BJU International (2000), 86, 286±290
Medical records and the law
STUART BRAMLEY
Bevan Ashford, Solicitors, Bristol, UK
Introduction
The main reasons for keeping medical records are, of
course, clinical rather than legal. However, case-notes
are increasingly becoming governed by different areas of
law and this article therefore will attempt to clarify the
legal requirements of patient records.
There is no single statute (written law) covering
medical records. Legislation covers speci®c areas, e.g. the
Access to Health Records Act 1990, which concerns the
right of patients to see their medical records. However,
most legal principles have been established by case-law,
i.e. decided on by a judge in an individual situation,
thereby setting a precedent for other courts to follow.
Thus unless a particular legal question relating to
medical records is the subject of statutory legislation or
has been decided on by a court, no legal certainty will be
possible and clinicians will be placed in the dif®cult
position of acting in accordance with what they think the
law should say, rather than what it actually does.
The duty to keep medical records is not just one of civil
law, breach of which may allow the patient to sue, but
also a requirement of employment. For GPs, there is a
statutory duty under the NHS (General Medical Services)
Regulations 1992 (SI 638 Schedule 2), whereas for those
in hospital practice (private or NHS), their contract of
employment will always carry a clear implication that
they owe a duty of care to the patient, governing not just
clinical treatment but also that a proper record of this is
made.
Presentation
Doctors should be aware that that law will be concerned
not just with what they write, but with how they write it.
The publication `Standards for Records and Record
Keeping' [1] constitutes an admirably clear guidance
on the essential elements of note-keeping. It may seem
axiomatic that records should be legible, indelible, clear,
unambiguous and chronologically accurate, but even
these basic prerequisites are often breached. Others are
less self-evident; many senior (let alone junior) doctors
are unaware that, e.g. black ink should be used in case
notes as blue ink often photocopies badly, or that
alterations should be signed, timed and dated, with the
altered entry scored out but still left legible. These
286
requirements are not actually demanded by legislation,
but the clinician should remember that the test used by
courts in negligence cases is whether the clinician has
been reasonable. This reasonableness extends to note-
keeping just as to the patient's clinical care. It is not
dif®cult to imagine a situation where the care is
compromised because of ambiguity in the records. For
example, the abbreviation PID could be read as `prolapsed
intervertebral disc' when the author meant `pelvic
in¯ammatory disease'; or OD being understood to
mean `once daily' but when `overdose' was actually
meant. This is particularly true when both (or more)
abbreviations are from the same subspeciality of
medicine. It seems extraordinary to the layman how
long the phrase IUD was used interchangeably to
represent `intrauterine device' and `intrauterine death',
although the frequent confusion arising led to the
introduction of IUCD (intrauterine contraceptive device)
instead.
Interestingly, the public conception of doctors having
illegible handwriting has recently been shown to be more
than simply anecdotal. The Department of Public Health
in Swansea carried out a study in which a computer,
programmed to read handwriting, assessed the best
efforts of three groups, i.e. doctors, nurses and NHS
administrators (The Times, 25 September 1998). With
the exception of numbers, the computer found the
doctors to have by far the worst handwriting, an
impression con®rmed by those who regularly attempt
to decipher volumes of case-notes for medicolegal
purposes.
Generally, this causes little more than a headache for
those trying to read medical records. However, occa-
sionally the outcome can be much worse, as a case heard
at the High Court in 1988 shows [2]. Here, a GP
prescribed Amoxil tablets to an asthmatic patient; the
GP's hand-writing was extremely unclear and the
pharmacist instead dispensed Daonil, a drug used for
diabetics to reduce the body's sugar levels. The patient,
not a diabetic, suffered hypoglycaemia, leading to
irreparable brain damage. At the ensuing negligence
claim, the judge held that the pharmacist bore 75% of the
blame, primarily because the unclear word was followed
by `250'. A pharmacist paying attention, the court
maintained, would have realized that this could not have
referred to Daonil. Furthermore, he should have
# 2000 BJU International

recognized the danger Daonil posed to those not diabetic.
Nonetheless, the GP was held liable for a quarter of the
liability (and hence a quarter of the £120 000 award of
damages granted to the patient), on the grounds that a
clinician owes his patients a legal duty to write
suf®ciently legibly.
It is arguable that that duty may extend beyond the
doctor with unreadable hand-writing to encompass his or
her colleagues who are aware of this but take no action.
In the above case, the clinician was a GP whose notes
would have been seen by fewer people than if had he been
a doctor in hospital, where entries are read by a wider
range of individuals involved in caring for the patient.
The recent enquiry into the deaths of children with heart
problems at Bristol Royal In®rmary hinted at the legal
and ethical quandary faced by clinicians who become
aware of what may be failings by colleagues. If a doctor
cannot read a colleague's handwriting, it is probable that
he/she is under a legal obligation to alert the colleague to
that de®ciency.
It is not just other health professionals who need to be
able to interpret medical records. As explained below,
patients now have a largely unfettered right to see, and
take copies from, their health records [3]. The latter is
de®ned as a record which consists of information relating
to the physical or mental health of an individual, made by
or on behalf of a health professional in connection with
that individual's care. The Act governing this also confers
the right to an explanation of unintelligible parts or terms
within the record. Health professionals are therefore
accountable to patients and to colleagues for what they
write. Patients are entitled to ask for abbreviations to be
expanded and acronyms clari®ed. Despite this, it is still
possible to ®nd abbreviations of a pejorative nature
within medical records, leaving embarrassed clinicians
with the task of explaining to inquisitive patients what
GOK, FLK, LOLIAD or PAFO really mean (God Only
Knows, Funny Looking Kid, Little Old Lady in Apparent
Distress, Pissed and Fell Over).
Patients are not only entitled to a clari®cation of
entries in their records, they are also allowed by statute
the right to correct errors [3]. This clearly gives rise to
arguments of de®nition as to what is or is not a mistake,
and accordingly the clinician who is genuinely at odds
with the patient need not make the alteration, but must
include a note setting out the fact that the request to
amend has been made but refused, and the patient's view
of the perceived inaccuracy. Disagreements which even
this measure cannot settle can be resolved by an
application to the Court [3].
The last has occasionally led to the perception that
doctors are in effect being told by the patient what should
go in the case notes. It is argued that health professionals
should be free to write whatever they feel is clinically
# 2000 BJU International, 86, 286±290
M E D I C AL R E C O R D S A ND TH E L AW 287
correct. That view might be correct if medical records
belonged to the clinician, but in law they do not,
although nor are they the property of the patient.
Ownership
Hospital case notes are in the ownership of the Trust or
Health Authority, albeit acting as agents of the Secretary
of State for Health. GP notes (whether practice fund-
holder or not) belong to the relevant Fund-Holding
Health Authority (FHSA), on the apparently curious
grounds that they are written up on the standard forms
that the FHSA supplies [4]. This seems to confuse the
ownership of documents with ownership of the informa-
tion contained in those documents, although the British
Medical Association (BMA) has raised the more logical
argument that it is instead because the records are
compiled as part of the contract of employment and, in
accordance with general law on this subject, therefore
belong to the employer rather than the creator of the
document [5].
Access
Before 1970, the question of who owns medical records
may have had some practical use, as before then a patient
who wished to see what was in his/her notes had little
recourse but to sue the hospital or individual GP. This
legal action would have been based on no more evidence
than the patient's recollection of what occurred during
the treatment in question, and it was not until the actual
trial that the case notes would be produced at Court
under subpoena. Recognizing that this situation brought
several groundless claims to trial (as the explanation
which defeats many putative negligence claims is usually
found within the medical records), in 1970 the
legislature granted patients the right to access before
the trial [6].
This act held that so long as they were likely to be
relevant to real or contemplated legal proceedings, copies
of case notes could be obtained from the hospital or GP,
and indeed from third parties. The real likelihood of
bringing an action was needed [7], a requirement which
was not removed until 1984, and then only for
computer-held notes [8]. For records not held on
computer, it was not until the Access to Health
Records Act 1990 that patients were allowed to see
case notes. This only applied to those notes created after 1
November 1991, unless these could not be easily
understood without sight of earlier records, in which
case the previous notes would also be disclosable. Few
grounds for opposing disclosure now exist, the most
important one for day-to-day consideration being that
access would be likely to cause serious harm to the
288 S. BRAMLEY
physical or mental health of the patient or another
person [9]. It is interesting that, unlike the Data
Protection Act, the Access to Health Records Act does
not confer a right to compensation for distress caused by
incorrect information within the medical records. Many
commentators feel anomalies such as this warrant the
two statutes being replaced by a single one, which would
carry identical rights, responsibilities and remedies
regardless of whether the information the patient seeks
is held on computer or written on paper.
Con®dentiality
If a patient is allowed to see his/her records, to whom else
could they be disclosed? Many doctors will have received
requests by the police to see the notes of someone
suspected of involvement in criminal activity. To what
extent is the obligation to keep someone's medical details
private outweighed by a wider obligation to the public?
Given that medical records are an exception to the
Public Records Act `30-year rule', so that despite being
owned by the Department of Health they do not become
public documents after 30 years, the only time that
disclosure can be made to an applicant other than the
patient themself is where the public interest demands it.
This requirement is rigorous. Since Hippocrates, the need
to preserve patient con®dence has been a moral and
ethical duty of the highest importance. However, how
that translates into strict guidelines is less clear. Those
working in the business of providing health care need
practical guidance on con®dentiality, a topic which (like
that of consent) is not only vague in several crucial areas,
but is also one which changes with almost every new
court case on the subject.
The right to con®dentiality is recognized by the
European Convention on Human Rights (Article 8),
although this allows member states to override the right
where appropriate. English law does so in two ways;
where there are speci®c, statutory exceptions allowing
con®dential information to be disclosed without consent;
and where the disclosure falls under the wider principle of
the `public interest'. Statutory exceptions include:
' The NHS (Venereal Diseases) Regulation 1974, which
allows information capable of identifying patients with
venereal disease to be given to those charged with
preventing its spread (SI 1974 no. 29)
' The Road Traf®c Act 1972, which confers a duty on
`any person' to inform the police about road accidents
resulting in personal injury. In 1974, a doctor was
successfully prosecuted under this Act for failing to
allow police access to the patient [10].
' The Misuse of Drugs Regulations 1973, which obliges
clinicians to provide the Home Of®ce with names,
addresses and addiction details of patients addicted to
certain classes of drugs (no. 799).
' The Public Health (Control of Disease) Act 1984,
which stipulates that the Department of Health must
be noti®ed of any patient having or suspected of having
cholera, smallpox, plague or typhoid.
' The Prevention of Terrorism Act 1989, which obliges
anyone to report to the police or Home Of®ce an
individual `reasonably suspected' of involvement with
terrorism (s. 18).
The Children Act 1972 and the Mental Health Act
1983 also oblige clinicians in particular circumstances to
co-operate with, and give con®dential patient informa-
tion to, bodies such as the Social Services. Contrary to
popular belief, there is no statutory obligation on doctors
to report to the police or UK vehicle licensing authority
those patients who are felt not medically ®t to drive but
who insist on doing so.
However, this raises the dif®cult question of when
con®dential information can be disclosed to an
unauthorised party, not for a speci®c statutory exception
but because it is in the public good so to do. In many
instances, it is abundantly clear that such a breach, for
the ultimate protection of others, is encouraged. Lion
Laboratories v Evans [11] made the point that the Courts
would not allow the `cloak of con®dentiality' to hide the
exposure of, amongst other things, criminal conduct, and
the case of Re. N [12] stipulated that breach of con®dence
would be lawful in child abuse situations. Similarly, W v
Edgell [13] involved a psychiatric patient responsible for
multiple killings, and held that the duty to protect the
public held sway over the need to preserve patient
con®dence, so long as disclosure is to someone with a
legitimate interest in receiving the information.
What is the justi®cation for disclosing information
where the criminal conduct is much less serious? The
Edgell case established the need for there to be a real and
serious risk of danger to the public. This was upheld by R
v Cardiff Crown Court, ex parte Kellam [14], which was
widely publicised in the national press at the time. A dead
body, stabbed 83 times, was found near a psychiatric
hospital. A witness told the police that he had seen a man
`behaving oddly' near there, and perhaps understandably
the police suspected that the perpetrator may have been
a psychiatric patient on day-release. They wished to
interview a particular patient and asked to see his
records. The relevant Consultant Psychiatrist opposed
this, arguing that the Police and Criminal Evidence Act
1984 excluded the papers that the police wished to see,
and which would have con®rmed the patient's where-
abouts on the day in question. The Court held that the
# 2000 BJU International, 86, 286±290

Police and Criminal Evidence Act, which usually allows
the police access to documentary evidence in investigat-
ing crime, excluded medical records because Parliament
had felt that `the con®dentiality of records of identi®able
individuals should have paramountcy over the prevention and
investigation of serious crime'. However, although the
Police and Criminal Evidence Act is not an appropriate
tool for the police to use when seeking medical records, it
is clear that the `public interest' argument using the
Edgell principle will allow disclosure.
How serious a crime, or risk to the public, needs to be
before breach of con®dentiality will be lawful has not
been clari®ed. Reference was made in the Kellam case to
the statutory de®nition of `serious arrestable offences', i.e.
treason, murder, manslaughter, rape, kidnapping, cer-
tain sexual offences, causing an explosion, certain
®rearms offences, hijacking, causing death by dangerous
driving and terrorism [15]. Guidelines issued by the BMA
in 1985 suggest that disclosure is lawful when the
offence involved is `grave'. The General Medical Council
(GMC, http://www.gmc-uk.org.uk) 1995 pamphlet
`Con®dentiality' covers a wider scope, suggesting a
public interest exception where to do otherwise would
risk death or serious harm to the patient or another
person.
This, as with the other tests, places the doctor in the
position of having to de®ne `serious harm' and the
magnitude of the risk. However, it is arguable that he is
the person best placed to do so.
HIV/AIDS information
This problem is particularly acute when the already
complex questions outlined above also involve the
fraught medical and ethical issues surrounding HIV
and AIDS. The situation is not made any easier when the
social connotations and stigma that HIV carries, more so
than any other transmittable disease, becomes a factor in
the equation. Nonetheless, there is still an urgent need to
set the right balance between preserving patients'
con®dentiality and protecting others. The varied ways
in which HIV can be transmitted means that those
`others' will be current and future sexual partners, as well
as health workers caring for the patient. Most health
Directives on this stress the need to persuade the patient
to be open and truthful with others. That is entirely
laudable, but if it always happened in practice, the issue
of breach of con®dentiality would not arise.
A Guidance issued by the GMC in 1988, and revised in
1993 (http://www.gmc-uk.org.uk), suggests that where
sexual partners are concerned, breaching con®dence is
justi®ed where there is a `serious and identi®able risk to a
speci®c individual who, if not so informed, would be exposed to
the infection'. It may be argued that this test raises more
# 2000 BJU International, 86, 286±290
M E D I C AL R E C O R D S A ND TH E L AW 289
questions than it answers. The inclusion of `speci®c'
presumably excludes the situation where a doctor knows
that an HIV-positive patient is planning to engage in
indiscriminate unprotected sexual relations, rather than
with a partner more readily identi®able. The case of Roy
Carnes is useful here. A Birmingham man was accused,
albeit by the national press where clinical facts do not
normally stand in the way of a good story, of deliberately
engaging in unprotected sex with several work col-
leagues, whilst suppressing his HIV-positive status.
However, the con®dentiality of this situation was
breached not by his GP but by several national news-
papers. Had a doctor been placed in that position it is
arguable that a similar breach of con®dence would have
been deemed lawful, given that the risk of `death or
serious harm to the patient or another person' was
relatively clear.
In the situation where it is other healthcare profes-
sionals, rather than sexual partners of the patient, who
need to be informed, the same GMC Guidance suggests
that it should be explained to the patient that staff `cannot
be expected to provide adequate clinical management and care
without full knowledge of the patient's condition'. If
counselling about the potential risk to others does not
result in the degree of frankness anticipated, and this
would endanger the health of any clinician caring for the
patient, `it would not be improper to disclose such
information that that person needs to know'.
This Guidance, of course, carries no legal weight but in
the absence of statute, the GMC were faced with either
waiting for a Court case to give judges the opportunity to
clarify the law, or else to pre-empt that by setting out
what the Council believed to be a workable set of
principles based on general legal precepts governing
con®dentiality. The situation has still not been tested by
the Courts and, in the absence of a Court case, it can be
argued that the Guidance represents a code of conduct
which is entirely in accordance with public thinking on
the balancing act between public and private interests.
Computerized medical records
This is likely to be of real concern in the future. In
September 1998, the then Health Secretary Frank
Dobson announced a £1 billion investment in informa-
tion technology for the Health Service (The Independent,
24 September 1998). It was envisaged that pilot areas
would start to put all their case notes on computer disk,
with a third of hospitals having entirely computerized
case-notes by 2002 and all new NHS patients having a
computer ®le by 2005. The perceived bene®ts go well
beyond simply eliminating poor handwriting or lost
medical records, as the nationwide system would allow
clinicians to email prescriptions to pharmacists and
290 S. BRAMLEY
enable GPs to refer patients to hospital electronically.
Specialists in one part of the country will be able to
diagnose the condition of a patient in another by
accessing the records and other data held at the patient's
local hospital. Patients' access to their notes will be
improved, with individuals being given an NHS password
and reading their records via their home computers.
Unless there is to be some associated speci®c legislative
framework, this system (to be known as the NHS Net)
needs to observe the Data Protection Act rules. It is
doubtful that that Act in its current form will cover all
eventualities arising from the new situation. For
example, anyone holding personal information on a
computer must be registered under the Act, and this
registration requires adherence to certain principles. One
such is that information may not be stored for any
purposes other than those speci®ed on the Register.
Unless the `purposes' of medical records are very widely
drawn, which the Data Protection Registrar has
historically opposed for other professions, the principle
risks introducing in¯exibility into a system. It is unlikely
that one of the speci®ed purposes of an individual
patient's computerized case notes would be disclosure to
a third party entirely unconnected with the care of that
patient. However, if a patient is found to be HIV-positive
and states that he has no intention of notifying sexual
partners of that, current Department of Health guidance
[16] is that disclosure would be justi®ed. Such disclosure
would be supported by the usual rules of con®dentiality,
but if the information were obtained from computer-held
records, disclosure to that patient's partner would
constitute a breach of the Data Protection Act.
One issue which occasionally causes dif®culty in
practice is that patients' paper medical records are not
always kept together. What may be regarded as the main
body of hospital records often excludes, e.g. Accident and
Emergency cards, psychiatric records, genitourinary clinic
notes, etc. This separation serves to emphasize a central
theme of the con®dentiality principle, that sensitive
information is accessed only when it is necessary. Unless
the NHS Net incorporates an integral `Chinese wall',
behind which clinicians may only peer if authorized to do
so, then the computerized records will share the main
drawback, as do patient-held `smart cards', in that they
may allow wider access of private information to more
people than do traditional paper records.
However, it is reassuring that the Minister for Health's
team took into account the situation in Sweden, where
the computerization of medical records is more advanced
than in the UK. Some teething troubles were identi®ed
but the general feeling is that computer-held records are
easier to read, facilitate better communication links
within the profession, take up less space and reduce the
need for duplication. Many hospitals in Sweden have
been rigorous in introducing rules stating which staff can
have access to computerized records.
Conclusion
Doctors who hope to ®nd a clear and exclusive body of
law, dealing with every legal issue arising from medical
records, will be disappointed. There is, as yet, no `Health
Records Act' to which puzzled clinicians can refer in
answering dif®cult legal or ethical questions arising from
case notes.
However, a clear legal framework is discernible and
there should be no excuse for clinicians failing to observe
the basic precepts. Given the importance of medical
records, particularly although not exclusively in the ®eld
of con®dentiality, doctors should not hesitate to refer
problem areas to the solicitors acting for their Trust,
Health Authority or practice.
References
1 United Kingdom Central Council for Nursing Midwifery and
Health Visiting. Standards for Records and Record Keeping,
April 1993
2 Prendergast v Sam & Dee Limited, The Times 24 March
1988
3 Access to Health Records Act, s.3 (ii), s.6 (ii), s.8, 1990
4 NHS (General Medical Services) Regulations, SI 1992 no.
635, para 36, 1992
5 BMA. Rights and Responsibilities. London: British Medical
Association, 1992
6 Administration of Justice Act 1970, s.32, later replaced by
the Supreme Court Act 1981 s33
7 Dunning v United Liverpool Hospitals Board of Governors
1973, 3 All ER 454
8 Data Protection Act, s. 21 (I). 1984
9 Access to Health Records Act (Control of Access)
Regulations 1983, no. 746 SI 1993
10 Hunter v Mann 1974 QB 767
11 Lion Laboratories v Evans. 1984 2 All ER 417
12 Re. N. 1990 1 All ER 205
13 W v Edgell 1990 1 All ER 635
14 R v Cardiff Crown Court, ex parte Kellam 1993 16 BMLR 76
15 Police and Criminal Evidence Act 1984s116
16 Department of Health. Guidance on Partner Noti®cation for
HIV Infection. 1993
Author
S. Bramley, Associate, Bevan Ashford Solicitors, 35 Colston
Avenue, Bristol BS1 4TT, UK.
# 2000 BJU International, 86, 286±290