Throughout the day, practice staff regularly deal with situations which, if handled wrongly, could lead to patient information being shared without consent. These situations are both common and high-risk.
To a GP, the way to handle most of these situations will be evident. But rushed induction training, pressure from patients, workload and building design issues can all conspire to make these simple but frequent situations become something larger.
How practices can breach confidentiality
Let’s look at a selection of scenarios:
Mrs Henderson has phoned. Her husband has some mobility issues but recently had some bloods sent off. He has told his wife to ‘get on the phone and find out these results’. Your receptionists know the couple well.
The risk here is that Mr Henderson has never formally written to say that his results can be shared with his wife. This is a very common event and many receptionists, being familiar with the couple, will feel pressurised to give the result to Mrs Henderson for the sake of expediency and to be able to get onto the next call.
One of the GPs has asked a receptionist to phone a patient as the secretary is off sick today. The patient’s results are in and the GP wants her to have an appointment. The patient is having a lot of difficulty hearing the receptionist due to background noise and a slight hearing impairment which is usually not a problem. The receptionist has to raise her voice a bit to be heard and arrange a time. The patient’s daughter happens to be in the waiting area.
Pressure of staff and time has led to a breach of confidentiality and, in addition, has put the receptionist in a difficult position. This has the potential to cause unintended upset to the patient and her family and a complaint may arise.
Your new receptionist, a young man, has been settling in well and is proving popular with patients. One day, a girl he knows and has not seen for a while comes in for an appointment. Once he gets home, he decides to message her to invite her out for a drink and a catch-up – she has been a Facebook friend since school days.
New and inexperienced staff may lack the knowledge to help them identify boundaries. This kind of situation is most common in smaller communities but can also occur in larger towns. Social media by its very nature encourages instant communication and discourages pause for thought.
Confidentiality action plan
Because of the complex nature of a GP surgery, new and interesting confidentiality situations arise continuously. Although most practices will have the basics in place, competing priorities often mean that a potentially high-risk area is overlooked.
What steps can practices take to lower the risks?
Ensure that the confidentiality clause in contracts of employment also refers to the practice’s confidentiality policy.
Ask all staff to sign the policy and any subsequent copies re-issued after review.
Make sure your policy is up to date. Social media should at least be part of the policy or, ideally, should be covered by a linked, separate policy.
Ensure the policy is readily available in hard copy, on the server and on the intranet.
As well as training staff at induction, introduce annual confidentiality training updates. Consider occasional face-to-face training with an expert; on line training has its place but the opportunity for discussion with other practices is invaluable. Practices across a CCG or CHP will benefit from joint training events.
As a team exercise, identify confidentiality risk areas or risk activities. Using scenarios will help keep this lively and engaging. Assess the risk and potential for harm as a team, and take appropriate action to minimise the risk. This may involve additions to your policy and further training. On occasion, surgery design may itself be contributing. Think of ways of moving higher-risk activities behind a closed door or further away from patient areas.
Encourage staff to identify confidentiality ‘near misses’. Devise a simple, accessible and quick system for recording these. Investigate them objectively, paying attention to how the practice’s systems or circumstances at the time of the event conspired to create the near miss. As above, review policies and training if necessary.
Agree a policy on staff as patients. In a larger town, this may be to ask new staff who are registered with the practice to move to a different GP. In a small community where staff have to be registered, review your policy to make sure it is still relevant. Agree principles: no access at all to own or family records or access all areas for all? Update the written policy, contract of employment and training accordingly.
Devise a confidentiality undertaking to be signed by visitors to the practice.
- Agree a policy on local school students who hope to study medicine and want to ‘sit in’ for a while with a GP.
Fiona Dalziel is a practice management consultant www.dlpracticemanagement.co.uk