Confidentiality guidance: Principles

1. 6. Confidentiality is central to trust between doctors and patients. Without assurances about confidentiality, patients may be reluctant to seek medical attention or to give doctors the information they need in order to provide good care. But appropriate information sharing is essential to the efficient provision of safe, effective care, both for the individual patient and for the wider community of patients.
2. 7. You should make sure that information is readily available to patients explaining that, unless they object, their personal information may be disclosed for the sake of their own care and for local clinical audit. Patients usually understand that information about them has to be shared within the healthcare team to provide their care. But it is not always clear to patients that others who support the provision of care might also need to have access to their personal information. And patients may not be aware of disclosures to others for purposes other than their care, such as service planning or medical research. You must inform patients about disclosures for purposes they would not reasonably expect, or check that they have already received information about such disclosures.
3. 8. Confidentiality is an important duty, but it is not absolute. You can disclose personal information if:
   
   1. (a) it is required by law (see paragraphs 17 to 23)
   2. (b) the patient consents – either implicitly for the sake of their own care (see paragraphs 25 to 31) or expressly for other purposes (see paragraphs 32 to 35)
   3. (c) it is justified in the public interest (see paragraphs 36 to 56).
4. 9. When disclosing information about a patient, you must:
   1. (a) use anonymised or coded information if practicable and if it will serve the purpose
   2. (b) be satisfied that the patient:
      1. (i) has ready access to information that explains that their personal information might be disclosed for the sake of their own care, or for local clinical audit, and that they can object, and
      2. (ii) has not objected
   3. (c) get the patient’s express consent if identifiable information is to be disclosed for purposes other than their care or local clinical audit, unless the disclosure is required by law or can be justified in the public interest
   4. (d) keep disclosures to the minimum necessary, and
   5. (e) keep up to date with, and observe, all relevant legal requirements, including the common law and data protection legislation.²
5. 10. When you are satisfied that information should be disclosed, you should act promptly to disclose all relevant information.
6. 11. You should respect, and help patients to exercise, their legal rights to:
   1. (a) be informed about how their information will be used, and
   2. (b) have access to, or copies of, their health records.³