Doctor-Patient Confidentiality

Q:

I keep seeing private information about COVID-19 patients circulating on social media… is there a law to stop this from happening?

A:

Interestingly, I have been thinking about this topic since the Opposition Leader, Kamla Persad-Bissessar, released information on the first COVID-19 related death in Trinidad & Tobago a couple weeks ago… and then again when apparently that same person’s medical history was later circulated on social media.

It was clear that the medical information I’m referring to (and I assume you are as well) could have only originated from the person’s confidential medical record, and thus shared by a medical professional. And if that medical professional was a doctor, they would have acted in breach of the Medical Board of Trinidad and Tobago Code of Ethics in the Practice of Medicine.

In addition to that specific breach for a doctor, and for any other medical professional who could have released the information, for privacy laws in Trinidad and Tobago, we have the Data Protection Act 2011:

4. The object of this Act is to ensure that protection is afforded to an individual’s right to privacy and the right to maintain sensitive personal information as private and personal.

Section 2 defines the term “sensitive personal information” to mean information on a person’s–

(a) racial or ethnic origins;

(b) political affiliations or trade union membership;

(c) religious beliefs or other beliefs of a similar nature;

(d) physical or mental health or condition;

(e) sexual orientation or sexual life; or

(f) criminal or financial record;

For a breach of patient confidentiality by doctor employed at a public institution, a person may be able to place that liability on the hospital/regional health authority:

40. (1) A public body shall not process sensitive personal information unless it obtains the consent of the person to whom that sensitive personal information relates.

But if there’s a breach of the doctor-patient confidentiality in the doctor’s private capacity, the following sections should apply:

69. A person who—

 (a) collects, retains, manages, uses, processes or stores personal information in Trinidad and Tobago;

 (b) collects personal information from individuals in Trinidad and Tobago; or

 (c) uses an intermediary or telecommunications service provider located in Trinidad and Tobago to provide a service in furtherance of paragraph (a) or (b),

shall follow the General Privacy Principles set out in section 6 in dealing with personal information.

Those General Privacy Principles are:

6. The following principles are the General Privacy Principles which are applicable to all persons who handle, store or process personal information belonging to another person:

…

(c) knowledge and consent of the individual are required for the collection, use or disclosure of personal information;

…

(e) personal information shall only be retained for as long as is necessary for the purpose collected and shall not be disclosed for purposes other than the purpose of collection without the prior consent of the individual;

…

(g) personal information is to be protected by such appropriate safeguards having regard to the sensitivity of the information;

(h) sensitive personal information is protected from processing except where otherwise provided for by written law;

…

With all that being said, these are the penalties for breaching the provisions of the Act:

95. (1) A person who commits an offence under this Act is liable upon—

(a) summary conviction, to a fine of not more than fifty thousand dollars or to imprisonment for a term of three years; and

(b) conviction on indictment, to a fine of not more than one hundred thousand dollars or to imprisonment for a term of not more than five years.