The Law
According to well-established rules, a public authority must possess the power to carry out what it intends to do.
If not, its action is ‘ultra vires’, that is, beyond its lawful powers.
It is also necessary that the power is exercised for the purpose for which it was created or is ‘reasonably incidental’ to the defined purpose.
It is important that all HSC bodies are aware of the extent and limitations of their powers and act ‘intra vires’.
The approach often adopted by Government to address situations where a disclosure of information is prevented by lack of function (the ‘ultra vires’ rule), is to create, through legislation, new statutory gateways that provide public sector bodies with the appropriate information disclosure function.
However, unless such legislation explicitly requires that confidential patient/client information be disclosed, or provides for common law confidentiality obligations to be set aside, then these obligations must be satisfied prior to information disclosure and use taking place, for example by obtaining explicit patient/client consent.
Records management considerations
Staff should be trained in the legal framework covering the disclosure of confidential patient/client information.
They should also be provided with procedures for obtaining explicit consent and guidance on where to seek advice if they are unsure whether they should disclose such information.