Trust me, I'm a doctorThe discovery by a roadside of patient files detailing mental health problems has highlighted concerns about the security of medical records.

However, Marion Chester suggests that the underlying problem in the NHS is much more serious than just dealing with human fallibility and mislaid or carelessly disposed of paper recordsAlmost without exception we have provided facts about ourselves to GPs and other medical practitioners in the NHS.

Believing this information will be treated in confidence, we reveal marital problems, our sexual histories, mental health concerns and a range of other data including information about other family members and our possible genetic predispositions to medical conditions.Doctors have an interest in receiving this information so that they will be able to accurately diagnose and treat our problems.

For as long as there has been a medical profession, the notion that these confidences must be respected has been a central tenet.

Doctors know that breaches of confidence have the potential to destroy patient trust with the result that patients may in future withhold, possibly vital, information.

A widespread breakdown of patient trust would result in serious consequences not only for the treatment of individuals, but also for public health.In the past, the physical nature of patients' notes provided some protection.

GPs were much more easily able to control who had access to them.

The growth of IT in the health service means that information can potentially be accessed by a wide range of personnel in the health service and passed on within and beyond the NHS.Patients recognise and accept that facts from their records may be released to other medical practitioners who will be engaged in their treatment.

However, the NHS now requires medical practitioners to share identifiable patient information for a variety of other purposes, such as for planning of health services and financial and clinical audit.

Once data has been disclosed it will then be used for a multitude of other purposes, including research carried out both within the NHS and in the private sector.The need for confidence in the treatment of personal health records is acknowledged in legislation.

The Data Protection Act 1998 places personal medical data in a special category of sensitive data.

The Act provides that when dealing with sensitive personal data the processing must also be fair and lawful.

Lawful refers to the requirements found in common law, being a duty not to disclose without consent or unless there is an overriding public interest in disclosure.

However, the courts have been more concerned with commercial confidentiality than with the protection of personal privacy and the state of the common law reflects this.The Act also requires data controllers, including those holding personal medical information, to comply with a range of data protection principles.

One if these is the requirement that data only be used for the purposes for which it was collected.

However, the legislation goes on to modify the application of this principle to permit the use of medical records for other reasons, such as for research purposes.

The Act also provides that certain conditions must be met before sensitive identifiable medical information can be disclosed or otherwise processed.

Although these are called conditions they are in fact, exemptions to the prohibition on processing/disclosure of personal data.

Lawful disclosure of personal medical data can be made if one condition in sched 2 to the Act applies together with one from sched 3 as amended by Data Protection (Processing of Sensitive Personal Data) Order 2000 SI 2000 417.

One circumstance where disclosure is permissible is when the patient consents, but many alternative circumstances are also provided for.Sched 2 details a whole host of circumstances including:l Where disclosure is necessary for contractual purposes where the data subject is a party, for example insurance policies;l For compliance with legal obligations of the data controller (health service bodies are bound around with so many legal obligations, many of which could be used to justify disclosure); l To protect the vital interests of the subject (which clearly involves the prevention of death or harm of patients, but also may be argued to include the patient's interest in the health service operating smoothly and the detection of fraud by others);l For the exercise of functions of a government department or functions of a public nature exercised in the public interest by any person; and,l For the legitimate interests of the data controller or others.Sched 3 and the Order include, where disclosure is necessary for:l Employment purposes; l In the vital interests of the subject, or of another person where consent cannot reasonably be obtained;l For the exercise of functions of a government department or functions of a public nature exercised in the public interest by any person;l For medical purposes (which can and will be widely interpreted);l For the detection or prevention of crime in the public interest; l To protect members of the public against dishonesty, malpractice, or incompetence;l To enable confidential counselling; l For insurance and pension purposes (including use of information about family members); and, l For research purposes.Clearly, almost any activity involving the use and disclosure of medical records can potentially come within these conditions.

Patients will not know, never mind have consented, to these uses.

Only limited protection is to be found in the requirement that processing must be carried out fairly and lawfully, that is, in line with common law requirements.

Not content with the wide discretion given to the NHS by the Data Protection Act, the Secretary of State for Health now intends to use provisions in proposed legislation currently before Parliament to give himself powers to override the common law and extend the range of circumstances in which medical records and personal identifiable information from them can be divulged both within and beyond the NHS.

The Department of Health has persistently ignored patient organisations and respected bodies representing medical professionals when they have called for legislative changes making patient consent a legal prerequisite to these flows of information.

The Data Protection Registrar appears to be unable or unwilling to intervene.

Plans to further extend government powers to use our records, without reference to our wishes may in the end only be prevented by a legal challenge under article 8 of the European Convention on Human Rights.

In the meantime, we may want to review what we are prepared to divulge to those who are providing us with medical services.Marion Chester is a member of the Law Society's mental health and disability committee