Disclosing confidential information

8. As a healthcare professional, you may find yourself in situations where patients disclose to you information they expect to be kept confidential, or where you are privy to confidential information about your patients. In most cases, you must keep this information confidential unless the patient provides you with explicit or implied consent to disclose it.
9. Implied consent is only relevant in specific circumstances. You may rely on implied consent to share confidential information with those who are providing (or supporting the provision of) direct care to the patient, provided that all of the following apply:
   1. the person accessing or receiving the information is providing or supporting the patient’s care;
   2. information is readily available to patients explaining how their information will be used (for example, in leaflets, posters, on websites or face to face), and they have the right to object;
   3. the patient has not objected; and
   4. anyone to whom confidential information is disclosed understands that it is given to them in confidence, which they must respect.
10. More information about consent generally, and implied consent can be found in our guidance on consent. 

Disclosing information with consent

11. Where you are not sharing information with other healthcare professionals for the purpose of providing (or supporting the provision of) direct care to a patient, you should always try to get your patient’s explicit consent to disclose sensitive information about them, unless any of the following apply:
    1. obtaining consent would defeat the purpose of the disclosure (for example, where there would be a risk of harm to others; where detection of a serious crime would be obstructed); or
    2. you have already made the decision to disclose information in the public interest and obtaining consent would be meaningless or tokenistic; or
    3. the patient is not able to give consent as a result of disability, illness or injury. A patient’s ability to give consent is referred to as their ‘capacity’ to consent. For more information on capacity, including what to do if a patient lacks capacity, see our consent guidance.
12. Where your patient provides you with explicit consent to disclose confidential information about them, you must ensure that they know what they are consenting to and that they are clear what information is going to be disclosed, why it is being disclosed and to which person or authority. Refer to Standards 2 and 3 (annex 1) and our guidance on consent. Where you are relying on implied consent (see paragraph 9), patients should not be surprised to learn how their information is used; if the information would be used in ways that patients would not reasonably expect, you should seek explicit consent for this from the patient.
13. It is important to remember that patients with the capacity to consent have the right to make their own decisions and to refuse consent, even where you or others may consider the decision to be ill-advised. If a patient makes a decision contrary to clinical advice, you should document this in the patient records so that it is clear to all involved in that patient’s care.

Disclosing information without consent

14. If a patient does not provide you with explicit consent to disclose confidential information about them, and if you cannot rely on implied consent, there may still be circumstances in which you may pass the information on to an appropriate authority, such as where it is in the public interest, or where there is a legal requirement for you to do so.
15. In some circumstances, therefore, disclosure without consent may be appropriate. If this is the case, there are certain things you need to consider and we discuss these in detail within this guidance. Decisions on whether to disclose information need to be made on a case-by-case basis and only after considering all relevant information available to you at the time.
16. A number of specific situations that you may face in practice are covered in more detail within this guidance, including: passing on information in relation to a patient’s fitness to drive; and making a disclosure to comply with external investigations.

Keeping a record of disclosure

17. Whether you disclose information with or without patient consent, you should keep a record of it and document what information you disclose and to which person/body you disclose it. You should also document any attempts to seek consent to disclose information or, if it is not appropriate to seek consent, the reasons why it is not appropriate. You should also tell the patient about the disclosure in writing (unless it is not practicable or would undermine the purpose of the disclosure) and document that you have done this.

Data protection

18. All disclosures must be compliant with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. For further information, contact the Information Commissioner’s Office (ICO).