During public health emergencies, healthcare organizations face the difficult challenge of trying to protect patient privacy while also helping to prevent the spread of disease.

Even during these emergency public health concerns, maintaining the privacy of personal health information remains a fundamental principle of healthcare. To enable disease surveillance, contact tracing, and other public health actions, limited disclosures may be necessary in emergency situations like infectious disease outbreaks.

Furthermore, in these situations, healthcare organizations must carefully balance individual privacy rights with the need to protect public health. Any disclosure of patient information should be legally permitted, limited to what is necessary, and made only for legitimate public health purposes.

 

Confidentiality in healthcare

Confidentiality in healthcare refers to the obligation of healthcare providers to keep a patient’s personal health information private unless the patient consents to its disclosure. This concept is both a professional standard and legally enforced through laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the General Data Protection Regulation (GDPR).

Patient confidentiality encourages trust between patients and healthcare providers. When patients know their personal information will be kept private, they are more likely to share accurate and complete information about their health. This allows providers to make informed decisions, leading to more accurate diagnoses, appropriate treatment, and better patient outcomes. As noted in the study ‘Trust and Privacy: How Patient Trust in Providers is Related to Privacy Behaviors and Attitudes’, “patient concerns about the privacy of their health information can impede their access to health care and hinder disclosure to providers, creating incomplete medical records.” This supports the idea that openness is required for accurate diagnosis, informed clinical decision-making, and effective treatment. Without confidence that their information will remain private, patients may be reluctant to disclose critical details about their health, potentially compromising the quality of care they receive and leading to poorer health outcomes.

However, there are circumstances where maintaining strict confidentiality might conflict with the duty to protect public health. For instance, during an outbreak of a highly infectious disease, healthcare providers may need to share patient information with public health authorities to prevent the spread of the disease.

See also:

 

Ethical principles guiding confidentiality

In the article ‘Respecting Privacy and Upholding Confidentiality: Core Ethical Duties’, Vishal G. Shelat argues that confidentiality is a fundamental ethical responsibility that forms the foundation of patient trust and supports the delivery of high-quality healthcare.

Respect for autonomy, one of the principles guiding confidentiality, recognizes patients' right to control their personal health information. As Shelat explains, “privacy refers broadly to an individual's right to control access to themselves and their personal information.” In contrast, “confidentiality refers to a physician's professional duty to safeguard patient information shared in the course of care.” Thus, protecting confidentiality encourages patients to disclose sensitive information honestly, enabling accurate diagnoses and effective treatment.

The principles of beneficence and non-maleficence require healthcare professionals to act in patients' best interests. At the same time, they “are not absolute and may be overridden under specific, ethically justified circumstances,” such as when disclosure is legally required or necessary to protect others from serious harm.

The article also emphasizes fidelity, describing confidentiality as “a moral promise embedded within the professional identity” of healthcare professionals. By safeguarding patient information and limiting disclosures to the minimum necessary, providers uphold patient trust while balancing their ethical and legal responsibilities.

 

Legal obligations in public health emergencies

According to MedlinePlus, “all US states have a reportable diseases list. It is the responsibility of your provider, not you, to report cases of these diseases. Many diseases on the list must also be reported to the CDC.”

For example, in the United States, HIPAA allows for the disclosure of patient information without consent when it is necessary to prevent or control disease, injury, or disability. Similarly, the GDPR includes exceptions for the processing of personal data in the context of public health emergencies, such as pandemics.

There are also situations where healthcare providers have a legal duty to disclose patient information to protect others from harm. For example, when someone is diagnosed with a communicable disease such as tuberculosis, certain cases must be reported to public health authorities to support contact tracing and limit further transmission. Depending on the circumstances and local laws, information may also be shared with people who have been exposed to the infection, even if the patient has not given consent.

Even when disclosure is permitted, healthcare providers should share only the minimum information necessary and only with those who are legally authorized to receive it. This protects patient privacy while supporting efforts to prevent or manage serious public health risks.

 

When is breaching confidentiality justified?

The decision to break confidentiality requires careful consideration of both the potential harm to the patient and the potential benefit to public health. Here are some key scenarios where breaking confidentiality may be justified:

Communicable disease reporting

Many countries have laws that mandate the reporting of certain communicable diseases, such as COVID-19, tuberculosis, and HIV. In these cases, healthcare providers are required to notify public health authorities to help track and control the spread of disease. While this may involve disclosing patient information, it is generally considered an acceptable breach of confidentiality due to the public health risk.

 

Contact tracing

During outbreaks of infectious diseases, contact tracing helps in controlling the spread of the virus. This process involves identifying individuals who have been in close contact with an infected person and notifying them that they may have been exposed. In some cases, this may require disclosing the identity of the infected person, although efforts are usually made to minimize the amount of personal information shared.

 

Pandemic response

During public health emergencies, such as the COVID-19 pandemic, governments may introduce temporary measures that allow healthcare providers to share certain patient information without consent. These disclosures are intended to support public health activities, including disease surveillance, contact tracing, and vaccination programs, with the aim of slowing the spread of infection and protecting the wider community. Even during a public health emergency, healthcare providers should disclose only the information necessary for the situation and do so in accordance with applicable privacy laws.

Read also: When can confidentiality be broken?

 

Balancing ethical considerations

In situations where breaking confidentiality is justified, healthcare providers must carefully weigh several ethical considerations, including promoting patient well-being, preventing harm, respecting patient autonomy, and ensuring fairness in how decisions are made and applied.

Here are some key considerations when making these decisions:

  • Minimize harm: While it may be necessary to disclose patient information, healthcare providers should aim to minimize the harm caused by the breach of confidentiality. This may involve disclosing only the minimum amount of information necessary to protect public health and limiting the number of individuals who have access to this information.
  • Transparency: Whenever possible, healthcare providers should inform patients when their information will be disclosed and explain the reasons for the breach of confidentiality. This maintains trust between patients and providers, even in difficult circumstances.
  • Public interest vs. Individual rights: Providers must carefully weigh the public interest in disclosing information against the individual’s right to privacy. In some cases, the potential harm to the public may be so significant that it justifies a breach of confidentiality. In other cases, the harm to the individual may outweigh the public health benefit.
  • Proportionality: The decision to break confidentiality should be proportionate to the level of risk. For example, a minor risk of transmission may not justify a significant breach of confidentiality, while a high risk of transmission during a pandemic may warrant more extensive disclosures.

See also: Understanding permissible disclosures in an emergency

 

FAQS

What types of information can be disclosed during a public health emergency?

During a public health emergency, healthcare providers may be allowed to disclose information such as a patient’s diagnosis, contact information, and the identity of people they may have exposed to the disease. However, the amount of information disclosed should be the minimum necessary to protect public health.

 

Can a patient refuse to allow their information to be shared during a public health emergency?

In most cases, if there is a significant risk to public health, patients cannot refuse to allow their information to be shared. For example, laws often require healthcare providers to report certain communicable diseases to public health authorities, regardless of the patient’s wishes. However, patients should be informed about the disclosure whenever possible.

 

What happens if confidentiality is broken inappropriately?

Inappropriate breaches of confidentiality, where patient information is disclosed without a valid reason, can result in legal consequences for the healthcare provider, including fines, lawsuits, and loss of professional licenses. The patient’s trust in the healthcare system can also be severely damaged.

See also: