Patient confidentiality and consent to publication

In medicine stories about individual people are important. Knowledge emerges from cases and ethical questions are explored through them, which is why medical journals have traditionally published them.

Once doctors just wrote up their cases and sent them to journals and that was it. Now they know that they need to get the patient’s consent before doing so.1 But sometimes the authors can’t trace the patient to ask for consent, and sometimes they don’t want to ask the patient. This week, Isaacs and colleagues describe the events surrounding a case report that they submitted to the BMJ two years ago.2 We declined to publish it because they did not have consent, but they argue that consent would have been difficult to obtain without jeopardising the clinical relationship with the parents, and that the public interest over-rides the need for consent. The case report was published in an Australasian journal,3 and we also publish commentaries from the editor of that journal explaining why he published it4 and two members of the BMJ’s ethics committee explaining why they recommended that we shouldn’t publish it.5

When we declined to publish this case we did so on ethical grounds. But now it is clear that under data protection legislation we couldn’t have published it legally without consent. The UK’s Data Protection Act and subsequent guidance from the Information Commissioner6 make it clear that medical information about an identifiable living patient can be published only with the explicit consent of the patient (or parents in the case of a child). Although there are public interest exemptions for other disclosures of medical information (for example, for research), there are none for publishing the information—that is, putting it into the public domain. This restriction applies to the BMJ as the publisher of the information and not just to authors.

Isaacs and colleagues are correct to say that at the time they submitted their paper we did allow exceptions to a demand for explicit consent. If the message was important, the patient impossible to trace, and the likelihood of offence small, we did occasionally waive the need for consent. Now we can’t allow those exceptions, and we have amended our guidance to make this clear (http://resources.bmj.com/bmj/authors/editorial-policies/copy_of_patient-confidentiality). The General Medical Council’s guidance is similarly clear.7

The only way that we can publish information on individual patients without explicit consent is if we can anonymise it adequately. What is adequate? The advice of the UK’s Information Commissioner is that it has to be such that an investigative journalist would not be able to identify the patient from the report (personal communication), but it is hard to know what that means. The test a court has traditionally applied is whether a reader, knowing the underlying facts, would reasonably be able to identify the person being discussed.

The Information Commissioner’s other advice to doctors is to think ahead—if you think you might want to write up a case or cases, ask for consent before you lose touch with the patients. In our experience of asking authors to get consent, patients rarely refuse it.

But if there is no consent because the author cannot trace the patient, and the message is important, we will consider whether the case can be anonymised. This will usually mean losing detail (but not changing it), and at the extreme it may mean publishing the case with no information about the authors. The biggest clue to patients’ identities is often the hospital and the clinicians who looked after them.

The policy doesn’t apply just to case reports. It may affect any article that describes patients in enough detail to allow them to be identified. It might, for example, apply to a table in a research study providing clinical and demographic details of a small group of people. We now state in articles whether consent was obtained or whether it isn’t required. It may not be needed because the case has been anonymised, because the patient is dead (in which case data protection law doesn’t apply), or because the case is hypothetical (for example, it has been invented for educational—or literary—purposes).

Isaacs and colleagues may well be right when they say that the early descriptions of child abuse and Munchausen’s syndrome by proxy would never have been published if consent had been needed.2 What is clear is that under current data protection legislation the cases would have to have been presented very differently, probably with less detail and without identifying the authors. Nevertheless, an unresolved discrepancy exists between the Data Protection Act and the Human Rights Act. Under the Human Rights Act public health reasons may over-ride the ordinary restrictions on disclosing personal or private information, even in the absence of consent,8 but the Data Protection Act seems not to admit the possibility that the public health interest may demand publication of that information (to disseminate a public health message). Unless and until that is resolved, we have to accept that society has decided that a loss of communication about matters of public health importance is the price to be paid for the right of an individual to have control over the publication of his or her own medical information.