Confidentiality - children and young people

Regulatory bodies make it clear that confidentiality is central to the trust between clinicians and their patients and is essential to providing good care.

Without assurances over confidentiality, children and young people in particular may be reluctant to seek advice or treatment, or to give clinicians the information necessary to provide good and safe care.

While parents may have rights to access personal information relating to their children, any decision to disclose such information must be taken in the child’s best interests.

Basic considerations

While there are legal differences across the countries of the UK, the age of absolute consent is generally regarded as being 16 years, but even a child under age 12 may still be able to understand and make rudimentary decisions about how their personal information is used and shared, and this must be assessed on a case-by-case basis.

Decisions in this area need careful attention. Some teenagers can be particularly concerned about keeping their confidential medical or other personal information from their parents or guardians, and this should always be considered when deciding how best to communicate with this group.

The duty of confidentiality to young persons is not an absolute one. It may be appropriate to share confidential information if any of the following apply:

• You are required to do so by law or under the terms of a lawful court order.
• The child or young person is deemed to have capacity and has given their consent for specific information to be shared.
• Disclosure of personal information is justified in the public interest. This would apply where the benefits to a child or young person as a result of sharing the information will outweigh both the individual’s interest in keeping the information in question confidential and that of society as a whole.

A particular concern is a suspected risk of abuse, neglect or suffering – in which case you should normally inform an appropriate agency without unnecessary delay. Examples include the police or the local authority children’s or social work services, unless the disclosure of the information could in itself place the child at risk of harm. Even if your concerns turn out to be unfounded or you are worried you may cause upset to those involved, the potential consequences of not sharing relevant information in a timeous manner will usually outweigh any harm that sharing concerns with an appropriate agency might cause. 

It is important that all requests for information for child protection purposes be dealt with quickly, as a delay in providing the information could increase the risk of harm to the child or young person or undermine efforts to protect them.

A minimum data set of information should normally be disclosed when the decision has been made to alert an appropriate agency over concerns:

• The identity of the child or young person and, where applicable, their parents or guardians and also any other individual who is suspected may pose a risk or harm to them.
• The specific reasons for your concerns, which should include any relevant information about the child’s or young person’s health.

A health professional should normally seek consent from a young person or child with capacity, before considering whether to share confidential information. However, this may not be appropriate if seeking consent may actually increase the risk of harm to the child.

Where a child or young person does not have the capacity to consent to the disclosure of personal information, you should seek consent from a person who has parental responsibility, unless this could jeopardise the child’s safety.

When seeking consent it is important to explain why you want to share the information and provide reasons as to how this could benefit the child or young person.

Before sharing any confidential information relating to a child or young person, it is vitally important to check the identity of the person who is seeking the information. This could involve, for example, calling them back if you receive a telephone request from a person or agency you do not know or recognise. It is always best to seek written confirmation for disclosure requests, but where this may cause an unjustified delay or increased risk to an individual, verbal requests may be justified where identity has been established beyond any reasonable doubt.

Care should be taken not to disclose any irrelevant or excessive information which has not been requested. Full clinical records should not normally be disclosed unless there is a compelling reason to do so.

Common pitfalls

• Communicating information to young people in a manner that allows parents to have unintended access to sensitive, confidential information which the young person has sought to keep private.
• Failing to disclose personal information which is required by law or under the terms of a court order, or where there is legitimate public interest argument for disclosure.
• Failing to disclose personal information when a child or young person may be at risk of serious harm, or causing an unreasonable delay in the disclosure.
• Failure to provide sufficient details to allow a relevant authority to respond, when a decision has been made to disclose personal information.
• Failure to seek consent to disclosure from a child or young person who has capacity to make an informed decision.
• Failing to establish the identity of an individual or agency making a request for an apparently lawful disclosure of personal information pertaining to a child or young person.

Key points

• Inform an appropriate agency without delay with any concerns that a child or young person may be at risk of abuse, suffering or neglect – and seek advice from experts or the MDDUS if in doubt.
• Seek consent from a child or young person judged to possess capacity to share their personal information, unless there is a compelling reason not to do so.
• Confidential information can be shared without consent if there is a justification in the public interest or it is required by law.
• Inform the child or young person if you have disclosed personal information without consent, providing details of what confidential information has been shared, with whom and for what reason – unless to do so would place the individual or anyone else at increased risk of serious harm.
• Always seek timeous advice from MDDUS if you are unsure what personal information to share and who to share it with, and to discuss how to manage any potential risks associated with the sharing of the information concerned.

Further guidance

• The Data Protection Act 2018
• GMC. Protecting children and young people: The responsibilities of all doctors
• GDC. Focus on standards (Principle 4: Maintain and protect patients’ information)

MDDUS Training & CPD resources: www.mddus.com/training-and-cpd