Obligation to protect confidentiality

Those involved in clinical research owe an ethical and legal obligation to respect the confidences of research subjects. The obligation extends to all personal information, medical and other, given to or observed by the researcher in circumstances where the research subject expects it not to be disclosed. This expectation need not be explicitly stated but may be assumed from the context, e.g. it is always assumed in a physician–patient relationship, regardless of the existence of a contract between the physician and the patient. Health care professionals who disclose confidential information may be subject to disciplinary action by their professional body (e.g. the GMC or UKCC) and all researchers, whether health care professionals or not, may also be subject to legal action. Medical confidentiality is protected as part of the right to private life under Article 8(1) of the European Convention on Human Rights (Z v Finland [1997]), and consequently also under the Human Rights Act 1998.

Disclosure of information which does not reveal the identity of a research subject, e.g. epidemiological or aggregated data, is not a breach of the obligation of confidence. This is even true where anonymised patient information is sold for research purposes without the patient's consent (R v Department of Health, ex parte Source Informatics Ltd [1999]).

Exemptions from the duty of confidentiality

There are a number of exceptions to the obligation of confidentiality which may justify disclosure.