Medical Confidentiality: An Obligation to Uphold in All Circumstances?

At the heart of the triangular relationship between patients, healthcare professionals and society, medical confidentiality concerns information that may be sensitive and must therefore be protected. While breaches of medical confidentiality may result in sanctions, certain exceptions are also provided for by law.

Medical confidentiality refers to “the obligation of healthcare professionals to maintain the confidentiality of medical and non-medical information obtained in the course of their professional relationship with a patient”. This principle plays a crucial role in medical ethics and professional conduct, as well as in Luxembourg law and culture.

Medical confidentiality is based on four fundamental values, as explained by Alexandra Corre, Counsel at Brucher Thieltgen & Partners.

“The first principle is respect for the trust placed in a doctor by a person in a vulnerable situation. This respect for trust is closely linked to professional ethics, which constitutes the second principle. Through the medical oath, both the dignity of the doctor and the vulnerability of the patient are protected.”

The third principle is the protection of privacy, which is a fundamental freedom. Finally, the fourth concerns the interests of society as a whole. A breach of confidentiality could discourage individuals from seeking medical care, potentially leading to serious public health consequences.

Who Is Bound by Medical Confidentiality?

Numerous healthcare professions are subject to medical confidentiality. Under the Luxembourg Criminal Code, this obligation applies to doctors, surgeons, pharmacists, health officers and midwives.

However, the Criminal Code also covers any person who, by virtue of their status or profession, is entrusted with confidential information.

This includes other healthcare professionals, such as dentists, nurses, physiotherapists, nursing staff and healthcare facility directors, as well as court-appointed experts, including medical experts and experts responsible for calculating damages.

The law is clear: any such person who discloses confidential information, except where called upon to testify in court or where disclosure is required by law, may be subject to criminal penalties.

Other professionals, such as cleaning staff working in hospitals, are not necessarily subject to medical confidentiality obligations. However, they must comply with a duty of discretion, which is often included in their employment contracts and whose breach may constitute misconduct.

As for patients, medical confidentiality cannot be invoked against them.

“Patients may therefore release healthcare professionals from their duty of confidentiality or provide written authorisation allowing a third party who is not involved in their care to access their medical records.”

What Information Is Protected?

Under the Code of Medical Ethics, medical confidentiality protects all information entrusted to a doctor, but its scope extends beyond this.

Everything a doctor has seen, heard, understood or interpreted in the course of practising their profession is also protected by medical confidentiality.

This includes patients’ statements, diagnoses, medical records, information disclosed by family members, and details concerning the patient’s family, social, psychological or financial circumstances insofar as they relate to the patient’s health.

Are There Any Exceptions?

Medical confidentiality may be lifted in certain circumstances, particularly when a healthcare professional is called upon to testify in court, where disclosure may be permitted, or when the law requires information to be disclosed.

“The obligation to disclose refers to situations in which the law requires information to be communicated for various reasons. These may concern civil status, such as the registration of births or deaths; public health, such as the reporting of infectious or communicable diseases; requests from judicial authorities in matters relating to guardianship or curatorship; or situations in which a doctor must provide a medical adviser working for a health insurance fund with information concerning a patient’s health.”

Healthcare professionals are also required to report certain crimes committed against minors to the judicial authorities, particularly where it is still possible to prevent or limit their consequences or prevent another crime from occurring.

They must also disclose information where a child may be at risk. For example, when a doctor suspects that a child has been sexually abused, they are required to report the situation.

In addition to mandatory disclosure, healthcare professionals may also have the right to disclose information in specific circumstances, particularly when testifying in court.

“Healthcare professionals are required to appear before the court and may agree to testify. However, it is preferable for the patient to authorise such disclosure. Similarly, if a healthcare professional becomes aware of a serious criminal offence committed against a patient, they may report it. If the patient is a minor, reporting becomes mandatory. Finally, confidentiality may be lifted out of necessity where a serious and imminent danger threatens the patient or a third party.”

These situations illustrate the dilemma healthcare professionals may face: breaching medical confidentiality or potentially being held liable for failing to assist a person in danger.

Comparing the penalties associated with each situation may often help professionals determine the appropriate course of action.

What Are the Possible Sanctions for Breaching Medical Confidentiality?

As a fundamental patient right, medical confidentiality is legally protected.

Where patients have concerns, they may first discuss the matter directly with the healthcare professional involved.

If a breach is established, both parties may seek an amicable settlement.

Patients may also lodge a complaint with the competent disciplinary body, such as the Luxembourg Medical Council (Collège Médical) or the Higher Council governing certain healthcare professions. Disciplinary sanctions may range from a warning to a prohibition on practising.

In addition to disciplinary proceedings, patients may file a complaint with the National Commission for Data Protection (Commission Nationale pour la Protection des Données, CNPD), seek compensation for the damage suffered before the civil courts, or initiate criminal proceedings.

Indeed, a breach of medical confidentiality is punishable by criminal sanctions, including imprisonment for a period of eight days to six months and a fine ranging from EUR 500 to EUR 5,000. Patients may also join criminal proceedings as civil parties to seek compensation.

Both patients and healthcare professionals may seek assistance from a law firm such as Brucher Thieltgen & Partners, which can assess whether a breach of medical confidentiality may have occurred and provide advice and representation to the individuals concerned, whether healthcare professionals or private individuals, regarding the appropriate legal proceedings or defence strategy.

For further information, please do not hesitate to contact: