Medical confidentiality is the cornerstone of medical ethics.1 It is one of the core concepts of professionalism and should be an integral part of the curriculum in medical school and postgraduate medical education.2

Laws in most countries require physicians to keep secret all information they learn during a professional patient–physician encounter and not to transmit it to third persons.3 The right to confidentiality persists after death.4 In some situations the law requires the physician to disclose information. In most countries this is the case for certain infectious diseases and for death and birth certificates.5 In most cases the decision to disclose information or not has to be made by the physician on ethical and legal grounds. The balancing of conflicting interests is an important part of the decision-making process. If identifiable victims are at risk of serious harm that cannot be prevented except by breaching confidentiality, physicians need to consider the option of warning the victim or providing information to the police. Physicians could be held liable if they fail to disclose information that could have prevented serious harm, as was the case in Tarasoff v The Regents of the University of California.6 7 However, the contrary could also happen—that is, a court could find that confidentiality should not have breached by the physician.8 In some countries, though not in Switzerland or the UK,9 physicians have a legal obligation to report child or elder abuse10 11 as well as domestic violence.12

Studies show that physicians’ attitudes towards confidentiality vary when faced with hypothetical cases. They may have different thresholds for disclosure when balancing the interests of their patients and of third parties.13 Moreover, some physicians take their obligation to prevent avoidable breaches more seriously than others: a sizeable number of physicians talk to family members and friends about identifiable patients14 or do not take sufficient precautions when speaking about patients in public places.15 In adddition, many physicians overestimate their duties to transmit information to the police.1 It is hardly possible to eliminate completely some violations of confidentiality that are due to differences in the balancing of interests: in difficult cases, various specialists in ethics and even the courts might come to different conclusions. However, some breaches of confidentiality could be avoided if physicians were made aware of their patients’ strong wishes regarding protection of their privacy16^–18 and if physicians knew more about their ethical and legal obligations in situations at risk for unnecessary disclosure of information.

The aim of our study was to define the factors influencing physicians’ attitudes towards patient confidentiality in everyday situations in order to define the need to offer further ethical and legal education to various subgroups of physicians. To our knowledge, no other study has so far tried to identify these factors.

Our hypotheses were that having attended a course in ethics or health law is associated with a more accurate identification of violations of confidentiality. We also thought that learning to avoid breaches of confidentiality is part of the hospital training of young physicians: the latter might therefore be less experienced with respect to confidentiality, in particular if they are confronted with hypothetical scenarios that they have not yet encountered themselves. Data were also collected to test the following additional questions: do demographic variables such as age and gender, hospital versus private practice, the type of specialty or the fact of having a subspecialty in internal medicine influence attitudes towards confidentiality? The transmission of anonymous information is in general permitted. A violation of confidentiality takes place if the patient is identifiable and has not consented to the transmission of his personal data. We thought therefore that one factor influencing the ability to identify a breach of confidentiality is a physician’s sensitivity to the risk that a patient is identifiable in a given situation. We also wanted to know whether participants who consider the physician responsible (alone or together with another person) in a hypothetical case involving unauthorised transmission of information by a computer specialist are in general more sensitive to confidentiality violations in this and other cases than physicians who tend to attribute the blame to others and to exclude their own responsibility.

METHODS

All internists and general practitioners who were registered members of the association of physicians (Association des médecins de Genève; AMG) in Geneva or who were working in the department of internal medicine or in the medical polyclinic of the University Hospital of Geneva in 2004 received a standardised anonymous questionnaire (N = 925). Physicians reported their specialty, age, gender, length of experience and ethical training. They were asked to indicate in seven hypothetical cases whether a violation of confidentiality had occurred and whether the violation was unimportant, important or serious (scores 1–3; no violation  =  score 0).

In Switzerland, physicians can be punished for violations of medical confidentiality according to criminal law. The questionnaire was therefore discussed with three professors of criminal law from the University of Geneva to establish whether a violation took place and whether the violation is serious or not.19 For this evaluation, it was imagined that the case was brought to the courts and whether a judge would consider mitigating circumstances for the physician when establishing the penalty (the amount of the fine or the length of imprisonment).

All seven hypothetical scenarios of the questionnaire describe a physician who violates confidentiality. We chose situations in which physicians are at risk of not respecting medical confidentiality, based on previous experience of members of the Institute of Legal Medicine in Geneva. The seven cases we used are the following:

• Case 1: An internist reveals the disease and name of a politician to his wife, who is herself a physician but is not at all involved in the politician’s healthcare.

• Case 2: A physician tells his wife the diagnosis of his patient, mentioning that the patient is one of the five male members of the cantonal government.

• Case 3: A gynaecologist informs his colleague that a patient is positive for hepatitis. Without being explained explicitly, the context of the case suggests that the patient could not be considered to be aware of the disclosure. Indeed, being dissatisfied with her gynaecologist, she informs him that she wants to consult the colleague instead.

• Case 4: A physician discloses the list of all the physician’s patients at the request of a police officer who wants to investigate the theft of a purse that occurred in the waiting room.

• Case 5: A surgeon transmits the medical record of a patient to a forensic pathologist in order to enable the latter to find out whether the patients’ medical characteristics match those of a recently found cadaver.

• Case 6: A physician discloses to a lawyer friend at a dinner party that a female patient with important injuries complained about police violence during the evacuation of a squat the same day. Physicians were asked whether they think that the patient in this vignette is identifiable or not.

• Case 7: A computer specialist is described who, after repairing a physician’s computer, takes home a list of all patients. In this case, physicians were asked whether they think that a violation occurred and also who should be considered responsible for the violation—the physician, the computer specialist or both.

SPSS for windows 16.0 was used for statistical analyses. For each participant, a total score for “unidentified violations” was calculated, which counted how many times the score 0 had been given by each participant. A score of 3 indicated, therefore, that a participant had not identified violations in three cases, the theoretical maximum score of possible unidentified violations being 7. We used Student t tests to compare the scores of different groups concerning this variable “unidentified violations”. Non-parametric tests (Mann–Whitney and Kruskal–Wallis) were used to compare the scores 0 to 3 assigned by different groups to each case.

Differences between groups were considered significant if p values were ⩽0.05.

ANCOVA and stepwise linear regression were used for multivariate analysis to identify factors predicting how often physicians failed to identify a violation (the variable “unidentified violations”).

Binary logistic regression was carried out to determine which variables predict the response to each of the seven cases separately. Among the possible binary variables for each case, we chose the one where the responses of all physicians were the closest to a 50/50 split:

• Case 1: 0–2 (n = 318, 64.1%) vs 3 (n = 178, 35.9%)

• Case 2: 0–1 (n = 282, 57.6%) vs 2–3 (n = 208, 42.4%)

• Case 3: 0 (n = 276, 56.8%) vs 1–3 (n = 210, 43.2%)

• Case 4: 0–1 (n = 175, 35.8%) vs 2–3 (n = 314, 64.2%)

• Case 5: 0 (n = 365, 75.9%) vs 1–3 (n = 116, 24.1%)

• Case 6: 0–1 (n = 202, 41.7%) vs 2–3 (n = 282, 58.3%)

• Case 7: 0–2 (n = 114, 26.4%) vs 3 (n = 318, 73.6%)

This type of binary variable was preferred because any other systematic binary transformation of the 4-point score would have implied vignettes where a very small number of respondents would have to be compared with a large majority: for example, the variable “non-violation vs violation” in case 7 would have meant comparing 4.4% (n = 19) of the participants with 95.6% (n = 417).

The following independent variables were entered in the regression (“stepwise” in the linear logistic regression and using the stepwise “forward conditional” option in the binary logistic regression): age, gender, AMG versus hospital physician, participation in an ethics course in general, participation in the course in health law and ethics taught in Geneva, being an internist, having completed a subspecialty of internal medicine, working in private practice, number of years of private practice, number of years of hospital practice, hospital practice of more than 10 or 20 years, and years of postgraduate medical experience (see Appendix A, table A1). The threshold for entering and removing variables was set at p = 0.05.

RESULTS

A total of 508 complete questionnaires were returned (participation rate 55%). The characteristics of the two groups of doctors are shown in table 1.

The law professors considered violations serious (score 3) in cases 1, 2, 4, 6 and 7, because there are no mitigating circumstances to excuse the violation. They considered the breaches less serious, but still important, in cases 3 and 5 (score 2): in both cases the physician’s intention is altruistic. The intention to protect his colleague and the willingness to help with the identification of the cadaver were considered to be mitigating circumstances justifying the score 2 instead of 3.

The mean scores assigned by physicians varied according to the case. For all seven cases, they were lower than those proposed by the law professors (the “gold standard”). The differences between physicians’ mean scores and the gold standard were smallest in case 7 (0.4 points lower than the gold standard (physicians 2.6 vs law professors 3), highest in cases 2 and 5 (physicians 1.6 points lower than the gold standard) and intermediate in cases 1 (1.1 points lower), 3 and 4 (1.3 points lower) and 6 (1.4 points lower).

In case 7, 129 participants (25.4%) thought that the physician was responsible for the breach of confidentiality, 125 (24.6%) considered both the physician and the informatics specialist responsible, 199 (39.2%) indicated that only the computer specialist was responsible for the violation, and 34 (6.7%) ticked the answer “I don’t know”. Significantly more (32.5%) of the participants who thought that the physician alone was guilty than those who considered the informatics specialist guilty, alone or together with the physician (22.6%), assigned a score below 3—that is, a score lower than the gold standard.

Physicians who had worked in the hospital for more than 20 years identified violations of confidentiality more often than physicians with less hospital experience (table 2). Physicians who thought that in case 7 the physician was responsible for the violation either alone or together with the computer specialist (n = 254) identified confidentiality violations more often in the seven cases than all other physicians (n = 254). The former had higher scores than the latter in all cases: the differences were significant for four cases (cases 1, 2, 4, 6; table 3). Otherwise, the factors associated with identifying the violation and its severity were specific for each case and we could not identify a “trait” in favour or against confidentiality (Cronbach α<0.6 for the seven cases).

For each physician, we counted the number of cases assigned the score 0 (no violation). Physicians believed that no violation occurred for a mean of almost 2 cases (mean 1.9 (SD 1.2) cases). Stepwise linear regression of the dependent variable “number of unidentified violations” retained four independent variables that were significantly associated with correct identification of the violations: those most likely to identify correctly that the vignette described a breach of confidentiality were those with more years of hospital practice, those with more years of private practice, those who had attended the Geneva course in health law and women (table 4).

Binary logistic regression of the responses of the 508 physicians to the seven cases confirmed that several factors are associated with correct identification of violations and their severity, but each factor played a specific role only for single cases or a small number of situations. Binary logistic regression showed also that although most factors vary from case to case, the overall picture is a general coherent influence of a small number of factors that were associated with more accurate identification of the violation and its seriousness. The variables “length of hospital practice” and “more than 10 or 20 years of hospital practice” were retained in the “forward conditional” modus in cases 2, 3 and 7. Three variables were retained in two cases: the variable “ethics course” in cases 3 and 5, the variable “the physician in case 7 is guilty either alone or together with the computer specialist” in cases 1 and 4 and the variable “patient in case 6 is identifiable” in cases 2 and 6 (see Appendix A, table A1). Two variables were retained for only one case: “years of private practice” in case 4 and “age” in case 6.

Regarding whether a variable was significant when introduced separately (see Appendix A, table A1), besides the variables “more than 20 years of hospital practice”, “length of hospital practice” and “physician is guilty” in case 7 alone or together with the computer specialist” (tables 2 and 3), the variable “age” was significant in several cases (2, 4 and 6). Case 4 was distinct from all others in that it was the only one for which the variables “years of private practice”, “internist” and “years of postgraduate medical practice” were significantly associated with the ability to identify the violation. Case 7 is particular in that physicians who believed that the physician alone is guilty in this situation identified correctly the breach of confidentiality but were more likely to underestimate its severity than those who thought that the responsibility for the violation is either shared with the computer specialist or that only the computer specialist is guilty.

The variance explained by single or groups of factors did not exceed the 10% limit, except for one hypothetical situation: in case 6, the factor explaining more than 40% of the variance was whether a physician believed that the patient is identifiable or not. The majority of physicians (84.1%) thought this is the case. However, among those who considered that the patient is identifiable, 25 (6.8%) still considered that no violation of confidentiality takes place if the physician talks about the case at a party where a lawyer is present and another 68 (18.6%) physicians of those who considered the patient identifiable thought that the violation is not important.

DISCUSSION

The results of our study show that, according to the type of case, sizeable minorities or even a majority of physicians either do not correctly identify violations of confidentiality or underestimate their seriousness. These findings speak in favour of a need for more education. Our study makes it possible to identify factors that influence physicians’ responses. The description of these factors, as well as the analyses of physicians’ answers, helps to define in more detail in which areas, for which subgroups of physicians, and which type of education could be useful.

Only a small percentage of physicians identified all the violations. Our study might have overestimated physicians’ “errors”: physicians may have been inclined to not identify at least one violation because it might have seemed improbable to them that we chose seven cases with violations. However, this might only have shifted results towards generally lower scores and would not affect the influence of demographic or practice-related factors.

Ethics courses and practical training

Overall, our hypotheses concerning the positive influence of ethics courses and practical training were confirmed. The first important finding of our study is that having had theoretical health law education, during medical school or, especially, the course taught in Geneva, is positively associated with the ability to identify violations. However, of greater influence than theoretical education was the length of hospital practice (table 4). Years of private practice were a further independent factor associated with more correct identification of violations. This means that practising in the hospital and in private practice seems to add separate skills or knowledge. Indeed, as the binary logistic regression of responses to the seven cases shows, experience in private practice increased awareness of the confidentiality of patient data if the police request information concerning a theft in a physician’s waiting room—that is, in a situation typical for work with outpatients. Hospital experience seems to favour the identification of confidentiality breaches in all other cases.

However, all models explain only a small part of the variance of the variable “unidentified violations” and of the responses to the hypothetical cases. Neither theoretical courses nor practical experience seems to be sufficient to enable physicians to deal correctly with specific situations at risk for avoidable breaches of confidentiality. This indicates the need for education: ethics courses should address specifically those cases in which the majority of physicians did not identify the confidentiality breach. In addition, more studies are needed to test more hypothetical cases among physicians, since the seven cases we presented are not exhaustive for situations posing a risk of avoidable violation of confidentiality. Education seems to be indicated specifically for the two cases from our study where 57% (case 3) and 76% (case 5) of participants thought that no violation took place. Interestingly, both cases concern contacts with colleagues, with a gynaecologist and with a forensic specialist. Education sessions should address that sharing of information with colleagues is not always legally correct. While patients are expected to know and to have implicitly consented to the fact that sharing of information between health personnel in a hospital is part of normal routine that is in the interest of all patients, the same rules do not apply to private practice. If a patient is in conflict with her physician, as is described in case 3, physicians cannot assume implied consent to sharing of information with other physicians, but should obtain explicit consent before transmitting any information. In addition, it seems important to inform physicians about their obligation towards colleagues. Another study has shown that 71% of physicians felt under the obligation to inform surgeon colleagues about HIV-positive patients even if the patients asked them not to do this.20 This indicates that physicians seem to feel a strong obligation to protect their colleagues. However, in the case of the hepatitis-C-positive patient, contacting the gynaecologist is not justified, because a gynaecologist using routine protection (gloves) is not at risk. Moreover, if physicians rely on their colleagues to report patients’ infectious diseases, they might abandon routine protection, and overall risk from this behaviour would increase and not decrease the transmission of blood-borne infections to physicians.

The theoretical knowledge of physicians needs to be increased also concerning requests from forensic pathologists, to remind physicians that if it is not possible to obtain patient consent, they should always first search for a solution where individual information is not transmitted. In case 5, they should request a copy of the forensic records and compare them with the patient’s record in their hands. This permits them to confirm or refute whether the corpse has the same characteristics as their patient without giving away any personal patient information. Theoretical education should also address the question whether confidentiality obligations persist after a patient’s death. In Switzerland they do, as in the UK and many other countries.4

Awareness that patients may be identifiable, and “self-criticism”

Our study shows also that the awareness of the fact that patients are identifiable even if their name is not mentioned (cases 2 and 6) influences attitudes. Physicians who thought that the patient in case 6 is identifiable were more likely to correctly identify the confidentiality violation both in case 6 and in case 2. This indicates that increased sensitivity towards the possibility of identifying a patient seems to be a general trait that could be addressed during teaching modules.

Another interesting factor that was found to influence answers in a variety of cases is the ability to accept oneself as responsible and not to attribute guilt only to others—for example, to the computer specialist in case 7. This ability, which could be called “self-criticism”, seems to be another general trait, besides “sensitivity concerning identification”, that has a positive influence. Whether self-criticism can be influenced by education is open to debate, but a trial seems justified.21 22

The influence of gender

Being female was an independent factor associated with more identified violations in the linear regression. In line with our study, Lindenthal and Thomas found that among internists female physicians were more likely to be patient centred and not to breach confidentiality.23 Why might women be more sensitive to breaches of confidentiality? One explanation could be that self-criticism and sensitivity to risks to others are what one often calls typically female characteristics. In addition, the women in our study were a special group (data not shown): they were younger than the men. In addition, more of the women were hospital physicians and fewer were in private practice, although overall the same percentage of female and male physicians held a specialist title in a subdiscipline of internal medicine. The fact that the women in our sample were significantly younger than the men is interesting because age and experience were associated with more accurate identification of violations. Since “being a woman” means, in our study, being younger and having less professional experience, gender seems therefore to be a truly independent factor.

Internists versus general practitioners: the influence of physicians’ specialty

We found that internists assigned higher scores (ie, higher severity) to the confidentiality breach than general practitioners in one case only (case 4). Due to the scarcity of studies, it is difficult to interpret this result. Lako and Lindenthal did not find any differences between confidentiality attitudes of general practitioners and family physicians in New Jersey,24 while Lindenthal and Thomas found significant differences between internists and psychiatrists, the latter defending confidentiality more strongly than the former.23 The differences could be influenced by the type of information that physicians are handling. Since psychiatric information is often considered to be more sensitive, psychiatrists might be more protective concerning patient information than other physicians. Internists in our study might have been more critical about physicians giving out patient lists (as in case 4) than general practitioners because consulting an internist might indicate more severe disease and could therefore be viewed as more stigmatising for patients than their seeing a general practitioner.

Methodological limitations

Our study has a few methodological limitations: since the response rate was 55%, our sample could have selected physicians who are interested in ethics and health law and those who are motivated to attend teaching modules. However, since we found that even motivated physicians interested in health law could benefit from more education on confidentiality, the response rate will not affect the overall conclusion of this research. In addition, it is not likely that factors influencing responses vary significantly between physicians who are motivated about and interested in ethics and those who are not.

CONCLUSIONS

Our study shows that several factors influence physicians’ ability to identify violations of confidentiality. Among these are years of hospital and private practice, ethics and health law courses during medical school, sensitivity concerning the risk that patients are identifiable even if their names are not mentioned and a form of self-criticism that makes physicians recognise their own responsibility. Although these factors play some role, in our study the risk of inadvertently breaching confidentiality is influenced predominantly by the type of situation. Postgraduate education programs on confidentiality are indicated for most physicians and should address specific hypothetical situations that pose a risk of avoidable breaches of confidentiality.