Confidentiality guidance: Disclosing information with consent

1. 24. Seeking a patient’s consent to disclosure of information shows respect, and is part of good communication between doctors and patients.

Circumstances in which patients may give implied consent to disclosure

Sharing information within the healthcare team or with others providing care

1. 25. Most patients understand and accept that information must be shared within the healthcare team in order to provide their care. You should make sure information is readily available to patients explaining that, unless they object, personal information about them will be shared within the healthcare team, including administrative and other staff⁹ who support the provision of their care.

1. 26. This information can be provided in leaflets, posters, on websites, and face to face and should be tailored to patients’ identified needs as far as practicable. Posters might be of little assistance to patients with sight impairment or who do not read English, for example. In reviewing the information provided to patients, you should consider whether patients would be surprised to learn about how their information is being used and disclosed.

1. 27. You must respect the wishes of any patient who objects to particular information being shared within the healthcare team or with others
   providing care, unless disclosure would be justified in the public interest. If a patient objects to a disclosure that you consider essential to the
   provision of safe care, you should explain that you cannot refer them or otherwise arrange for their treatment without also disclosing that
   information.
   
   28. You must make sure that anyone you disclose personal information to understands that you are giving it to them in confidence, which they must respect. All staff members receiving personal information in order to provide or support care are bound by a legal duty of confidence, whether or not they have contractual or professional obligations to protect confidentiality.

1. 29. Circumstances may arise in which a patient cannot be informed about the disclosure of information, for example in a medical emergency. In such a case you should pass relevant information promptly to those providing the patient’s care. If and when the patient is capable of understanding, you should inform them how their personal information was disclosed if it was in a way they would not reasonably expect.

Local clinical audit

1. 30. All doctors in clinical practice have a duty to participate in clinical audit and to contribute to National Confidential Inquiries.¹⁰ If an audit is to be undertaken by the team that provided care, or those working to support them, such as clinical audit staff, you may disclose identifiable information, provided you are satisfied that the patient:
   1. (a) has ready access to information that explains that their personal information may be disclosed for local clinical audit, and that they
      have the right to object, and
   2. (b) has not objected.
2. 31. If a patient does object you should explain why the information is needed and how this may benefit their own, and others’ care. If it is not possible to provide safe care without disclosing information for audit, you should explain this to the patient and the options open to them.
   
   32. If clinical audit is to be undertaken, but not by the team that provided care or those who support them, the information should be anonymised or coded. If this is not practicable, or if identifiable information is essential to the audit, you should disclose the information only if you have the patient’s express consent. (See the guidance on Research and other secondary uses in paragraphs 40 to 50.)

Disclosures for which express consent should be sought

1. 33. As a general rule, you should seek a patient’s express consent before disclosing identifiable information for purposes other than the provision of their care or local clinical audit, such as financial audit and insurance or benefits claims.¹¹
2. 34. If you are asked to provide information to third parties, such as a patient’s insurer or employer or a government department or an agency assessing a claimant’s entitlement to benefits, either following an examination or from existing records, you should:
   1. (a) be satisfied that the patient has sufficient information about the scope, purpose and likely consequences of the examination and disclosure, and the fact that relevant information cannot be concealed or withheld
   2. (b) obtain or have seen written consent to the disclosure from the patient or a person properly authorised to act on the patient’s behalf; you may accept an assurance from an officer of a government department or agency or a registered health professional acting on their behalf that the patient or a person properly authorised to act on their behalf has consented
   3. (c) only disclose factual information you can substantiate, presented in an unbiased manner, relevant to the request; so you should not usually disclose the whole record, although it may be relevant to some benefits paid by government departments and to other assessments of patients’ entitlement to pensions or other health-related benefits, and
   4. (d) offer to show your patient, or give them a copy of, any report you write about them for employment or insurance purposes before it is sent, unless:
      1. (i) they have already indicated they do not wish to see it
      2. (ii) disclosure would be likely to cause serious harm to the patient or anyone else
      3. (iii) disclosure would be likely to reveal information about another person who does not consent.¹²

1. 35. If a patient refuses consent, or if it is not practicable to get their consent, information can still be disclosed if it is required by law or can be justified in the public interest (see paragraphs 36 to 56). If the purpose is covered by a regulation made under section 251 of the NHS Act 2006, disclosures can also be made without a patient’s consent, but not if the patient has objected.¹³