Confidentiality

MAIN TOPIC

Confidentiality DAVID BENATAR Confidentiality is an important principle in med- PhD ical ethics, but one that may be overriden in Associate Professor some circumstances. Philosophy Department Autonomy University of Cape Town Autonomous beings are those that are capable of controlling their own lives. They David Benatar works are beings that can deliberate and, in the mainly in moral phil- osophy and related absence of any external restrictions, act on areas. His interests their deliberations. Healthy adult humans are both theoretical typically are, in this sense, autonomous (to and applied. In addi- varying degrees). Given that they are tion to lecturing in the autonomous in this way, they have an Philosophy Department at the interest in having this autonomy respected. University of Cape Confidentiality protects the autonomy of Town, where he is patients by allowing them to control infor- based, he also teach- mation about themselves. This is particu- es Bioethics in UCT’s larly important given the often sensitive Health Sciences and personal nature of the information Faculty. that medical practitioners can acquire, and the damaging ways in which such informa- tion could be used. Unlike some other principles in contempo- Privacy rary bioethics, such as principles of Although privacy, like confidentiality, can (patient) autonomy and (doctors’) truth- foster a person’s autonomy, people also telling, the principle of confidentiality has tend to value privacy independently of been recognised since ancient times to be concerns about autonomy. Feelings of essential to the professional ethics of med- shame and vulnerability lead people to ical practitioners. As important as this value their privacy. Confidentiality obvi- principle is, however, it has limits. There ously fosters privacy by preventing the are some occasions when it is outweighed spread of privileged information that by competing moral considerations. would violate privacy. Determining when this is so is often diffi- cult. There is no simple formula that can Promise-keeping be applied to establish when confidential- Given that doctors undertake to preserve ity ought to be breached. However, if we confidentiality, the importance of confi- understand the values on which the princi- dentiality is also based on the value of ple of confidentiality is based, we are bet- promise-keeping. Sometimes the promise ter equipped to assess whether the princi- to keep information in confidence is ple ought to be sacrificed in a given cir- explicit, but it is often implicit. Patients cumstance. know that doctors have duties of confiden- tiality and have often taken oaths to affirm those duties. Patients consult doctors in UNDERLYING VALUES this knowledge and often without securing Confidentiality’s value is not intrinsic but explicit promises from the doctors directly rather instrumental. That is to say, the to them. The professional norms of pre- value of confidentiality is derivative from serving confidentiality are so widespread the other values it advances. We can distin- that patients can reasonably assume their guish four such values: autonomy, privacy, doctors to have implicitly promised to promise-keeping and utility (or welfare). keep confidence.

CME January 2003 Vol.21 No.1 11 MAIN TOPIC

Utility • the prevention of harm to the One way in which confidentiality Confidentiality in medicine greatly very person to whom the duty of dilemmas can become difficult is if enhances utility by leading to confidentiality is owed. it is unclear whether the harm is improved health care, both of the sufficiently weighty. Although a sig- We might call the former ‘harm to individual patient and of society. If nificant threat to life may defeat others’ and the latter ‘harm to the patients had no assurance that doc- the other values, it is less clear patient’. tors would respect confidentiality, whether more remote threats of they would be more reluctant to this kind, or significant threats of consult doctors. The upshot of this lesser harms, are strong enough. would be that many more people The dilemmas of A second and more common way would suffer and even die than is preserving confi- in which confidentiality dilemmas the case where people feel more dentiality arise in become vexing is seen if we exam- comfortable consulting doctors. An ine the fourth underlying value — individual’s health is therefore those situations in utility.Where confidentiality does improved. Public health is also which there is no not conflict with the prevention of improved, both by iterating the harm, all considerations of utility individual benefits and by avoiding consent to disclose. usually support the preserving of the exponential ill-effects of un- confidentiality. In cases of conflict, diagnosed contagious diseases. the usual utility of keeping confi- Harm to others dence (outlined above) must be The others may be one or many. MORAL LIMITS balanced against the disutility of For example, preserving confiden- One obvious condition that would doing so — the harm to others. In tiality about a patient’s HIV-posi- justify divulging confidential infor- other words, we are caught on the tive status may pose a threat to one mation is the consent of the person horns of a utility dilemma — sacri- other person (the spouse) if the to whom the duty of confidentiality fice the long-term utility of keeping patient is in a faithful monoga- is owed. Where such consent is confidentiality for the short-term mous relationship, or many other given, private information is con- gain of preventing harm, or pre- people (various potential sexual veyed but the duty of confidential- serve the long-term gain at the cost partners) if the patient is promis- ity is not breached. This is because of not preventing the more imme- cuous. the patient, in giving the consent, diate harm. The fact is that most of waives the right to confidentiality. In such situations, the patient’s the long-term benefits can be pre- Typically, the consent to convey interest in autonomy, privacy and served if breaches are sufficiently private medical information is lim- promise-keeping obviously persists. few. However, the erosion of these ited: the patient grants a medical However, the moral weight of these benefits is incremental with each practitioner permission to provide interests is limited. The value of breach, and their loss can thus specific information to a specific one person’s autonomy, for exam- creep up imperceptibly. person or group of people. ple, is bounded by the value of Harm to the patient others’ autonomy. My right to lead The dilemmas of preserving confi- Sometimes the person whom one my life as I please cannot extend to dentiality arise in those situations seeks to protect from harm is the limiting your autonomy (beyond in which there is no consent to dis- very patient to whom the duty of the limitation on your freedom to close. These dilemmas, at least in confidentiality is owed. Consider, interfere with me). Privacy and their most difficult forms, arise for example, a patient who does promise-keeping too have their where the principle of confidentiali- not want his diagnosis made limits. Thus, if any one of these ty conflicts with a principle of harm known to a spouse or parent even three values — autonomy, privacy prevention. It is helpful to consider though the spouse’s or parent’s or promise-keeping — were pitted separately two categories of harm knowledge of the diagnosis could against serious harm to others, the prevention: greatly benefit the patient. Or con- prevention of harm would certainly sider a patient whom a doctor prevail. Although they have greater • the prevention of harm to people finds to have been abused, but who strength together, they would still other than the person to whom does not want the doctor to make be outweighed by sufficiently seri- the duty of confidentiality is this known to other people, even ous harms to others. owed though such a disclosure could

12 CME January 2003 Vol.21 No.1 MAIN TOPIC prevent more such abuse. Where promise-keeping is defeated by the provide advance warning to the the patient’s autonomy is intact, prevention of harm to others. patient (or patient’s guardian overriding that autonomy in the where the patient is non- name of benefiting the patient is an HOW TO BREACH autonomous) of one’s plan to unwarranted form of paternalism break confidentiality.Very often and is unjustified (although Because breaching confidentiality one will find that at this point, a attempting to persuade the patient (without consent) always has some patient will decide that given the about the importance of disclosure cost, it should be avoided if possi- doctor’s intent, the patient would would be appropriate). ble. Thus the preferred first course rather disclose the information of action should be to persuade the himself, perhaps with the assis- patient (or patient’s guardian) of tance of the doctor. Where the Sometimes the per- the moral importance of disclosing patient does not relent, he or she the relevant information. Some son whom one will at least have the opportunity to medical practitioners are reluctant minimise the costs to himself in seeks to protect to bring moral pressure to bear on other ways. from harm is the patients to consent to disclosure. Such concern is sometimes well- very patient to founded where disclosure is the THREATS TO whom the duty of greater of the evils. However, CONFIDENTIALITY where it has been determined that confidentiality is Although the real dilemmas of breaching confidentiality may be whether to breach confidentiality owed. required, it is obviously preferable often interest doctors, there are to obtain patient consent for the highly suspect assaults on confi- disclosure. At least in such circum- dentiality that receive very little Autonomous agents have the stances moral pressure in eliciting attention. The most obvious of capacity to decide for themselves consent is entirely apt. these is indiscretion. Some doctors whether their welfare is best served are scrupulous in exercising discre- by breaches of confidentiality. Thus tion, but others are not. Many talk violating confidentiality to prevent One ought to break about patients in corridors, eleva- harm to the patient to whom confi- confidence in the tors and other public spaces. They dentiality is owed can be accept- least damaging way leave confidential documents lying able only where the patient’s around. They sometimes fail to capacity for autonomy is sufficient- consistent with the delete personally identifying details ly compromised or absent. In that required goal of when presenting cases at academic case, the autonomy is no longer a meetings. They talk with their value or, in the case of limited preventing harm. spouses or gratuitously with col- autonomy, a sufficiently strong leagues not involved in a particular value underlying the preservation patient’s care. Just mentioning that of confidentiality. The other three somebody is one’s patient can con- Sometimes, but relatively rarely, underlying values do remain intact. stitute a breach of confidentiality. consent is not forthcoming, and a As the patient cannot assess their Imagine a psychiatrist, for exam- breach of confidentiality is neces- relative value, a guardian or proxy- ple, making it known that a partic- sary. In such conditions, one prin- decision maker must make that ular person is his patient. Another ciple should govern the breach. determination on the patient’s form of indiscretion is poor control This is the principle of minimising behalf. Privacy and promise-keep- over patient files. Consider, for the costs of the breach. That is to ing considerations will typically example, a private doctor who, say, one ought to break confidence weigh less heavily for the incompe- upon retirement or sale of a prac- in the least damaging way consis- tent, and especially for those who tice, transfers all his patients’ files tent with the required goal of pre- were never competent. Although to another doctor without the venting harm. On this principle, they may have greater weight for patients’ consent. Patients, particu- one would be required to disclose members of the patient’s family, larly in the private sector, should the least information and to the they will be outweighed in the be entitled to choose which doc- fewest people necessary to attain same conditions under which a tors have access to their medical the goal. One ought usually also to patient’s interest in privacy or records.

CME January 2003 Vol.21 No.1 13 MAIN TOPIC

Less well-recognised by many doc- If patients had medical information tors is the threat that large hospi- about themselves that was not dis- FURTHER READING tals and medical teams pose to closed to private insurers, high-risk Bok S. Secrets: On the Ethics of Concealment and Revelation. New confidentiality.Where a patient is people would self-select into insur- York: Vintage Books, 1984: 116-135. cared for by a single doctor, per- ance schemes and low-risk people Siegler M. Confidentiality in medicine haps with an occasional referral to would opt out. The upshot of this — a decrepit concept. N Engl J Med a specialist, few people have access would be the eventual collapse of 1982; 307(24): 518-521. to information about the patient. the insurance scheme. If insurers Winslade WJ. Confidentiality. In: Reich In large hospitals and medical and insured both have access to WT, ed. Encyclopedia of Bioethics. New York: Macmillan, 1995: 451- teams, dozens of people may be the information then this problem 459. involved in a patient’s care and is avoided, but it is avoided at the hundreds of people might have cost of confidentiality.Very few access to a medical file. The prob- people would willingly disclose pri- lem is sometimes exacerbated vate medical information to insur- when medical files are stored elec- ance companies if they did not fear tronically. Not only is private infor- the alternative of being medically IN A NUTSHELL mation more widely known when uninsured. The disclosures, in • Confidentiality is an important so many people have access to it, effect, are coerced by circum- but non-absolute principle of but the risk of further information stance. Notice that this dilemma medical ethics. leakage is also greater. Institutional between insurance failure and loss • The moral value of confidential- safeguards, such as limiting access of confidentiality could be avoided ity is derivative from four under- to medical files, and clinical and by the community-rating of risks lying values: autonomy, privacy, clerical staff awareness about the characteristic of public health promise-keeping and utility (or importance of confidentiality are insurance. As everyone is automati- welfare). necessary to limit the damage that cally insured by such a system, • Where patients consent to infor- large medical teams do to confi- there is no need for the insurers to mation being divulged, there is dentiality. have private information about the no breach of confidentiality. insured in order to insure them. • The dilemmas of whether to Asymmetrical knowledge therefore breach confidentiality arise does not threaten public insurance. when this principle conflicts Very few people with the principle of harm-pre- would willingly dis- vention. CONCLUSION • The harm one seeks to prevent close private med- Confidentiality is an important may be either to people other ical information to principle in medical practice. than the patient or to the patient to whom the duty of However, it is not an absolute prin- insurance compa- confidentiality is owed. In the ciple. There are circumstances latter case it can be justified nies if they did not where it may be breached, typically only where the patient is not fear the alternative to prevent serious harm. Where the autonomous. of being medically principle is indeed outweighed by • Where confidentiality must be countervailing considerations, its breached, it should be done by uninsured. sacrifice is regrettable but justified. minimising the moral costs of Where confidentiality is sacrificed the breach. in the absence of competing values • Threats to confidentiality Private health insurance is another — as it is in cases of indiscretion, include: indiscretion, large hos- threat to confidentiality. This is for example — the breach of confi- pitals and medical teams and because of the danger that asym- dence is not only regrettable but private health insurance schemes. metrical knowledge would pose to also unjustified. a private health insurance scheme.

14 CME January 2003 Vol.21 No.1