GMC Logo Search the register GMC Online
  1. Home
  2. Ethical guidance
  3. Ethical guidance for doctors
  4. Confidentiality
  5. Using and disclosing patient information for direct care

Confidentiality: good practice in handling patient information

Using and disclosing patient information for direct care

Sharing information for direct care

26

Appropriate information sharing is an essential part of the provision of safe and effective care. Patients may be put at risk if those who provide their care do not have access to relevant, accurate and up-to-date information about them.9  Multidisciplinary and multi-agency teamwork is also placing increasing emphasis on integrated care and partnership working, and information sharing is central to this, but information must be shared within the framework provided by law and ethics.

9

In 2013, the Caldicott principles were updated to include a new principle: ‘the duty to share information can be as important as the duty to protect patient confidentiality.’

Implied consent and sharing information for direct care

27

Most patients understand and expect that relevant information must be shared within the direct care team to provide their care.19  You should share relevant information with those who provide or support direct care to a patient, unless the patient has objected (see paragraphs 30 and 31).11 

30

If a patient objects to particular personal information being shared for their direct care, you should not disclose the information unless it would be justified in the public interest,12  or is of overall benefit to a patient who lacks the capacity to make the decision. You can find further guidance on disclosures of information about adults who lack capacity to consent in paragraphs 41 - 49.

31

You should explain to the patient the potential consequences of a decision not to allow personal information to be shared with others who are providing their care. You should also consider with the patient whether any compromise can be reached. If, after discussion, a patient who has capacity to make the decision still objects to the disclosure of personal information that you are convinced is essential to provide safe care, you should explain that you cannot refer them or otherwise arrange for their treatment without also disclosing that information.

10

In this guidance, ‘direct care’ refers to activities that directly contribute to the diagnosis, care and treatment of an individual. The direct care team is made up of those health and social care professionals who provide direct care to the patient, and others, such as administrative staff, who directly support that care.

11

In England the Health and Social Care (Safety and Quality) Act 2015 created a duty to share information for direct care except in certain circumstances. See the legal annex to this guidance for more information.

28

The usual basis for sharing information for direct care is the patient’s consent, whether that is explicit or implied (see paragraph 13 for definitions). You may rely on implied consent to access relevant information about the patient or to share it with those who provide (or support the provision of) direct care to the patient if all of the following are met.

  1. You are accessing the information to provide or support the individual patient’s direct care, or are satisfied that the person you are sharing the information with is accessing or receiving it for this purpose.
  2. Information is readily available to patients, explaining how their information will be used and that they have the right to object. This can be provided in leaflets and posters, on websites, and face to face. It should be tailored to patients’ identified communication requirements as far as practicable.
  3. You have no reason to believe the patient has objected.
  4. You are satisfied that anyone you disclose personal information to understands that you are giving it to them in confidence, which they must respect.
13

Asking for a patient’s consent to disclose information shows respect, and is part of good communication between doctors and patients.6 

Consent may be explicit or implied.

  1. Explicit (also known as express) consent is given when a patient actively agrees, either orally or in writing, to the use or disclosure of information.
  2. Implied consent refers to circumstances in which it would be reasonable to infer that the patient agrees to the use of the information, even though this has not been directly expressed.
29

If you suspect a patient would be surprised to learn about how you are accessing or disclosing their personal information, you should ask for explicit consent unless it is not practicable to do so (see paragraph 14). For example, a patient may not expect you to have access to information from another healthcare provider or agency on a shared record.

14

You may disclose information on the basis of implied consent for direct care when the conditions in paragraphs 28 and 29 are met, and for local clinical audit when the conditions in paragraph 96 are met. In other cases, you should ask for explicit consent to disclose personal information unless it is not appropriate or practicable to do so.

For example, this might be because:

  1. the disclosure is required by law (see paragraphs 17 - 19)
  2. you are satisfied that informed consent has already been obtained by a suitable person7 
  3.  the patient does not have capacity to make the decision. In such a case, you should follow the guidance on disclosures about patients who lack capacity to consent (see paragraphs 41 - 49)
  4. you have reason to believe that seeking consent would put you or others at risk of serious harm
  5. seeking consent would be likely to undermine the purpose of the disclosure, for example by prejudicing the prevention, detection or prosecution of a serious crime
  6. action must be taken quickly, for example in the detection or control of outbreaks of some communicable diseases where there is insufficient time to contact the patient
  7. seeking consent is not feasible given the number or age of records, or the likely traceability of patients.

Patient objections to sharing information for direct care

30

If a patient objects to particular personal information being shared for their direct care, you should not disclose the information unless it would be justified in the public interest,12  or is of overall benefit to a patient who lacks the capacity to make the decision. You can find further guidance on disclosures of information about adults who lack capacity to consent in paragraphs 41 - 49.

41

You must work on the presumption that every adult patient has the capacity to make decisions about the disclosure of their personal information. You must not assume a patient lacks capacity to make a decision solely because of their age, disability, appearance, behaviour, medical condition (including mental illness), beliefs, apparent inability to communicate, or because they make a decision you disagree with.

42

You must assess a patient’s capacity to make a particular decision at the time it needs to be made, recognising that fluctuations in a patient’s condition may affect their ability to understand, retain or weigh up information, or communicate their wishes.

43

We give detailed advice on assessing a patient’s mental capacity in our guidance Consent: patients and doctors making decisions together. Practical guidance is also given in the Adults with Incapacity (Scotland) Act 2000 and Mental Capacity Act 2005 codes of practice.14 

44

You may disclose personal information if it is of overall benefit to patient who lacks the capacity to consent. When making the decision about whether to disclose information about a patient who lacks capacity to consent, you must:

  1. make the care of the patient your first concern
  2. respect the patient’s dignity and privacy
  3. support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information. 
45

You must also consider:

  1. whether the patient’s lack of capacity is permanent or temporary and, if temporary, whether the decision to disclose could reasonably wait until they regain capacity
  2. any evidence of the patient’s previously expressed preferences
  3. the views of anyone the patient asks you to consult, or who has legal authority to make a decision on their behalf, or has been appointed to represent them 
  4. the views of people close to the patient on the patient’s preferences, feelings, beliefs and values, and whether they consider the proposed disclosure to be of overall benefit to the patient
  5. what you and the rest of the healthcare team know about the patient’s wishes, feelings, beliefs and values. 
46

You might need to share personal information with a patient’s relatives, friends or carers to enable you to assess the overall benefit to the patient. But that does not mean they have a general right of access to the patient’s records or to be given irrelevant information about, for example, the patient’s past healthcare.

47

You must share relevant information with anyone who is authorised to make health and welfare decisions on behalf of, or who is appointed to support and represent, a patient who lacks capacity to give consent. This might be a welfare attorney, a court-appointed deputy or guardian, or an independent mental capacity advocate. You should also share information with independent mental health advocates in some circumstances.15 

48

If a patient asks you not to disclose personal information about their condition or treatment, and you believe they lack capacity to make that decision, you should try to persuade them to allow an appropriate person to be given relevant information about their care. In some cases, disclosing information will be required or necessary, for example under the provisions of mental health and mental capacity laws (see paragraph 47).

49

If the patient still does not want you to disclose information, but you consider that it would be of overall benefit to the patient and you believe they lack capacity to make that decision, you may disclose relevant information to an appropriate person or authority. In such cases, you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer. You must document in the patient’s records your discussions and the reasons for deciding to disclose the information.

12

For example, if staff providing treatment may be at risk of serious harm which cannot be managed through the use of universal precautions. See our explanatory guidance Disclosing information about serious communicable diseases. You can find all GMC guidance on professional standards and ethics at www.gmc-uk.org/guidance.

31

You should explain to the patient the potential consequences of a decision not to allow personal information to be shared with others who are providing their care. You should also consider with the patient whether any compromise can be reached. If, after discussion, a patient who has capacity to make the decision still objects to the disclosure of personal information that you are convinced is essential to provide safe care, you should explain that you cannot refer them or otherwise arrange for their treatment without also disclosing that information.

If a patient cannot be informed

32

Circumstances may arise in which a patient cannot be informed about the disclosure of personal information, for example in a medical emergency. In such cases, you should pass relevant information promptly to those providing the patient’s care.

33

If the patient regains the capacity to understand, you should inform them how their personal information was disclosed if it was in a way they would not reasonably expect.

Sharing information with those close to the patient

34

You must be considerate to those close to the patient and be sensitive and responsive in giving them information and support, while respecting the patient’s right to confidentiality.

Establishing what the patient wants

35

The people close to a patient can play a significant role in supporting, or caring for, the patient and they may want or need information about the patient’s diagnosis, treatment or care. Early discussions about the patient’s wishes can help to avoid disclosures they might object to.

Such discussions can also help avoid misunderstandings with, or causing offence or distress to, anyone the patient would want information to be shared with.

36

You should establish with the patient what information they want you to share, with whom, and in what circumstances. This will be particularly important if the patient has fluctuating or diminished capacity or is likely to lose capacity, even temporarily. You should document the patient’s wishes in their records.

Abiding by the patient's wishes

37

If a patient who has capacity to make the decision refuses permission for information to be shared with a particular person or group of people, it may be appropriate to encourage the patient to reconsider that decision if sharing the information may be beneficial to the patient’s care and support. You must, however, abide by the patient’s wishes, unless disclosure would be justified in the public interest (see paragraphs 63 - 70).

63

Confidential medical care is recognised in law as being in the public interest. The fact that people are encouraged to seek advice and treatment benefits society as a whole as well as the individual. But there can be a public interest in disclosing information to protect individuals or society from risks of serious harm, such as from serious communicable diseases or serious crime.23 

64

If it is not practicable to seek consent, and in exceptional cases where a patient has refused consent, disclosing personal information may be justified in the public interest if failure to do so may expose others to a risk of death or serious harm. The benefits to an individual or to society of the disclosure must outweigh both the patient’s and the public interest in keeping the information confidential.

65

Such a situation might arise, for example, if a disclosure would be likely to be necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person. When victims of violence refuse police assistance, disclosure may still be justified if others remain at risk, for example from someone who is prepared to use weapons, or from domestic violence when children or others may be at risk.

66

Other examples of situations in which failure to disclose information may expose others to a risk of death or serious harm include when a patient is not fit to drive,24 or has been diagnosed with a serious communicable disease,25  or poses a serious risk to others through being unfit for work.26 

67

When deciding whether the public interest in disclosing information outweighs the patient’s and the public interest in keeping the information confidential, you must consider:

  1. the potential harm or distress to the patient arising from the disclosure – for example, in terms of their future engagement with treatment and their overall health
  2. the potential harm to trust in doctors generally – for example, if it is widely perceived that doctors will readily disclose information about patients without consent
  3. the potential harm to others (whether to a specific person or people, or to the public more broadly) if the information is not disclosed
  4. the potential benefits to an individual or to society arising from the release of the information
  5. the nature of the information to be disclosed, and any views expressed by the patient
  6. whether the harms can be avoided or benefits gained without breaching the patient’s privacy or, if not, what is the minimum intrusion.
68

If you consider that failure to disclose the information would leave individuals or society exposed to a risk so serious that it outweighs the patient’s and the public interest in maintaining confidentiality, you should disclose relevant information promptly to an appropriate person or authority. You should inform the patient before disclosing the information, if it is practicable and safe to do so, even if you intend to disclose without their consent.

69

Decisions about whether or not disclosure without consent can be justified in the public interest can be complex. Where practicable, you should seek advice from a Caldicott or data guardian or similar expert adviser who is not directly connected with the use for which disclosure is being considered. If possible, you should do this without revealing the identity of the patient.

70

You must document in the patient’s record your reasons for disclosing information without consent and any steps you have taken to seek the patient’s consent, to inform them about the disclosure, or your reasons for not doing so.

38

If a patient lacks capacity to make the decision, it is reasonable to assume the patient would want those closest to them to be kept informed of their general condition and prognosis, unless they indicate (or have previously indicated) otherwise. You can find detailed advice on considering disclosures about patients who lack capacity to consent in paragraphs 41 - 49.

41

You must work on the presumption that every adult patient has the capacity to make decisions about the disclosure of their personal information. You must not assume a patient lacks capacity to make a decision solely because of their age, disability, appearance, behaviour, medical condition (including mental illness), beliefs, apparent inability to communicate, or because they make a decision you disagree with.

42

You must assess a patient’s capacity to make a particular decision at the time it needs to be made, recognising that fluctuations in a patient’s condition may affect their ability to understand, retain or weigh up information, or communicate their wishes.

43

We give detailed advice on assessing a patient’s mental capacity in our guidance Consent: patients and doctors making decisions together. Practical guidance is also given in the Adults with Incapacity (Scotland) Act 2000 and Mental Capacity Act 2005 codes of practice.14 

44

You may disclose personal information if it is of overall benefit to patient who lacks the capacity to consent. When making the decision about whether to disclose information about a patient who lacks capacity to consent, you must:

  1. make the care of the patient your first concern
  2. respect the patient’s dignity and privacy
  3. support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information. 
45

You must also consider:

  1. whether the patient’s lack of capacity is permanent or temporary and, if temporary, whether the decision to disclose could reasonably wait until they regain capacity
  2. any evidence of the patient’s previously expressed preferences
  3. the views of anyone the patient asks you to consult, or who has legal authority to make a decision on their behalf, or has been appointed to represent them 
  4. the views of people close to the patient on the patient’s preferences, feelings, beliefs and values, and whether they consider the proposed disclosure to be of overall benefit to the patient
  5. what you and the rest of the healthcare team know about the patient’s wishes, feelings, beliefs and values. 
46

You might need to share personal information with a patient’s relatives, friends or carers to enable you to assess the overall benefit to the patient. But that does not mean they have a general right of access to the patient’s records or to be given irrelevant information about, for example, the patient’s past healthcare.

47

You must share relevant information with anyone who is authorised to make health and welfare decisions on behalf of, or who is appointed to support and represent, a patient who lacks capacity to give consent. This might be a welfare attorney, a court-appointed deputy or guardian, or an independent mental capacity advocate. You should also share information with independent mental health advocates in some circumstances.15 

48

If a patient asks you not to disclose personal information about their condition or treatment, and you believe they lack capacity to make that decision, you should try to persuade them to allow an appropriate person to be given relevant information about their care. In some cases, disclosing information will be required or necessary, for example under the provisions of mental health and mental capacity laws (see paragraph 47).

49

If the patient still does not want you to disclose information, but you consider that it would be of overall benefit to the patient and you believe they lack capacity to make that decision, you may disclose relevant information to an appropriate person or authority. In such cases, you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer. You must document in the patient’s records your discussions and the reasons for deciding to disclose the information.

Listening to those close to the patient

39

In most cases, discussions with those close to the patient will take place with the patient’s knowledge and consent. But if someone close to the patient wants to discuss their concerns about the patient’s health without involving the patient, you should not refuse to listen to their views or concerns on the grounds of confidentiality. The information they give you might be helpful in your care of the patient.

40
You should, however, consider whether your patient would consider you listening to the views or concerns of others to be a breach of trust, particularly if they have asked you not to listen to specific people. You should also make clear that, while it is not a breach of confidentiality to listen to their concerns, you might need to tell the patient about information you have received from others – for example, if it has influenced your assessment and treatment of the patient.13  You should also take care not to disclose personal information unintentionally – for example, by confirming or denying the person’s perceptions about the patient’s health.
13

Patients are also entitled to access their health records under the Data Protection Act 1998. See endnote 54.

Disclosures about patients who lack capacity to consent

41

You must work on the presumption that every adult patient has the capacity to make decisions about the disclosure of their personal information. You must not assume a patient lacks capacity to make a decision solely because of their age, disability, appearance, behaviour, medical condition (including mental illness), beliefs, apparent inability to communicate, or because they make a decision you disagree with.

42

You must assess a patient’s capacity to make a particular decision at the time it needs to be made, recognising that fluctuations in a patient’s condition may affect their ability to understand, retain or weigh up information, or communicate their wishes.

43

We give detailed advice on assessing a patient’s mental capacity in our guidance Consent: patients and doctors making decisions together. Practical guidance is also given in the Adults with Incapacity (Scotland) Act 2000 and Mental Capacity Act 2005 codes of practice.14 

14

The main provisions of the Mental Capacity Act (Northern Ireland) 2016 have not yet come into force. The common law duty to act in the best interests of a patient who lacks capacity to consent therefore continues until the Act is commenced.

Considering the disclosure

44

You may disclose personal information if it is of overall benefit to patient who lacks the capacity to consent. When making the decision about whether to disclose information about a patient who lacks capacity to consent, you must:

  1. make the care of the patient your first concern
  2. respect the patient’s dignity and privacy
  3. support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information. 
45

You must also consider:

  1. whether the patient’s lack of capacity is permanent or temporary and, if temporary, whether the decision to disclose could reasonably wait until they regain capacity
  2. any evidence of the patient’s previously expressed preferences
  3. the views of anyone the patient asks you to consult, or who has legal authority to make a decision on their behalf, or has been appointed to represent them 
  4. the views of people close to the patient on the patient’s preferences, feelings, beliefs and values, and whether they consider the proposed disclosure to be of overall benefit to the patient
  5. what you and the rest of the healthcare team know about the patient’s wishes, feelings, beliefs and values. 
46

You might need to share personal information with a patient’s relatives, friends or carers to enable you to assess the overall benefit to the patient. But that does not mean they have a general right of access to the patient’s records or to be given irrelevant information about, for example, the patient’s past healthcare.

47

You must share relevant information with anyone who is authorised to make health and welfare decisions on behalf of, or who is appointed to support and represent, a patient who lacks capacity to give consent. This might be a welfare attorney, a court-appointed deputy or guardian, or an independent mental capacity advocate. You should also share information with independent mental health advocates in some circumstances.15 

15

Independent mental health advocates should also be given the information listed in section 130B of the Mental Health Act 1983. Guidance on the roles of independent mental health advocates is given in the Mental Health Act 1983 Code of Practice 2015.

If a patient who lacks capacity asks you not to disclose

48

If a patient asks you not to disclose personal information about their condition or treatment, and you believe they lack capacity to make that decision, you should try to persuade them to allow an appropriate person to be given relevant information about their care. In some cases, disclosing information will be required or necessary, for example under the provisions of mental health and mental capacity laws (see paragraph 47).

49

If the patient still does not want you to disclose information, but you consider that it would be of overall benefit to the patient and you believe they lack capacity to make that decision, you may disclose relevant information to an appropriate person or authority. In such cases, you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer. You must document in the patient’s records your discussions and the reasons for deciding to disclose the information.