting & DVLA Regulations

Confidentiality, Statutory Reporting & DVLA Regulations

Confidentiality is an essential prerequisite for effective healthcare. Patients disclose deeply personal, sensitive details only because they trust that healthcare professionals will protect their privacy. The General Medical Council (GMC) states that this duty of confidentiality extends beyond the death of the patient. However, confidentiality is not absolute; specific statutory mandates and overriding public interest grounds allow, and sometimes require, disclosure of patient-identifiable data.

The Caldicott Principles

In the UK National Health Service (NHS), the handling of patient-identifiable information is governed by the Caldicott Principles, overseen by an appointed Caldicott Guardian in each health trust:

1. Principle 1: Justify the purpose(s) — Every proposed use or transfer of confidential information must be clearly defined, scrutinized, and documented.
2. Principle 2: Don't use personal confidential data unless absolutely necessary — De-identified or anonymized data should be used wherever possible.
3. Principle 3: Use the minimum necessary personal confidential data — Information disclosed must be tailored strictly to what is required for the specific purpose.
4. Principle 4: Access should be on a strict need-to-know basis — Only individuals who require access to provide care or fulfill the purpose should view the data.
5. Principle 5: Everyone with access must understand their responsibilities — Staff must be trained in data privacy and statutory obligations.
6. Principle 6: Comply with the law — Every data release must conform to data protection statutes (Data Protection Act 2018 / UK GDPR) and common law.
7. Principle 7: The duty to share information can be as important as the duty to protect confidentiality — Clinicians must share critical data when it is necessary for direct patient care or safeguarding.
8. Principle 8: Inform patients about how their confidential data is used — Ensure transparency regarding data processing and secondary uses.

Lawful Grounds for Breaching Confidentiality

There are three distinct legal bases under which patient confidentiality may be lawfully breached:

                         [ Legal Bases for Disclosing Patient Data ]
                                             │
         ┌───────────────────────────────────┼───────────────────────────────────┐
         ▼                                   ▼                                   ▼
   [ 1. Patient Consent ]          [ 2. Statutory Legal Mandate ]       [ 3. Overriding Public Interest ]
 Explicit verbal or written         Statutory legal obligations          Necessary to protect individuals
 consent provided by patient        enacted by UK Parliament            or society from death or serious harm
 (e.g., insurance reports,           (Overrides confidentiality          (e.g., serious violent crime, child
  disclosures to solicitors)          without needing consent)             safeguarding, unfit driver)

1. Patient Consent

Where a competent patient gives explicit, informed consent for their medical records to be shared (e.g., with employers, solicitors, or private medical insurance companies), disclosure is lawful provided the disclosure is restricted strictly to relevant information.

2. Statutory Legal Mandates (Required by Law)

Under specific acts of Parliament, clinicians are legally required to disclose information without patient consent:

• Notifiable Infectious Diseases (NOIDs): Under the Health Protection (Notification) Regulations 2010, registered medical practitioners must report suspected cases of designated notifiable diseases to the local Proper Officer (UK Health Security Agency [UKHSA]) without delay.
  • Key Notifiable Diseases: Tuberculosis (TB), measles, mumps, rubella, whooping cough (pertussis), acute meningitis, acute encephalitis, meningococcal septicaemia, cholera, typhoid, food poisoning, diphtheria, malaria, rabies, tetanus, and viral haemorrhagic fevers.
  • Critical Exam Trap: HIV, hepatitis B, hepatitis C, chlamydia, and gonorrhoea are NOT statutory notifiable diseases. Disclosing an HIV or STI diagnosis to public health authorities or third parties without consent is a grave breach of confidentiality.
• Court Orders: A direct order issued by a judge or court of law mandates disclosure.
• Female Genital Mutilation (FGM): Mandatory reporting duty under the Serious Crime Act 2015 requiring healthcare professionals to report known cases of FGM in girls aged under 18 directly to the police within one month.
• Road Traffic Act 1988 (Section 172): Clinicians must provide information to the police to confirm the identity of a driver alleged to have committed a road traffic offense.

3. Overriding Public Interest

A clinician may disclose confidential data without consent if disclosure is essential to protect the patient or third parties from risk of death or serious physical or psychological harm (e.g., violent assault, knife crime, child sexual abuse, or an unfit driver refusing to stop driving).

DVLA Fitness to Drive Regulations

In the UK, the Driver and Vehicle Licensing Agency (DVLA) determines whether an individual is medically fit to hold a driving licence. The clinician's role is diagnostic and advisory; doctors do not have the legal authority to revoke a driving licence.

Doctor's Legal & Ethical Duties

1. Explain to the patient how their medical condition, treatment, or impairment impacts their driving ability.
2. Advise the patient to stop driving immediately.
3. Inform the patient of their statutory legal duty under Section 92 of the Road Traffic Act 1988 to notify the DVLA of their medical condition.

Management of the Non-Compliant Driver

If a patient indicates that they intend to continue driving against medical advice, the doctor must follow a clear escalation protocol:

1. Reiterate the severe risks to themselves and the general public, and remind them that driving while medically unfit is a criminal offense that invalidates motor insurance.
2. Suggest that the patient obtain a second medical opinion while remaining off the road.
3. If the patient continues to drive or refuses to notify the DVLA, the doctor must breach confidentiality in the public interest and contact the DVLA Senior Medical Adviser directly.
4. Before contacting the DVLA, the doctor should inform the patient of their intention to disclose. Once disclosed, the doctor must write to the patient confirming that the DVLA has been notified, and record the entire interaction in the medical records.

Summary of DVLA Medical Rules (Group 1: Cars & Motorcycles)

Death Certification (MCCD) & Coroner Referrals

Completing the Medical Certificate of Cause of Death (MCCD)

Since 9 September 2024, death certification in England and Wales has worked under the statutory medical examiner system:

• Any registered medical practitioner who attended the deceased at any point during their life may complete the MCCD if they can state the cause of death to the best of their knowledge and belief (the old requirement to have seen the patient within 28 days before death, or after death, has gone).

• Every death not investigated by the coroner is independently scrutinised by a medical examiner, who reviews the records, discusses the cause of death with the certifying doctor and speaks to the bereaved family before registration.

• If no attending practitioner is available, or the cause is unknown, the death must be notified to the coroner.

• Part 1: Direct Cause of Death & Antecedent Sequence

  • 1a: Immediate disease or condition leading directly to death (e.g., Aspiration pneumonia)
  • 1b: Underlying antecedent condition giving rise to 1a (e.g., Ischaemic stroke)
  • 1c: Underlying antecedent condition giving rise to 1b (e.g., Carotid artery stenosis)

• Part 2: Other Significant Contributory Conditions

  • Conditions that contributed to death but were not part of the direct chain causing it (e.g., Type 2 diabetes mellitus, Hypertension)

Mandatory Referrals to the Coroner

Under the Notification of Deaths Regulations 2019 (England and Wales), a doctor must notify the Coroner (the Procurator Fiscal in Scotland) when any of the following apply; the list includes deaths with no available attending practitioner and deaths where the deceased's identity is unknown: