In this smartphone age, healthcare providers are encouraged to be digital by default. Whilst service users administrate their lives on mobile devices, we aspire to offer them more choice around how they communicate with us. You’ve probably noticed how access to our services is increasingly provided via websites, email, social media, mobile apps and messaging these days, in addition to “traditional” face-to-face contacts. It all aims to improve convenience and timeliness.
As digital data becomes the prevalent currency in communications, privacy is higher on service users' agendas. Choose any big brand social media site and you’ll find users discussing how best to configure their privacy settings and whether or not they are comfortable with how the operator uses personal information.
When we invite service users to contact our frontline services digitally it involves them submitting personal data (like their contact details) by default. You are probably already aware of two operational basics that help us respect their privacy in these circumstances:
Firstly, it's suggested that if a service user initiates contact by one method, you should generally respond via the same method unless otherwise specified in advance. For example, in relation to engaging with young people through text messaging, the Royal College of Nursing says, “Mobile phone numbers that are collected in two-way messaging services must not be used for any purpose other than to respond to the text. If you need to make verbal contact with the young person, you should obtain their consent by text message first.”
Secondly, service users are generally entitled to prevent us from using their personal data to make digital contact with them. For example, the Data Protection Act ensures any person can stop an organisation from using personal data to send unsolicited direct marketing messages. Along these lines, best practice in healthcare might be to provide the opportunity for service users to ask that we respect their digital privacy. Using the example of a young person’s messaging service again, this could be as simple as saying, “Text STOP to prevent the nurse from contacting you” in the small print.
So, what exactly do we mean when we say “a confidential service”? And how do we interpret the act when we need to process personal data to safeguard risk to life? You might consider this second suggestion quite a stringent application of the act. Why? Because our frontline clinicians aren’t usually sending unsolicited direct marketing bumf – they are more likely to be responding to complex personal enquiries across a broad range of health issues. This is where our duty of care to safeguard the service user begins to influence how the statute is applied. So, what exactly we mean when we say “a confidentiality service”? How we interpret the act when we need to process personal data – say to safeguard risk to life?
Staying with the example, let’s say a young person sends a nurse a text messaging disclosing that they are at risk of harm. They have provided us with their mobile phone number but not their name. Although they have sent the message anonymously, they regret their disclosure and quickly follow up with a message requesting us to STOP further contact. How does the nurse now exercise their duty of care?
Here are two options:
A referral to emergency services could be made. In the majority of cases the police would be able to locate the user via their mobile number and conduct a safe and well check. Your view on whether this is appropriate might be influenced by how your organisation or professional group defines your specific duty of care and what guidelines they provide on breaching confidentiality without consent. Approaches differ between professional groups and organisations. Depending on the nature of the disclosure, this escalation could seem unnecessarily heavy-handed to some healthcare professionals.
A different response is to acknowledge that, in these circumstances, STOP might not apply. The Data Protection Act is clear about exceptions which can be made in situations where safety or a person’s best interests are threatened. Whilst the act says personal data must be processed “fairly and lawfully”, it also say that health professionals can process personal data without consent when the “processing is necessary to protect the vital interests of the data subject” (DPA, Schedule 2). This suggests that you could continue to encourage the young person to engage with you, explaining that you are concerned about their safety and you want to ensure they stay safe and well. Within the bounds of the act, this could be pursued until you have satisfied yourself that the young person is safe. Or, until you decide that escalation to emergency services is the only remaining option. This scenario may at first seem uncomfortable to some colleagues. To ensure the service user continues to feel respected and cared for in these circumstances, the tact and diplomacy applied by experienced healthcare professionals becomes really significant. You can imagine the kind of sensitivity that would be required.
Critical to each of these options is that you clearly define your approach to confidentiality and make it known to service users from the very beginning. Print it on your promotional material and send it out as a standard message when users first make contact. This supports the notion of having a privacy notice which is required under the Data Protection Act. The Royal College of Nursing says, “Young people must be made aware that confidentiality cannot be guaranteed if a disclosure is made.” As you know, many services for young people already commonly use a disclosure statement in the face to face environment.
There seems to be increasing dialogue amongst young people about the impact of what they say in their digital communications. Words are indeed like toothpaste: “easy to let out, impossible to take back” – especially when put in writing (and some young people tell us they are increasingly mindful of what words they are prepared to put into writing).
The data protection act requires us to respond with fair use of personal information, handling it only in ways that the subject would “reasonably” expect. It is our responsibility to manage expectations about what “reasonably” means to the smartphone generation, by explaining our duty of care in relation to privacy and how we might respond to words that cannot be ignored.
|
@{{Comment.screenName}}
{{Comment.DateCreated | date:"dd MMMM yyyy HH:mm"}}
|
{{Comment.Comment}} | |
|
@NRCUK
31 October 2014 12:13
|
 |
Great blog Jimmy and thanks for sharing your passion and wisdom to help keep young people safe. My issue is what you've suggested is a work around, it's working around the fact that when you engage with a young person why wouldn't you ask them if they would like to be contacted via facebook/twitter/next cool platform… record this in the clinical system as a preference then build apps for social media platforms that allow you to communicate (openly or not as appropriate or preference) linked to clinical notes. The “problem” with your blog is that work-arounds almost solve this, but there is no forward thinking and connection between how patients communicate and how providers think it is appropriate to communicate. Technology is no barrier here, it’s actually very simple, am wondering what the problem is to communicating with any patient anywhere, brands seem to have it sorted this, and before anybody says they have money I would imagine the cost of not supporting a patient in need when the need you is far lower than finding them and supporting after they needed you! |
|
@AgencyNurse
31 October 2014 11:38
|
 |
Jimmy this is a brilliant and really informative blog post. I was not aware of the RCN guidance before reading this but it looks like a really useful resource. I don't work with young people can can see the challenges faced by those who do. Thank you |
