Can I divulge patient details to Tracing Officers?
From:https://www.iosteopathy.org/covid-19/faq/
If I am contacted by a Tracing Officer advising that I have been in contact with a confirmed case of COVID-19, and I am asked for details of all those that I have been in contact with, can I divulge patient details without their prior consent?
We have sought advice from a GDPR specialist and their advice is as follows: The introduction of a contact tracing system by Central Government is in the public interest to protect citizens of the UK from the transmission of COVID-19. Notwithstanding the need to seek explicit patient consent to share medical records with third parties in order to satisfy GDPR Article 9, some details can be shared where it involves public interest matters.
Article 6 provides special provision where the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Clearly tracing those potentially infected with COVID-19 is in the public interest and the practitioner can share basic contact information such as the patient name, address, telephone number and email address with tracing agents. However, they are not permitted to share any medical information (beyond basic contact details) without the consent of the patient or a Court Order.
Despite the urgency of the situation, the practitioner should also satisfy themselves from an ID card, email confirmation or some other verifiable method offered by the Tracing Officer that the person investigating the matter is working on behalf of Public Health England or the appropriate body in Scotland or Wales. They could have an ID card from a variety of sister organisations because Public Health England has a variety of people supporting the initiative under the direction of a regional director. This includes public health staff, local authority environmental health officers, and even NHS sexual health staff with experience of contact tracing and knowledge of their communities.
If the practitioner is concerned, details can also be verified by contacting the appropriate regional Public Health Office here:https://www.gov.uk/guidance/contacts-phe-regions-and-local-centres#contact-details-for-your-region-and-local-centre