Patient Data Exceptions

General Exceptions

Disclosures of personal data generally require consent. There is an exception where processing is required urgently to prevent injury or other damage to the health of the person or serious loss of or damage to property. There is also an exception where processing is required for the purpose of legal advice or for the purpose of legal proceedings in which the person making the disclosure is a witness or party.

There are a number of exemptions from disclosure, including:

• Information preventing, detecting, and investigating offences.
• Where access would be likely to harm certain public interests of the state judicial system.
• Where access is sought to legally sensitive or privileged information.
• Where granting access would result in disclosing confidential information about another individual unless that other individual has consented to the disclosure.
• Where an expression of opinion about personal data was given in confidence.

There is an exception relevant to medical records permitting an exemption from the ordinary obligation to disclose where the information is kept only for the purpose of statistics or carrying out research, the information is not disclosed to anyone, and the results of statistical work or research are not made available in a way that identifies any of the individuals.

There are provisions in relation to modification of access in relation to health. In particular, it prohibits or limits the right of access where the supply of health data to a patient would cause serious harm to his or her physical or mental health. The data is to be communicated only by or after consulting the patient with an appropriate medical or appropriate health professional.

Freedom of Information

See the sections on freedom of information. Freedom of information allows a right of access to records held by public bodies, the right to have public information in the record amended if it is incomplete, incorrect, or misleading, and the right to obtain reasons for decisions affecting an individual.

Freedom of information rights apply to all members of the public. It covers records created by a public body. There is an exemption from freedom of information records if allowing access would involve disclosure of personal information. This is information about an identifiable individual that would, in the ordinary course of events, be known only to the individual or his family or friends or which is held by a body on the understanding that it will be treated as confidential information.

The person concerned is not subject to this restriction, so that person may seek information using freedom of information legislation. Once again, this effectively gives a presumptive right to one’s own medical records.

Refusal FoI

There are exemptions where the information is already public and where disclosure of personal information is permissible in order to avoid serious imminent danger to the life or health of a person, exceptions where the person to whom it relates consents to it being disclosed, where the information was provided on the basis that it will be made public, where the information relates to a record of a medical or psychiatric nature affecting the requester, and where the disclosure might be prejudicial to the health, mental health, well-being, or emotional condition of the requester.

The head of a public body or a nominated head of the body for freedom of information purposes may grant access to a record that is otherwise excluded on the basis that it contains personal information if satisfied that the public interest in granting the request outweighs the public interest in protecting the information, protecting the person to whom the information relates, or if granting access would benefit the person in question. If information is to be disclosed to the public, the person to whom the information relates must be consulted and provided with the opportunity to make submissions.

Access to information may be refused where it relates to confidential information. Confidential information may be either a record or information given to the body in confidence and on the understanding that it would be treated as confidential, and the disclosure would be likely to prejudice the giving of similar information to the body, and the supply of such information is important to the body. Alternatively, data may be confidential if the disclosure would constitute a breach of a duty of confidence.

Where the head of the body concerned is satisfied the public interest would be better served by granting than refusing the request, he may override the confidentiality exemption.

A request may be refused where it might reasonably be expected to endanger the life and safety of any person.

Minors and Inacapacity

The Minister may make regulations for the grant of a freedom of information request by the individual to whom the record concerns if it belongs to a class specified in the regulation, and the requester is the guardian or parent of the individual, or the individual to whom the record concerns is dead and the requester is a member of a specified class.

In the case of a minor or a person suffering from mental or physical incapacity, a request made by a parent or guardian, which in the opinion of the head of the body for freedom of information purposes is in the best interests of the minor or incapacitated person, may be granted.

The guidance notes set out factors to be considered. In relation to incapacitated persons, the question of whether it is a permanent or temporary incapacity is relevant. There is guidance on how to assess whether the person would consent to release if they were able to do so. This considers the benefit to the requester, whether the information is essentially private and sensitive, or whether it contains information relating to the incapacitated person’s background, it may not be appropriate to release.

In the case of minors, consultation is not mandatory. This is left to the decision maker. The objection of the minor is not determinative.

The Supreme Court considered the issue in relation to access sought by a parent in contentious circumstances to a minor’s records. The court acted on the basis of the presumption that the parent’s intentions were in accordance with the child’s best interest. However, the subsequent children’s referendum has lessened this principle, emphasizing the best interests of the child over the inherent right of the parents.

Deceased Persons

In the case of deceased persons, requests may be granted if made by the personal representative, the person to whom a function is conferred in relation to the estate, the spouse, or the next of kin of the individual concerned. There are ministerial guidance notes to support the regulations.

There are regulations in relation to access to the records of deceased persons. Proof of death is required. Access by spouse or next of kin is the subject of public interest. Guidance notes set out factors to be considered, including the confidentiality of information that is particularly sensitive or private, whether the deceased would have consented to release if alive, the nature and circumstances of the relationship of the requester and the deceased.

The matter was considered by the Supreme Court where a person sought information about his deceased grandmother, in particular her age. The Supreme Court differed from the High Court, rejecting a right of privacy after death. However, other cases have suggested that a person may retain privacy and dignity rights after death.

Guidance

The Medical Council advises medical records to be retained for as long as they are likely to be relevant to the person’s care, or the time the law or practice standards require.

The HSE has published guidance on record retention periods. It urges that a balance be sought between indefinite storage and necessity. Data protection rules require that data be kept no longer than necessary. The guidance suggests retention periods between 24 hours and indefinite periods depending on the nature of the records concerned.

The Medical Protection Society suggests:

• For an adult, eight years after the last treatment or death.
• For children, until the patient’s 25th birthday or eight years after the patient’s death.
• Maternity records, 25 years after the birth of the last child.
• In the case of a mentally disabled or disordered person, 20 years after last treatment or eight years after death.