12/05/2006 2:11pm

Address by Sarah Kerkin to the Consent in Child Health Workshop
6 August 1998

Introduction

Disclosing information about patients raises privacy issues under the Health Information Privacy Code 1994 and broader issues of confidentiality derived from health professionals' ethical duties. At first glance, the issues can seem very complex but if the various elements are separated and considered individually, it is much easier to both identify and follow the duties.

The issues of privacy and confidentiality are thrown into sharp relief when dealing with patients who are children. On the one hand, the professional's primary ethical duty is to the patient. On the other, the professional is dealing with a patient who may be well under the legal age of consent and who may or may not be competent (in terms of understanding) to consent to treatment. The professional may also have to deal with anxious parents or guardians who, not unnaturally, want to know about the situation. Balancing these competing interests is not easy and has, in the past, come down to professionals exercising their judgement based on clinical and ethical issues. The law has tended to mirror this approach. The Privacy Act has not substantially changed it, as I shall explain.

So how does the Privacy Act - or the Health Information Privacy Code 1994, which applies in respect of health information and health professionals - address these issues?

Parents do not have an automatic right to information about their children. As with other rights-based legislation in New Zealand, the Privacy Act and the Code draw no real distinction between their application to children and to adults. This is not a novel concept. Confidentiality of information about children - particularly with older children - has long posed difficult issues for health professionals, just as consent to treatment has posed difficult issues. The Privacy Act only adopts existing notions that children have a degree of autonomy which does not rely on a particular age.

The tension between parents' rights and children's rights can pose problems for health professionals who want or need to disclose information to parents to enable the parents to give informed consent to treatment. Although the law seems confusing, the tensions can be identified through outlining the framework of ethics and law which overlay privacy and confidentiality.

In my experience, privacy law is sufficiently flexible to meet most, if not all, situations involving patient information. Clinical and therapeutic issues are little affected by the law, and they pose the most difficult problems. The balance between retaining a patient's trust and fulfilling functions as health professionals is very delicate indeed, particularly when the patient's wishes and the professional's opinion are at odds.

Age, consent and information

It is not within the scope of this paper to summarise the law of informed consent as it relates to children. Nor should it be assumed that the law will translate well into a privacy context. But there are some similarities.

There are numerous cases, in New Zealand and overseas, about the treatment of children and whether competence to consent should be determined by age or capacity. (1) Gillick v West Norfolk and Wisbech Area Health Authority (2) adopted an understanding-based approach: children acquire capacity to have lawful dealings in cases of medical treatment within their minority, provided they have the requisite understanding and maturity to enter the transaction. This will be a question of fact in each case(3)

To some extent that approach has been mirrored in New Zealand through the Code of Health and Disability Services Consumers' Rights, which does not adopt an age test. Instead, it provides that consumers with diminished competence retain the right to give informed consent to the extent appropriate to their level of competence. (4)

The application of an understanding-based test is more complex and requires more careful judgement than does a status-based test, which ignores the fact that children are often autonomous, intelligent beings before their 16th birthdays.

In view of the apparent willingness of the law and clinicians to listen to the views of mature minors, the Privacy Commissioner did not consider that fixing a particular age in the Code would be particularly helpful. The Code has essentially adopted an understanding-based test for the ability to exercise rights under it.

If you would be prepared to listen to the views of a mature minor in respect of treatment, you should do the same with respect to his or her personal information, the implications of which I shall explain later.

Privacy, confidentiality and trust

It is hard to over-emphasise the importance of trust in the therapeutic relationship. Patients often have to divulge sensitive personal information in order to obtain treatment. Children - particularly older children - may not want their parents to know this information. They may find it difficult to confide in anyone, even (or perhaps especially) health professionals. They will do so only if they can trust the health professional not to judge and not to breach their confidences.

Health professionals need patients' cooperation and information to treat effectively, and must win their trust before patients will confide in them. Privacy and confidentiality are the means by which health professionals gain their patients' trust. Assurances of confidence and discretion tell patients that it is safe to confide in professionals, that their secrets will not be divulged. They tell patients that professionals respect their autonomy, dignity and sensitivity. This is the key to gaining trust because it allows those first steps towards building a relationship to be taken. It is no different for children - particularly older children- than for adults.

If patient expectations of confidence are not met and patients do not feel respected, this trust will never grow. The therapeutic relationship may never develop to a point where patients have faith in professionals, so professionals cannot be confident in patients' candour. This is important, because professionals rely on patients' information and reporting to a certain extent in making a diagnosis. If patients do not trust professionals sufficiently to be candid, there will be serious implications for the professional's ability to treat them effectively. This may in turn, have serious implications for the patient's overall health and for the efficient allocation of health resources.

All of these issues need to be weighed in deciding whether or not to disclose information, quite apart from what the law requires. These issues provide the basis for the framework of law and ethics which regulates the disclosure of patient information.

This framework contains a number of elements, which can be broken into two broad categories: anticipated disclosures and unanticipated disclosures.

Anticipated disclosures

Anticipated disclosures are the disclosures most easily addressed. They occur when the need to disclose has been anticipated at the point of obtaining the information: the intention to disclose has existed from the start.

There are two key concepts in the Health Information Privacy Code 1994:

purpose;
openness.

Anticipated disclosures tend to accord fairly closely with these concepts.

Rule 11 of the Code allows information to be disclosed if the disclosure was one of the purposes for which the information was obtained in the first place.

If the information to be disclosed was collected directly from the patient or a representative, they would normally have been informed of the purpose at that stage in accordance with the principle of openness. (5) The Code does not require consent to be obtained for these anticipated disclosures: it is purpose-driven, not consent-driven.

Purpose and openness have a number of advantages, not the least of which is that if information policies are established and patients are alerted to them, agencies are less likely to breach the Code. They are also less likely to receive complaints, because people tend to complain about disclosures when they are unpleasantly surprised to find that they have occurred.

There are two further advantages:

1. The patient understands the purpose and has the opportunity to express any concerns with the intended disclosure. Although the Code does not require patients to consent to a disclosure when that is a purpose for obtaining the information, some ethical obligations might require consent, so this provides an opportunity to obtain it;

2. The purpose is clearly established before the disclosure is made, providing a clear response to a complaint made to the Privacy Commissioner.

So if anticipated disclosures mean the purpose for collecting the information has been established, what are the purposes for obtaining health information? One of the purposes for obtaining information about a patient's health is to provide appropriate treatment. Given that obtaining informed consent is an integral part of providing treatment, it seems clear that one of the purposes for which health information is collected is to give patients sufficient information for them to grant informed consent for treatment.

If the person who is to receive treatment does not have the capacity to consent to it, then consent needs to be sought from another, appropriate, person. That person, too, needs sufficient information in order to grant informed consent. Thus, health professionals are in a strong position to argue that, when collecting information to treat a child whose parents or guardians will be asked to grant consent, one of the purposes for obtaining the information is to disclose sufficient information to the parents or guardians for them to grant consent.

When treating children, there will always be an issue about who should consent to the treatment. The issues are perhaps more easily resolved for very young children than for older children or mature minors, who may well have their own views on what is appropriate for them. Health professionals prepared to consider a mature minor's views on treatment should also take account of his or her views on privacy and confidentiality. Therefore, when information is collected from the mature minor, he or she should be made aware of the matters required by rule 3, just an adult would be. (6) This would include advising that some information will be disclosed to the parents if the parents are to be asked to give informed consent.

Facilitating informed consent does not necessarily involve disclosing the child's entire medical records. It means disclosing that information which is necessary to enable the parents to grant informed consent. Right 6 of the Code of Health and Disability Services Consumers' Rights may provide a good guide as to the information that a reasonable consumer would expect to receive:

(a) An explanation of his or her condition; and
(b) An explanation of the options available, including an assessment of the expected risks, side effects, benefits and costs of each option; and
(c) Advice of the estimated time within which the services will be provided; and
(d) Notification of any proposed participation in teaching or research, including whether the research requires and has received ethical approval; and
(e) Any other information required by legal, professional, ethical, and other relevant standards; and
(f) The results of tests; and,
(g) The results of procedures.

If this kind of information would normally be disclosed to facilitate informed consent, that would seem to be a purpose for obtaining the information. So disclosure to the parent being asked to give informed consent to treatment of a child would seem to be allowed by the Code.

Unanticipated Disclosures

The more difficult problems arise when the need for disclosure has not been anticipated, so it is not one of the purposes for which the information was obtained. This is often where health professionals make the mistake of heading straight to rule 11 of the Code and assuming the disclosure cannot be made. In fact, there are a number of laws which apply to personal information and they may need to be considered.

The Privacy Act and Code do not detract from any law which authorises or requires information to be made available .(7) So where there is such a law, it should be followed.

The distinction between laws authorising and requiring disclosure is important. If a statute requires disclosure, the disclosure must be made. It will not breach the Health Information Privacy Code. The New Zealand Medical Association's code of ethics allows disclosures which are required by law. It would be very surprising if other professional bodies would be prepared to find someone guilty of a breach of ethics through making a disclosure which was required by law.

If a statute merely authorises disclosure, health professionals are left with a discretion: they can choose not to disclose. While disclosure in accordance with such a law will not breach the Code, some codes of ethics will not allow it so the disclosure may well breach ethical duties.

It is therefore important to be very clear about whether the disclosure is required or only authorised. Words like 'shall' indicate that the disclosure is required, 'may' indicates that the professional has a discretion.

There are two statutory provisions which are relevant to the issue of disclosing children's health information to parents.

Code of Health and Disability Services Consumers' Rights

The Code of Consumers' Rights is a law, because it is contained in statutory regulations. Therefore, if it requires or authorises the disclosure of personal information, that will not be overridden by the Health Information Privacy Code .

The Code of Consumers' Rights contains a number of provisions which are relevant to the issue of informed consent. As already noted, individuals with diminished competence have the right to give informed consent to the extent appropriate to their level of competence.

Right 6(1) gives consumers the right to certain information. Right 6(2) provides that before giving consent, every consumer has the right to the information that a reasonable consumer, in that consumer's circumstances, needs in order to give informed consent. Right 7(1) provides that services may be provided only if the consumer has given informed consent, except where other enactments, the common law or the Code of Consumers' Rights provides otherwise.

'Consumer' is defined to include a person entitled to give consent on behalf of the consumer. Section 25 of the Guardianship Act 1968 provides that guardians may give consent to a medical, surgical or dental procedures where that is necessary or sufficient. Guardians may therefore be asked to give informed consent to treatment of a child under 16, although it should be remembered that children seem to have a right to give informed consent to the level of their competence.

Where a guardian is asked to give consent, the guardian would seem to be a consumer for the purposes of the Code of Consumers' Rights, and has the right to certain information before giving consent. Therefore, the guardian seems to have a right to the information set out in right 6(1). There is, then, a corresponding obligation on health professionals to provide that information to the guardian. It could thus be argued that the disclosure is required by law. That disclosure would not be overridden by the Health Information Privacy Code.

Health Act 1956, section 22F

Section 22F requires information to be disclosed to representatives on request, although it does set out some withholding grounds which may be relied upon to withhold the information. 'Representative' is defined in the Health Act and, in relation to a child under 16, is that child's parent or guardian.

Requests by representatives can be refused only if:

there is a lawful excuse not to disclose;
refusal is authorised by a code of practice issued under the Privacy Act.

Rule 11(4) of the Health Information Privacy Code authorises the refusal of a representative's request if:

(i) the disclosure of the information would be contrary to the individual's interests;
(ii) the agency has reasonable grounds for believing that the individual does not or would not wish the information to be disclosed; or
(iii) there would be good grounds for withholding the information under Part IV of the Privacy Act if the request had been made by the individual concerned.

If the withholding grounds do not apply, the information must be disclosed. If the withholding grounds do apply, the information may still be disclosed because reliance on the withholding grounds is discretionary.

Essentially, the withholding grounds allow health professionals to exercise their judgement. In deciding whether to rely on the withholding grounds when dealing with requests by parents who will be asked to consent to procedures, it is important to remember that they may need the information in order to grant informed consent.

Health Information Privacy Code 1994, rule 11

If there is no statute authorising or requiring the disclosure of health information, health professionals must consider:

1. Whether they want to disclose (as there is no obligation to disclose except where required by law);
2. Whether any of the exceptions in rule 11 would allow the disclosure.

There are a number of exceptions which might apply in this context.

Rule 11(1)(a)(ii): the disclosure is to the individual's representative where the individual is dead or unable to exercise his or her rights.

In relation to children under 16, a parent or guardian is a representative. (8)
It should not be assumed a the child cannot exercise his or her rights simply because of his or her age. Understanding and maturity are relevant to the ability to exercise rights.

Rule 11(1)(b): the disclosure is authorised by the individual or the individual's representative where the individual is dead or unable to give his or her authority.

If the disclosure has not previously been discussed with the individual, he or she could be asked to authorise it.
It should not be assumed that a child cannot grant an authorisation simply because of his or her age. Again, understanding and maturity will be relevant.

Rule 11(1)(c): disclosure is one of the purposes in connection with which the information was obtained.

This has already been canvassed. (9)unconscious;
not competent (although age alone does not necessarily determine competency);
has refused to give authorisation.

If it is not desirable or not practicable to obtain the patient's authorisation other exceptions are available. It will not be practicable or desirable to obtain an authorisation if the patient is:

Rule 11(2)(b): the information is disclosed by a registered health professional to a person nominated by the individual concerned or to the principal caregiver or a near relative of the individual concerned in accordance with recognised professional practice and the disclosure is not contrary to the individual's or representative's expressed request.

This seems particularly applicable to situations involving young children who would not be competent to give an authorisation and where recognised professional practice would be to deal with the parents or guardians.For instance, if the disclosure to a representative was necessary to obtain consent for an emergency procedure. (10) (10)

Rule 11(2)(d): that the disclosure is necessary to prevent a serious or lessen a serious imminent threat to the life or health of the individual concerned.

Disclosure under rule 11 is discretionary. Health professionals cannot be required to disclose simply because one of the exceptions applies. Disclosure in accordance with rule 11 may not be allowed by some codes of ethics, so health professionals should check their ethical duties before relying on an exception in rule 11.

Conclusion

The information issues underlying informed consent are less complex than the wider issue of informed consent and children. Although there are a number of approaches to the issue, the result seems to be the same: informed consent involves the disclosure of a certain amount of information to the person giving consent. The law seems to be sufficiently flexible to allow that.

The approach which most closely accords with the notions of autonomy and dignity central to the Health Information Privacy Code and the notions of trust and respect central to good clinical practice, is that of the anticipated disclosure. Agencies can - and should - establish information handling policies which are based on purpose and openness. When dealing with mature minors, be open with them if parents' consent to treatment will be sought: tell them that a certain amount of information will have to be disclosed in order to obtain their parents' consent. Try to be sufficiently flexible to accommodate their concerns. That way, health professionals will comply with the law and ethical codes, while upholding the trust so fundamental to the therapeutic relationship.

Sarah Kerkin
Executive Officer
Office of the Privacy Commissioner

(1) For a good discussion on this issue see McDowell, 'Medical Treatment in Children: Assessing the Scope of a Child's Capacity to Consent or Refuse to Consent in New Zealand' (1997) 5(1) JLM 81.

(2) ¹⁹⁸⁶ 1 AC 150.

(3) Supra at note 1, at 87.

(4) Health and Disability Commissioner (Code of Health and Disability Services Consumers' Rights) Regulations 1996, right 7(3).

(5) Rule 2(2)(b) provides that information does not have to be collected from the individual concerned where the agency believes on reasonable grounds that the individual is unable to give his or her authority and, having made the individual's representative aware of the matters set out in subrule 3(1), the health agency collects the information from the representative or the representative authorises collection from someone else.

Rule 3(1) requires health agencies to take reasonable steps to make individuals aware of a number of matters when information is collected directly from them. Those matters include: the fact of collection; purpose; intended recipients; contact details for the agency (or agencies) collecting and holding information; whether supplying the information is voluntary or mandatory; consequences of not providing the information; and the individual's right of access and correction.

(6) Ibid.

(7) This means any Act of Parliament and any regulations issued pursuant to an Act.

(8) The Code adopted the definition of 'representatives' used in the Health Act.

(9) See Anticipated Disclosures.

(10) Although the need for informed consent can be waived in emergencies. See McDowell, supra at note 1, at 83.