As part of new Quality Standards on Foetal Alcohol Spectrum Disorder (FASD), NICE are proposing to include on the medical records of the unborn, and then new-born, child whether the mother had any alcoholic drinks during pregnancy. Whether or not the mother consents is ignored by these proposals. They must jump through some data protection steps here to ensure this is lawful.
Doctors have a well-established duty to maintain confidence in information about a patient’s health and treatment. This was examined earlier this year when a woman lost her a claim against the NHS for not telling her that her father had Huntington’s disease. The judge ruled that the NHS had a duty of care to the daughter but that, on balancing the competing interests of the father and his daughter and the public interest test for disclosure, they had not broken that duty. This was even though the hereditary disease had caused the father to kill his wife and even though the daughter might not have gone ahead with her pregnancy, knowing that her own child could inherit the disease. Applying that to the current proposals, given there seems to be little evidence of causing harm to the unborn baby at lower levels of consumption, this could be in breach of confidence to the mother.
Further, GDPR has stringent standards. That case considered doctor-patient confidentiality but did not consider data protection or GDPR. While it is not always necessary to obtain consent to process or disclose personal data, there must be a clear lawful ground. Moreover, genetic and health data are given a higher standard of protection. Processing of such data is allowed – without the patient’s consent – where it is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services. That’s a high bar for NICE to meet with these proposals and we should expect them to publish their Personal Data Impact Assessment containing their justification for doing this.
It will also be interesting to hear what the ICO makes of this.
If you have any questions about data protection / GDPR or other issues, get in contact: 020 7467 8742 or email@example.com.