Patient confidentiality and consent to publication

BMJ 2008; 337 doi: (Published 10 September 2008)
Cite this as: BMJ 2008;337:a1572

Recent rapid responses

Rapid responses are electronic letters to the editor. They enable our users to debate issues raised in articles published on Although a selection of rapid responses will be included as edited readers' letters in the weekly print issue of the BMJ, their first appearance online means that they are published articles. If you need the url (web address) of an individual response, perhaps for citation purposes, simply click on the response headline and copy the url from the browser window.

Displaying 1-8 out of 8 published

Yes you are right. The hyperlink "submit response" leads to the thread rather than to the original article and I should have spotted the title which then begins with "Re:". The right method was to go to the original article and then hit "submit response" (or write individually).

This one is intended as a response to a response!


(I did notice the error after it appeared online)

Competing interests: None declared

Abhijit M Bal, Consultant

Crosshouse Hospital

Click to like:

Dr Bal has submitted a response to my previous one and among other things, poses some questions. For the avoidance of doubt, my response was specifically dealing with a statement in Jane Smith's editorial and it was not addressing the issues raised in Dr Bal & others' first response of 13 October 2010. Hence, it appears that Dr Bal has chosen to use my response to relaunch and expand his view about the consent policies of some journals in relation to case reports.

Competing interests: None declared

Jay Ilangaratne, Founder

Click to like:

An overwhelming majority of case reports do not have any compelling public health issue. Patients can be identified in a case report if several identifiers come together. There is no better identifier than name. Consent forms therefore should not be sent to journal editorial offices unless explicit consent is taken for the specific process of transfer.

The main question here is that of trust. Do journals trust the authors? If they dont trust the authors' attestation of consent, on what grounds do they trust the authenticity of the signature and name on the consent form?

I dont know what is the risk of breaching confidentiality by the transfer of consent form with named data. However, loss of data from databases is certainly not unheard of. In that context of risk, what is the benefit of transfer of consent form over authors' attestation of consent? Clearly, there is no legal requirement for transfer of forms given that 4 reputed journals advise authors not to send the forms (see my previous response on this issue).

To me, the transfer of consent form with named data appears to violate patient privacy, something that the consent process is designed to respect. Authors should take serious note of this and journals should revisit their requirements. Journals should accept the authors' attestation of consent declared on the manuscript.

Competing interests: I (along with my coauthors) refused to transfer the consent form to a mainstream British journal instead preferring to withdraw the manuscript.

Abhijit M Bal, Consultant

Department of Microbiology, Crosshouse Hospital, Kilmarnock KA2 0BE

Click to like:

In Jane Smith's concluding paragraph [1], it is said " the Data Protection Act seems not to admit the possibility that the public health interest may demand publication of that information (to disseminate a public health message)". I am inclined to disagree with her suggestion.

In fact, as confirmed by the Press Complaints Commission[2],there are journalistic exemptions as the Government had clearly " acknowledged that journalists and the media must be allowed to process data about individuals without having their activities, including newsgathering, investigations and publication, scotched by the Act's requirements". Given the DPA does not define "what the public interest means in any context[2], it is surely not unreasonable to conclude that a compelling public health issue would squarely fall under such exemption.It is further confirmed that public interest includes [2], " protecting public health and safety".

Hence,there are no strong grounds to portray DPA as a barrier against proper publication of material (whether it is a case report or otherwise) if the 'public interest' requirement could be satisfied. In the circumstances, I do not think, there's anything to be "resolved" as suggested by Jane Smith [1]


[1]Editorials: Patient confidentiality and consent to publication. Jane Smith. BMJ 2008 337:a1572; doi:10.1136/bmj.a1572

[2] (accessed; 14.10.2010)

Competing interests: None declared

Jay Ilangaratne, Founder

Click to like:

We recently submitted a case report that was accepted by a journal published from the UK. We took the patient's consent but when the journal insisted on seeing the consent form, we withdrew the manuscript. We explain our reasons below.

At the time of submitting the manuscripts, authors are asked to attest that they have the patient's consent. However, journals often ask authors to transfer the consent form along with the manuscript in order to directly verify the form. Consent forms by their very nature include some clearly identifiable patient information such as the patient's name and they also include the manuscript title. The title often explicitly states the clinical illness described in the text of the manuscript. The transfer of a consent form with named patient data amounts to disclosure of a patient's identifiable health data.

We went through the instructions for submitting case reports for 42 British journals. A vast majority of journals (37/42) give some instructions in relation to obtaining consent. Nineteen journals ask the authors to send the consent forms to the editorial offices (3 out of the 19 want the forms only if patients are identifiable). Eighteen out of the 19 journals provide their own version of the consent form for the patients to sign but only one journal provides the information about transfer of health data by way of addressing the form to the editor. Journals suggest various ways of transferring the consent forms including post, fax, or electronic uploading of the form. Four journals specifically request the authors not to send the consent form across for reasons of privacy and they too have specific versions of consent forms. Data were last accessed on 23/09/2010. Even though the data do not have a direct bearing on the following discussion, we were reassured that at least four reputed journals shared our concerns.

In the UK, processing of personal data is governed under the terms of the Data Protection Act 1998 (1). Personal data is defined as data relating to a living individual who can be identified from those data, or from the use of those data in combination with other information which is in the possession of, or is likely to come into the possession of the parties responsible for the further processing of the data. Guidance on the provisions of the Act has been published by the Information Commissioner's Office (2). Disclosure of sensitive personal data needs the explicit consent of the patient or must satisfy the necessity test as per Schedule 3 of the Act.1 The General Medical Council also requires the doctors to inform the patients about the nature and purpose of disclosure when seeking consent (3).

Journal publishing houses do not provide medical care and case reports do not form a part of patient care. Hence, for disclosure of sensitive personal data in this context, the only relevant processing condition from Schedule 3 of the Data Protection Act is the explicit consent of the patient. It is one thing for patients to sign consent forms for disclosure of their potentially identifiable health data in case reports. Whether this is on a par with the actual disclosure of patients' names to journal publishing houses through transfer of consent forms needs further clarification. Consent forms with patient identifiable data can be lost or misplaced in post or at the publishing house and mistakes may happen when faxing the forms. Data stored electronically is also not entirely safe. Thus there is a clear risk of breaching confidentiality.

Several professional obligations and ethical issues also underpin our concerns. Some cases could relate to diseases that carry a burden of social stigma. Explicit mention of such conditions in the title of the manuscript printed on the consent form followed by accidental loss of the form may have consequences for the individual. Modern technology can precisely identify an individual with the help of combinations of data particularly if name and location are available. Author affiliations indirectly provide important clues in relation to the location of the individual (4). Many journals request consent forms at the time of initial submission prior to peer-review. Case reports have a high rejection rate and thus large amounts of identifiable health data is accessible at the publishing houses either physically or electronically even if cases do not make it to the print. The International Committee of Medical Journal Editors does not offer any firm advice in this regard because requirements vary between countries (5). We came across one case put before the Committee on Publication Ethics (COPE) where COPE agreed that there was no need for the journal to see the consent form following a dispute similar to ours (6).

What are the solutions that safeguard the interests of patients, publishers, and authors? If journals must go beyond authors' attestation, they could ask authors to get an additional attestation from, say, the Caldicott guardian of the health board in the UK (and any other competent authority in other countries). If however after a careful consideration of the legislative, professional and ethical issues, the processing of the consent forms in this manner is considered acceptable, then the forms should be suitably altered. The forms should make it explicit to the patients that they consent for both the clinical material to be published as well as for the transfer of their personal verification to that effect. The documentation should advise patients that the signed form identifying them with the case study will be sent by post or fax to the journal offices, their sensitive and named personal data will be stored by the publishing house for an indefinite period, and their named data would be accessible to the journal staff.

But there is an alternative. We believe journals should simply place more trust on authors' attestation and that patients should be reassured that privacy continues to apply even when they permit some of their health information to be published in case reports. We suggest that consent forms be archived in the patient's health records. In any case, we fail to see how a signed consent form with a name and a signature printed on it convinces the journal editors of its authenticity when authors' attestation of consent is not considered trustworthy. Thus, the value of transfer of consent forms remains unclear. Any benefit of transfer of named data must be weighed against the possible risk of breaching confidentiality and the consequences of such a breach. The ultimate responsibility of data transfer lies with the authors but journals also need to revisit some of their requirements that appear to facilitate the process.


1. Data Protection Act 1998. Document available at: Accessed on 05/08/2010.

2. Information Commissioner's Office. Use and Disclosure of Health Data: Guidance on the Application of the Data Protection Act, 2002. Document available at: -_use_and_disclosure001.pdf. Accessed on 05/08/2010.

3. Confidentiality: Disclosing Information for Education and Training Purposes. Supplementary Guidance, General Medical Council, 2009.

4. Smith J. Patient confidentiality and consent to publication. BMJ 2008; 337: a1572.

5. International Committee of Medical Journal Editors. Uniform Requirements for Manuscripts Submitted to Biomedical Journals: Ethical Considerations in the Conduct and Reporting of Research: Privacy and Confidentiality. Document available at: Accessed on 05/08/2010

6. Committee on Publication Ethics. Consent to publication for case details, and potential for journal violation of patient anonymity. Document available at: publication-case-details-and-potential-journal-violation-patient- anonymity. Accessed on 23/09/2010.


AMB conceptualized the study, acquired and analyzed the data, and wrote the manuscript. AMB, AC and AD interpreted and analyzed the data and critically revised the manuscript. SG substantially contributed to the design and critically revised the manuscript.

Additional comments:

We had submitted a longer version of this manuscript to three mainstream journals for publication but it was rejected by all the three journals. One of the journals provided us with reviewer comments. We have benefited from those comments and the current version posted in the "rapid response" is the revised version following that peer-review.

Competing interests: AMB, AC, and SG withdrew a case report from a mainstream journal published from the United Kingdom refusing to transfer the consent form signed by the patient whose case they had reported. AD has no conflict of interest to declare.

Abhijit M Bal, Consultant Microbiologist

Andrew Collier, Al Dowie, Sujoy Ghosh

Crosshouse Hospital, Kilmarnock KA2 0BE

Click to like:

Jane Smith points out how under the data protection act and guidance from the information commissioner, the BMJ is obliged to ensure all authors obtain consent for publication of case reports. As a Foundation Year 2 trainee keen to publish such interesting cases I can appreciate this need to protect patients, however, I have also experienced frustration in relation to the current consent process.

Smith points out that the Information Commissioner has advised doctors to think ahead when writing up cases, however, such forward planning is hindered by the current publication process. I recently decided to write up a case report and initially it was not clear which journal would be most interested in publishing the case as the story was still unfolding. What was clear, even on initial presentation, was that the case would be interesting enough to warrant publication. We therefore decided to obtain consent for publication in advance whilst the patient was in hospital under our general surgical care, and subsequently wrote the case up on discharge. However, when it came to submitting the case I discovered each journal had its own specific consent form, and would not except the generic one we had written and the patient had signed in advance.

To make the consent process easier for both authors and patients I would therefore like to propose that the International Committee of Medical Journal Editors agree a consent form that would be valid for submission across medical journals to compliment their excellent guidelines on "Uniform Requirements for Manuscripts Submitted to Biomedical Journals: Writing and Editing for Biomedical Publication"[1]. This would allow authors the ability to gain consent in advance and on a single occasion. If the case report was rejected by one journal the consent obtained would still be valid for submission elsewhere, not requiring the complication of a new consent form to be signed by the patient.

1. International Committee of Medical Journal Editors. 2007.

Competing interests: None declared

Competing interests: None declared

Robert W Aldridge, Foundation Year 2 Doctor

Royal Free Hospital. Pond Street. London. NW3 2QG

Click to like:

Jane Smith states that

"Isaacs and colleagues may well be right when they say that the early descriptions of child abuse and Munchausen’s syndrome by proxy would never have been published if consent had been needed"... a fine example of why consent should always be sought. The monstrous invention MSbP should have had to provide greater testament to its validity and veracity had privacy rules been followed. The damage is often done when opposing opinion - be it refusal of pubication by the "subject" or counter opinion - is not sought thereby allowing "open season" for anyone, physician or not, to pronounce widely on what may be falsified data. The latter will always be a danger with single case publication without "subject" consent or through anonymity - it is common knowledge that certain sectors of industry will use any means, fair or foul, to market and publicise their wares.

In respect of "child abuse"; that would require criminal investigation so the concept of publicising a single case study, or case series, into "child abuse" must be seen in that context - a patient/s, who is a victim/s, for which an investigation/s takes place, resulting in a judicial outcome/s; one wonders how that could later become a feature requiring specific victim details supporting a report of the abusive act/s in a medical journal. What informative value in a description of a single case, or indeed a series of dissimilar cases?


John H.

Competing interests: None declared

Competing interests: None declared

John P Heptonstall, TCM Specialist

Leeds LS27 8EG

Click to like:

Smith points out the potential legal pitfalls when submitting papers which might breach patient confidentiality. This is an issue discussed frequently at the regular quarterly meetings of editor members of the Committee on Publication Ethics (COPE). Examples include: the frustration of an author unable to obtain publication of his discovery of a new technique for confirming deliberate contamination of a sample sent for laboratory analysis; a paper describing a symptom in infants the authors believed associated with abuse was turned down by UK journals but eagerly accepted in Europe; an editor was very concerned that her journal might lose a major role in professional development of doctors engaged in psychosexual counselling if it were to demand consent in every case described; a paper had to be shelved which demonstrated that a rare neurological syndrome, previously ascribed to a specific brain lesion, was factitious. Although, as suggested by Smith, one solution might be to anonymise authors and their institutions, in many cases the benefit of attribution apparently overrules the desire to enhance understanding.

In my role as editor of BMJ ‘fillers’ this is a daily problem with the majority of contributions under such rubrics as ‘My most interesting patient’ unaccompanied by consent. When its necessity is pointed out to authors, many are amazed and some outraged. I have been accused of political correctness and the journal of unnecessary bureaucracy and cowardice in the face of regulators.

Frequently authors and editors have been misled by their belief in a ‘public interest’ defence as outlined in the current General Medical Council advice in its booklet Confidentiality:Protecting and providing information (2004)[1]. Notwithstanding that the law and professional regulation are not identical and while Smith points to a helpful QandA that can be found on the GMC website, that body’s written guidance deals with research, clinical audit, administration and epidemiology but not with such mundane matters as the publication of case reports or small case series. At present the GMC is consulting on a new edition. Hopefully these types of publication will be included so helping clarify the situation for editors and authors.

[1] http://www.gmc- (accessed 11.9.08)

Competing interests: The author chairs General Medical Council Fitness to Practice Panels. The views expfressed are hois own and do not purport to be those of the GMC. He is also an associate editor of the BMJ but has no idea whether it agrees with is opinions.

Competing interests: None declared

Harvey Marcovitch, Chairman, Committee on Publication Ethics

OX15 6JW

Click to like: