in Health Care

Session 4: Confidentiality and Privacy in Health Care

Medical Ethics — CMT/CDT NTA Level 4

Kolandoto College of Health Sciences Mwanza

A patient discloses personal and often deeply private information to a health worker in order to be helped.

This disclosure is made in trust, and that trust is the foundation of the practitioner-patient relationship.

If patients fear that their information will be revealed, they will withhold it, delay seeking care, or give false histories — and their treatment will suffer.

Confidentiality is therefore not merely a courtesy. It is a professional duty and, in Tanzania, a legal obligation.

Confidentiality

The duty of a health worker to keep secret all information obtained from or about a patient in the course of the professional relationship, and not to disclose it to any third party without the patient’s authorisation.

Privacy

The right of a patient to control access to their own person and their own information — including the right to be examined and interviewed out of the sight and hearing of others.

Respect for autonomy — the information belongs to the patient, not to the health worker.

Beneficence — confidentiality encourages full disclosure, which enables correct diagnosis and treatment.

Non-maleficence — disclosure can cause the patient real harm: stigma, loss of employment, marital breakdown, violence.

Fidelity — the health worker made an implicit promise of secrecy when the patient agreed to be treated.

The Hippocratic Oath and modern professional codes both make this duty explicit.

The Medical, Dental and Allied Health Professionals Act and the codes of the respective professional councils impose a duty of secrecy.

The HIV and AIDS (Prevention and Control) Act protects the confidentiality of a person’s HIV status; unauthorised disclosure is an offence.

The Law of the Child Act protects information concerning children.

Breach may expose the health worker to disciplinary action by the council, civil suit for damages, and in some cases criminal liability.

Clinical information

Diagnosis, test results, treatment given, prognosis, and the fact of attendance itself.

Personal identifiers

Name, address, age, occupation, photographs and any detail that could identify the patient.

Social and family history

Marital status, sexual history, income, religion, and information about relatives.

Records

Case notes, laboratory forms, registers, X-rays, referral letters and electronic records.

Information after death

The duty of confidentiality continues after the patient has died.

Incidental knowledge

Anything seen or overheard in the ward, theatre or clinic, whether or not you were treating the patient.

With the informed consent of the patient — this is the normal and preferred route.

To other members of the health care team who need the information to treat the patient (shared confidentiality).

Where the law requires it

Notifiable diseases — cholera, plague, yellow fever, viral haemorrhagic fevers.

Births and deaths registration.

Suspected child abuse or neglect.

By order of a court of law.

To prevent serious harm to an identifiable third party.

For approved research, audit or teaching — with the data anonymised.

Disclose only the minimum information necessary, and only to the person entitled to receive it.

Wherever possible, tell the patient before you disclose, and explain why.

Seek the patient’s consent even when disclosure is legally permitted.

Record in the notes what was disclosed, to whom, and on what authority.

If you are uncertain, consult a senior colleague or the facility ethics committee before disclosing.

Do not discuss patients in corridors, wards, canteens, buses or at home.

Conduct history taking and examination out of the hearing of other patients; use screens and curtains.

Keep case notes and registers in a locked cupboard; never leave files open on a desk.

Do not leave laboratory results, referral letters or prescriptions lying where others can read them.

Protect computers and phones with passwords; never store patient photographs on a personal phone.

Never post patient information, images or ‘interesting cases’ on WhatsApp, Facebook, Instagram or any social media.

Address patients discreetly when calling them from a waiting area.

In the facility

Discussing a case within hearing of other patients or relatives.

Reading the file of a patient you are not treating, out of curiosity.

Telling a relative the diagnosis before the patient has been told.

Leaving the HIV register or ART cards on an open counter.

Loud counselling in a room without a closed door.

Outside the facility

Telling family or friends about a patient you saw, even without naming them.

Sharing photographs of wounds, X-rays or patients on social media groups.

Discussing a well-known patient in the community.

Confirming to a caller that a named person is admitted.

Using patient cases as examples in public without anonymising them.

Children — a mature minor may be entitled to confidentiality; involve parents in the child’s best interests.

The unconscious patient — disclose to next of kin only what is needed for care and decision-making.

The patient with HIV — status may not be disclosed to a spouse without consent; counsel the patient to disclose, and follow the national guidelines.

Employers, insurers and the police have no automatic right to clinical information; they require the patient’s written consent or a court order.

The media has no right of access to any patient information.

For the patient — stigma, discrimination, rejection by family, loss of employment, violence, and loss of trust in the health system.

For the health worker — disciplinary proceedings, suspension or removal from the professional register.

For the facility — civil claim for damages, and loss of community confidence.

For public health — patients avoid testing and treatment, and disease control programmes fail.

Confidentiality is the duty to keep patient information secret; privacy is the patient’s right to control access to it.

The duty is ethical, professional and legal, and it continues after the patient’s death.

Confidentiality is not absolute — consent, legal requirement, and prevention of serious harm are recognised exceptions.

Disclose only the minimum necessary, to the person entitled, and document it.

Most breaches in practice are careless rather than deliberate — corridor talk, open files and social media.

Define confidentiality and privacy, and distinguish between them.

Explain four (4) ethical grounds for the duty of confidentiality.

List five (5) circumstances in which confidential information may lawfully be disclosed.

Describe five (5) practical measures for maintaining confidentiality in a busy outpatient department.

A police officer asks you to confirm whether a named person was treated for a stab wound. How do you respond, and why?

State the consequences of breaching confidentiality for the patient and for the health worker.