Unsolicited Third-Party Information

Policy

Unsolicited third-party information is information about a patient that has been offered by someone other than the patient, the patient's representative, or a clinician involved in the patient's care.

Under the principles in the Health Information Privacy Code (HIPC), health information must be collected from the patient, unless an exception applies.

We have an obligation not to use or disclose information that hasn't been verified.

We treat unsolicited third-party information differently to other health information:

• Don't use, rely on, or disclose information in the patient notes unless steps have been taken to ensure that it is accurate, up to date, complete, relevant, and not misleading. In most cases this will mean verifying the information with the patient.

  Don't promise anonymity to the third party offering the information.

  To verify the information, you may need to tell the patient where it came from. Patients have a right to their health information.

  There would need to be a serious threat to life, health, or public safety to justify withholding the patient's health information from them. If you believe this may apply, consider seeking medicolegal advice.

• If the information can't be verified, you may choose to "reject" it. In some situations, your professional and ethical obligations mean you may need to act on information even when it would otherwise be appropriate to reject it.

Until unsolicited information can be verified, store in a temporary file. Make sure it hasn't been saved anywhere else, e.g. in emails or phone messages.

If you are unsure what to do with information you have been offered about a patient, consult the privacy officer for guidance.

See also Safeguarding Patient Information.

Managing unsolicited third-party information

If offered information about a patient

Stop and think. Is this unsolicited third-party information?

If yes:

• At the start of the conversation, make it clear you can't promise anonymity to the third party offering the information. Ask them not to disclose anything to you, unless they accept that they may be identified to the patient if it is necessary to fulfil our obligations under the HIPC.
• Don't record the information in the patient notes.
• If the third party doesn't want you to verify the information with the patient, and/or none of the exceptions for collecting information from someone other than the patient apply, you may choose to reject the information.
• If the third party gives permission for you to verify the information, do this before adding it to the patient notes.

"Rejecting" information

If information can't be verified, you have the option of rejecting it.

To reject the information:

• Tell the person who supplied the information that you are rejecting it as you can't verify it, and/or none of the exceptions for collecting information from someone other than the patient applies.
• Don't record the information in the patient notes.
• Delete any emails or phone messages that contain the information.

If rejecting the information puts the health and safety of anyone at risk, you may have a duty to act on it despite the third party not giving you permission to identify them. In a situation like this, there may be circumstances where the third party ends up being identified, even if they have asked not to be.

If appropriate, you could advise the informant that although you can't act on unverified information, they can go to the police with their concerns.

Situations involving unsolicited third-party information can be very complex and nuanced.
If you aren't confident about how to proceed, consider telling the third party that you can't guarantee their anonymity, and then seek medicolegal advice.

GPDocs appreciates the advice of Medical Protection Society in the development of this policy.