Code of Medical Ethics Opinion 3.2.1
Patients need to be able to trust that physicians will protect information shared in confidence. They should feel free to fully disclose sensitive personal information to enable their physician to most effectively provide needed services. Physicians in turn have an ethical obligation to preserve the confidentiality of information gathered in association with the care of the patient.
In general, patients are entitled to decide whether and to whom their personal health information is disclosed. However, specific consent is not required in all situations.
When disclosing patients’ personal health information, physicians should:
(a) Restrict disclosure to the minimum necessary information; and
(b) Notify the patient of the disclosure, when feasible.
Physicians may disclose personal health information without the specific consent of the patient (or authorized surrogate when the patient lacks decision-making capacity):
(c) To other health care personnel for purposes of providing care or for health care operations; or
(d) To appropriate authorities when disclosure is required by law.
(e) To other third parties situated to mitigate the threat when in the physician’s judgment there is a reasonable probability that:
- The patient will seriously harm him/herself.
- The patient will inflict serious physical harm on an identifiable individual or individuals.
For any other disclosures, physicians should obtain the consent of the patient (or authorized surrogate) before disclosing personal health information.