- Obtain consent to disclose identifiable patient information unless it is required by law or justified in the public interest.
- Be prepared to justify disclosures in the public interest.
- Follow relevant guidance from the GMC and the NHS.
Disclosures with patient consent
Consider whether information can be anonymised or if it is really necessary to disclose identifiable patient information. Most disclosures require consent, including:
- sharing information with other members of the healthcare team
- discussing the patient's diagnosis or care with family members and carers
- writing reports for insurers or the patient's employer
- disclosing medical records to solicitors - most solicitors provide the patient's signed consent when requesting information
- using case studies or images for research, education and training
- release of information to the media or online.
Obtaining consent
Implied consent
You can share personal information within the healthcare team to support patient care, provided the patient does not object. You should ensure information is readily available about this in the form of leaflets, posters, etc.
If a patient objects, you should explain the implications for their care but ultimately you should respect their wishes, unless disclosure is justified in the public interest (see below).
Express consent
When disclosures are for purposes other than patient care, you should be satisfied the patient has mental capacity and understands:
- who will see the information
- what is being disclosed
- the purpose of disclosure
- the significant foreseeable consequences.
The patient can give verbal or written consent. Contact us for advice if you're unsure.
Patients without capacity
Decide whether the disclosure is in the patient's best interests. Factors to consider include the patient's privacy and dignity; whether they might regain capacity; their previously expressed wishes and the views of those close to the patient.
Record why you decided the patient did not have capacity and why you believe you were justified in disclosing information.
Young patients
Follow the confidentiality guidance set out in the GMC's 0-18 years: guidance for all doctors.
Mandatory disclosures
You may be obliged to disclose patient information in some situations, including the below.
Courts, tribunals and coroners' inquiries
The judge or presiding court officer of a court might order you to disclose information. You should object if asked to disclose information to the court information that you consider irrelevant or potentially harmful and seek advice as needed.
You must disclose relevant information about a deceased patient to help a coroner or procurator fiscal but should not usually disclose information about living people.
The police
In most cases, you can disclose information only with the patient's consent or if you believe it is justified in the public interest. However, there are limited exceptions outlined below:
- If a driver suspected of a road traffic offence seeks treatment, the police can ask for their name and address under the Road Traffic Act 1988.
- You must disclose information that might be of material assistance in preventing an act of terrorism or securing the arrest of someone for a terrorist offence. Failure to do so without reasonable excuse is a criminal offence.
- Patients with gunshot or knife wounds should be reported to the police when admitted. This does not apply to knife injuries that are accidental or self-inflicted, but seek advice from a colleague if you're unsure. Do not disclose personal information, such as the patient's name and address, at this point.
- In England and Wales - you must inform the police if you discover an act of female genital mutilation (FGM) appears to have been carried out on a girl under the age of 18.
- When the police have obtained a valid court order compelling you to disclose information.
Regulatory bodies
You may be required to disclose information to organisations such as the GMC, CQC, the Parliamentary and Health Service Ombudsman (PHSO) and accountable officers (controlled drugs).
The PHSO has the power to require disclosure to help it fulfil its statutory duties.
The CQC and accountable officers say that information requests should be proportionate and the minimum necessary. It may be possible to provide anonymised information, so seek MDU advice.
HMRC
Following a written request from a tax inspector under Schedule 36, Part 1 of the Finance Act 2008.
Disease notification
Cases of certain diseases, such as acute meningitis and measles, must be notified to the proper officer of your local authority or health board.
Contact us if you're unsure whether you are legally required to disclose patient information.
Disclosures in the public interest
You will occasionally need to disclose information, even without the patient's consent, to protect individuals or the wider public from death or serious harm. In such cases, the patient's right to confidentiality is outweighed by the public interest. Examples include:
- you suspect a child is at risk of abuse
- a patient has confessed to a serious crime such as murder
- you are concerned a patient poses a risk to the public, eg they are suffering blackouts and continue to drive despite advice not to.
Before disclosing information in the public interest, you need to:
- weigh the possible harm of disclosure without consent (both to the patient, and to trust in the profession) against the harm that is likely to arise from not disclosing the information
- inform the patient that a disclosure will be made and why, unless it would be impracticable, put others at risk of harm, or prejudice the purpose of the disclosure
- act promptly to disclose relevant information
- keep disclosures of identifiable information to the minimum necessary and make sure you do not compromise the confidentiality of others.
Deceased patients
Your duty of confidentiality continues after a patient has died. If you receive a request to disclose information about a deceased patient, you should consider the following:
- whether the patient left any instructions
- if no instructions were left, whether releasing information is likely to cause distress to the patient's family or breach the confidentiality of others
- the purpose of the disclosure. The GMC has set out a list of circumstances when information about a dead patient should be released, such as when a parent asks for information about the circumstances and causes of a child's death
- your legal obligations, for example when someone has a right of access to records. We've published detailed guidance on the steps to take in this situation.
Contact us for help if you're unsure what to do in any of these situations.
This page was correct at publication on 09/06/2022. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.