Information Privacy in Healthcare - The Vital Role of Informed Consent

The use and disclosure of patient information is subject to multiple legal and ethical obligations. Within European human rights law the differences relating to consent are reflected in the separate requirements of data protection law, the common law, and professional ethics. The GDPR requires explicit consent. This contrasts with the ethical and common law availability of reliance on implied consent for the use of patient information for that patient's care and treatment. For any proposed use of patient information for healthcare purposes other than direct care, even where GDPR may be satisfied if the patient refuses to consent to disclosure, the information should not normally be disclosed. For any proposed use or disclosure outside healthcare the justification should normally be consent. However, consent is often not possible or appropriate and an overriding public interest can be relied upon to justify the use or disclosure, both legally and ethically.