In Good medical practice, we say the following:
41.‘You must be honest and objective when writing references, and when appraising or assessing the performance of colleagues, including locums and students. References must include all information relevant to your colleagues’ competence, performance and conduct.’
71. ‘You must be honest and trustworthy when writing reports, and when completing or signing forms, reports and other documents. You must make sure that any documents that you write or sign are not false or misleading.
a. You must take reasonable steps to check the information is correct.
b. You must not deliberately leave out relevant information.’
In Leadership and management for all doctors we also say the following:
34. ‘You must be honest and objective and keep to the principles of equality and diversity when appraising or assessing colleagues’ performance. This includes when assessing trainees during the Annual Review of Competence Progression (ARCP) or other equivalent process. The safety of patients and the public could be put at risk if you make false, exaggerated or incomplete comments about another professional’s competence or experience.’
This explanatory guidance provides more detail about how to follow these principles. It also explains to candidates what they can expect to be included in any references written about them.
Serious or persistent failures to follow this supplementary guidance will put your registration at risk.
Prospective employers use references to gather information about a candidate’s qualifications and employment history and to help them assess their suitability for the post in question.1 They also give both employers and candidates an opportunity to verify the information supplied in an application. So you should write references in a way that is fair to both the candidate2 and the prospective employer.
If you have concerns about a candidate's fitness to practise you should follow the advice at paragraph 25 of Good medical practice.
Spring v Guardian Assurance plc and others . The principles in Spring v Guardian Assurance have been found, by extension, to apply to statements made or information provided after the employee has taken up his or her new position (McKie v Swindon College  EWHC 469).
Employers need to be confident that they can rely on the information in references, particularly when they are employing healthcare professionals. Candidates also need to be confident that references written about them are accurate and reliable. A reference that presents an inaccurate picture of a prospective employee could lead either to an unsuitable candidate being appointed or the most suitable person not being appointed. In some cases this will put patients at risk of serious harm and it may undermine trust in the profession.
You must be honest and fair when providing references. You should usually provide a reference if you are the person best placed to do so. When providing a reference, you should state the basis upon which you are making your assessment of the candidate, such as how long you have known them and in what capacity.
When assessing whether information is relevant, you should consider whether including it (or leaving it out) could mislead an employer3 about either a specific issue or the overall suitability of a candidate. If you agree to provide a reference, you must do the following:
- Only provide comments that you can substantiate.
- Provide comments that are objective, fair and unambiguous.
- Do not base comments on your personal views4 about a candidate that have no bearing on the candidate’s suitability.
Kidd v Axa Equity & Law Life Assurance Society plc, Allied Dunbar Assurance plc 
This includes your views about a colleague’s age, colour, culture, disability, ethnic or national origin, gender, lifestyle, marital or parental status, race, religion or beliefs, sex, sexual orientation or socio-economic status.
You should include all information you are aware of that is relevant to a candidate’s professional competence and be prepared to provide evidence to support this, where appropriate.
You should provide information about a candidate’s conduct, including matters that might affect a patient’s trust in the individual candidate or the public’s trust in the profession as a whole.
You should draw attention to any other issues that could put patients at risk. This may include information relating to unresolved, outstanding or past complaints about the candidate’s competence, performance or conduct, if you judge that this is relevant to the candidate’s suitability. You should take reasonable steps to check the information you provide. If this is not practical, or the information is incomplete, you should make this clear.
You should not usually include personal information about a candidate, for example in relation to their health, in a reference. However, a situation may arise where you are aware of confidential information about a candidate that has a direct bearing on their suitability for the particular post in question. In these circumstances, you should get consent to disclose the information. If this is not practical, or consent is withheld, you should consider whether the benefits (to individual patients or the public) of disclosing the information would outweigh the possible harm to the individual candidate. For example, including health information may be justified if it is necessary to protect patients from risk of serious harm.5 You can find more guidance on releasing information in the public interest in paragraphs 36 - 56 of Confidentiality.6
You should establish with the patient what information they want you to share, with whom, and in what circumstances. This will be particularly important if the patient has fluctuating or diminished capacity or is likely to lose capacity, even temporarily. You should document the patient’s wishes in their records.
If a patient who has capacity to make the decision refuses permission for information to be shared with a particular person or group of people, it may be appropriate to encourage the patient to reconsider that decision if sharing the information may be beneficial to the patient’s care and support. You must, however, abide by the patient’s wishes, unless disclosure would be justified in the public interest (see paragraphs 63 - 70).
If a patient lacks capacity to make the decision, it is reasonable to assume the patient would want those closest to them to be kept informed of their general condition and prognosis, unless they indicate (or have previously indicated) otherwise. You can find detailed advice on considering disclosures about patients who lack capacity to consent in paragraphs 41 - 49.
In most cases, discussions with those close to the patient will take place with the patient’s knowledge and consent. But if someone close to the patient wants to discuss their concerns about the patient’s health without involving the patient, you should not refuse to listen to their views or concerns on the grounds of confidentiality. The information they give you might be helpful in your care of the patient.
You must work on the presumption that every adult patient has the capacity to make decisions about the disclosure of their personal information. You must not assume a patient lacks capacity to make a decision solely because of their age, disability, appearance, behaviour, medical condition (including mental illness), beliefs, apparent inability to communicate, or because they make a decision you disagree with.
You must assess a patient’s capacity to make a particular decision at the time it needs to be made, recognising that fluctuations in a patient’s condition may affect their ability to understand, retain or weigh up information, or communicate their wishes.
We give detailed advice on assessing a patient’s mental capacity in our guidance Consent: patients and doctors making decisions together. Practical guidance is also given in the Adults with Incapacity (Scotland) Act 2000 and Mental Capacity Act 2005 codes of practice.14
You may disclose personal information if it is of overall benefit to patient who lacks the capacity to consent. When making the decision about whether to disclose information about a patient who lacks capacity to consent, you must:
- make the care of the patient your first concern
- respect the patient’s dignity and privacy
- support and encourage the patient to be involved, as far as they want and are able, in decisions about disclosure of their personal information.
You must also consider:
- whether the patient’s lack of capacity is permanent or temporary and, if temporary, whether the decision to disclose could reasonably wait until they regain capacity
- any evidence of the patient’s previously expressed preferences
- the views of anyone the patient asks you to consult, or who has legal authority to make a decision on their behalf, or has been appointed to represent them
- the views of people close to the patient on the patient’s preferences, feelings, beliefs and values, and whether they consider the proposed disclosure to be of overall benefit to the patient
- what you and the rest of the healthcare team know about the patient’s wishes, feelings, beliefs and values.
You might need to share personal information with a patient’s relatives, friends or carers to enable you to assess the overall benefit to the patient. But that does not mean they have a general right of access to the patient’s records or to be given irrelevant information about, for example, the patient’s past healthcare.
You must share relevant information with anyone who is authorised to make health and welfare decisions on behalf of, or who is appointed to support and represent, a patient who lacks capacity to give consent. This might be a welfare attorney, a court-appointed deputy or guardian, or an independent mental capacity advocate. You should also share information with independent mental health advocates in some circumstances.15
If a patient asks you not to disclose personal information about their condition or treatment, and you believe they lack capacity to make that decision, you should try to persuade them to allow an appropriate person to be given relevant information about their care. In some cases, disclosing information will be required or necessary, for example under the provisions of mental health and mental capacity laws (see paragraph 47).
If the patient still does not want you to disclose information, but you consider that it would be of overall benefit to the patient and you believe they lack capacity to make that decision, you may disclose relevant information to an appropriate person or authority. In such cases, you should tell the patient before disclosing the information and, if appropriate, seek and carefully consider the views of an advocate or carer. You must document in the patient’s records your discussions and the reasons for deciding to disclose the information.
All patients have the right to a confidential medical service. Challenging situations can however arise when confidentiality rights must be balanced against duties to protect and promote the health and welfare of patients who may be unable to protect themselves.
For specific guidance on confidentiality in the context of child protection, see our guidance Protecting children and young people: the responsibilities of all doctors.16 For general advice on confidentiality when using, accessing or disclosing information about children and young people, see our guidance 0–18 years: guidance for all doctors.17
As a rule, you should make decisions about how best to support and protect adult patients in partnership with them, and should focus on empowering patients to make decisions in their own interests. You must support and encourage patients to be involved, as far as they want and are able, in decisions about disclosing their personal information.
There are various legal requirements to disclose information about adults who are known or considered to be at risk of, or to have suffered, abuse or neglect.18 You must disclose information if it is required by law.
- satisfy yourself that the disclosure is required by law
- only disclose information that is relevant to the request, and only in the way required by the law
- tell patients about such disclosures whenever practicable, unless it would undermine the purpose of the disclosure to do so.
You can find advice about disclosures that are permitted but not required by law in paragraphs 17 - 19.
You must disclose personal information about an adult who may be at risk of serious harm if it is required by law (see paragraph 53). Even if there is no legal requirement to do so, you must give information promptly to an appropriate responsible person or authority if you believe a patient who lacks capacity to consent is experiencing, or at risk of, neglect or physical, sexual or emotional abuse, or any other kind of serious harm, unless it is not of overall benefit to the patient to do so.
If you believe it is not of overall benefit to the patient to disclose their personal information (and it is not required by law), you should discuss the issues with an experienced colleague. If you decide not to disclose information, you must document in the patient’s records your discussions and the reasons for deciding not to disclose. You must be able to justify your decision.
Saha v GMC  EWHC 1907
You should also consider the impact of the Data Protection Act 1998 on the disclosure of sensitive personal data. Further advice can be sought from the Information Commissioner.
If a candidate asks for a copy of the reference, you should usually give them a copy, though you are not required to do so.7
See Data Protection Good Practice Note: Subject access and employment references (pdf) 2005, Information Commissioner’s Office.