Disclosing confidential information
This guidance is for registrants in situations where they need to consider the professional requirement to maintain confidentiality alongside the need to ensure protection of patients and the public.
The sections are intended to be read together and cannot be read in isolation.
About this guidance and how it applies to you
- We have produced this guidance to help our registrants in situations where they need to consider the professional requirement to maintain confidentiality alongside the need to ensure protection of patients and the public. This guidance does not create new requirements or give legal advice.
- This guidance should be read alongside the Standards of Practice for Optometrists and Dispensing Opticians, which all optometrists and dispensing opticians must apply to their practice and the Standards for Optical Students which all student optometrists and dispensing opticians must apply to their practice. Where we refer to both sets of standards, these will be referred to as “standards” for ease of reading. Where we refer to specific standards, we will put the number of the Standards for Optical Students in brackets after the number of the Standards of Practice, where applicable (e.g., 11(10)).
- Standard 14(13) (annex 1) outlines the importance of keeping patient information confidential in compliance with the law.
- Standard 11(10) (annex 1) outlines that you must be aware of, and comply with, your legal obligations in relation to the safeguarding of children, young people and vulnerable adults. Promptly raise concerns about your patients, colleagues, employer or other organisation(s) if patient or public safety might be at risk. You can view our guidance on speaking up for support on raising concerns.
- The requirement to maintain confidentiality is not absolute and can be overridden in cases where this is in the public interest, such as where there is a risk of public harm.
- You should use your judgement to apply the guidance that follows to your own practice and the variety of settings in which you might work.
- If you have any questions about this guidance or how to apply it, you should consider seeking further advice which, depending on the nature of your question, may involve contacting appropriate professional colleagues, your employer, your professional indemnity insurance provider, your professional or representative body, or obtaining independent legal advice. Student optometrists and student dispensing opticians can additionally seek advice from their tutor, supervisor or training provider.
Disclosing confidential information about patients, with or without consent
- As a healthcare professional, you may find yourself in situations where patients disclose to you information they expect to be kept confidential, or where you are privy to confidential information about your patients. In most cases, you must keep this information confidential unless the patient provides you with explicit or implied consent to disclose it.
- Implied consent is only relevant in specific circumstances. You may rely on implied consent to share confidential information with those who are providing (or supporting the provision of) direct care to the patient, provided that all of the following apply:
- the person accessing or receiving the information is providing or supporting the patient’s care;
- information is readily available to patients explaining how their information will be used (for example, in leaflets, posters, on websites or face to face), and they have the right to object;
- the patient has not objected; and
- anyone to whom confidential information is disclosed understands that it is given to them in confidence, which they must respect.
- More information about consent generally, and implied consent can be found in our guidance on consent.
Disclosing information with consent
- Where you are not sharing information with other healthcare professionals for the purpose of providing (or supporting the provision of) direct care to a patient, you should always try to get your patient’s explicit consent to disclose sensitive information about them, unless any of the following apply:
- obtaining consent would defeat the purpose of the disclosure (for example, where there would be a risk of harm to others; where detection of a serious crime would be obstructed); or
- you have already made the decision to disclose information in the public interest and obtaining consent would be meaningless or tokenistic; or
- the patient is not able to give consent as a result of disability, illness or injury. A patient’s ability to give consent is referred to as their ‘capacity’ to consent. For more information on capacity, including what to do if a patient lacks capacity, see our consent guidance.
- Where your patient provides you with explicit consent to disclose confidential information about them, you must ensure that they know what they are consenting to and that they are clear what information is going to be disclosed, why it is being disclosed and to which person or authority. Refer to Standards 2 and 3 (annex 1) and our guidance on consent. Where you are relying on implied consent (see paragraph 9), patients should not be surprised to learn how their information is used; if the information would be used in ways that patients would not reasonably expect, you should seek explicit consent for this from the patient.
- It is important to remember that patients with the capacity to consent have the right to make their own decisions and to refuse consent, even where you or others may consider the decision to be ill-advised. If a patient makes a decision contrary to clinical advice, you should document this in the patient records so that it is clear to all involved in that patient’s care.
Disclosing information without consent
- If a patient does not provide you with explicit consent to disclose confidential information about them, and if you cannot rely on implied consent, there may still be circumstances in which you may pass the information on to an appropriate authority, such as where it is in the public interest, or where there is a legal requirement for you to do so.
- In some circumstances, therefore, disclosure without consent may be appropriate. If this is the case, there are certain things you need to consider and we discuss these in detail within this guidance. Decisions on whether to disclose information need to be made on a case-by-case basis and only after considering all relevant information available to you at the time.
- A number of specific situations that you may face in practice are covered in more detail within this guidance, including: passing on information in relation to a patient’s fitness to drive; and making a disclosure to comply with external investigations.
Keeping a record of disclosure
- Whether you disclose information with or without patient consent, you should keep a record of it and document what information you disclose and to which person/body you disclose it. You should also document any attempts to seek consent to disclose information or, if it is not appropriate to seek consent, the reasons why it is not appropriate. You should also tell the patient about the disclosure in writing (unless it is not practicable or would undermine the purpose of the disclosure) and document that you have done this.
Data protection
- All disclosures must be compliant with the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. For further information, contact the Information Commissioner’s Office (ICO).
Vision and safe driving – what to do if a patient’s vision means they may not be fit to drive
- You may encounter situations where you consider a patient’s vision means they may not be fit to drive.
- Below, we set out the requirements of the governing bodies of drivers and driving in the UK, the ways in which you should communicate with a patient when advising them they may not be fit to drive, and when you should disclose this information to someone other than the patient.
Driver and Vehicle Licensing Agency (DVLA) and Driver and Vehicle Agency (DVA)
- The DVLA in England, Scotland and Wales and the DVA in Northern Ireland are the government agencies that register and issue licences to drivers in the UK. As part of their role in registering and licensing drivers, they are legally responsible for deciding if a person is medically fit to drive and retain their licence.
- The DVLA issues guidance for healthcare professionals on assessing fitness to drive which includes the medical standards for driver licensing. There is specific guidance on sight testing as well as other health conditions you may encounter during a consultation.
- The medical standards in the guidance are applicable to the whole of the UK, including Northern Ireland.
Drivers' responsibilities
- Licensed drivers have a legal responsibility to notify the DVLA/DVA of any medical condition they have that may affect safe driving. A full list of conditions that are considered notifiable can be found here.
Your responsibilities
- You should inform the DVLA/DVA where:
- you have assessed that a patient may not be safe to drive; and
- you consider that they will not or cannot inform the DVLA/DVA themselves; and
- you have a concern for road safety in relation to the patient and/or the wider public.
- In making an assessment of whether a patient is safe to drive, you should be aware of, and make reference to, the DVLA’s guidance, particularly the chapter on visual disorders, which outlines the legal sight standards that all licensed drivers must meet.
- If a patient’s corrected vision would meet the minimum standards for driving, but their uncorrected vision would not, this may mean they are not safe to drive if they choose to drive without corrective lenses.
- You should be aware that there are higher standards in place for bus and lorry drivers than for car drivers and motorcyclists, and details of these can be found in the DVLA guidance referenced above (listed as "group 2").
- If you are unsure whether a patient meets the required standards you should consider seeking the advice of a professional colleague or your employer, or seeking the advice of the DVLA/DVA’s medical advisors.
What should I do if I think a patient is not safe to drive?
- If, in your professional judgement, you think that a patient may not be safe to drive you should explain this clearly to the patient and your reasons for this. With the patient’s consent, you should discuss your concerns with their family and/or carer if appropriate (e.g. if they attend appointments with the patient, or if they live with the patient).
- You should advise the patient to stop driving immediately.
- You should advise the patient that they have a legal responsibility to notify the DVLA/DVA of any condition which may affect their ability to drive safely and provide them with further information on how to contact the DVLA/DVA.
- You should advise the patient that you have a duty to notify the DVLA/DVA yourself if, in your professional judgement, a patient either will not or cannot do so, and there is any concern for the safety of the patient and/or the wider public. For more information on the steps you should take in such situations, see the section below on ‘disclosing to the DVLA/ DVA without consent’.
- You should also consider whether you need to notify other healthcare professionals, such as the patient’s GP if possible and discuss with the patient why you think this is appropriate.
- If driving is relevant to the patient’s occupation, you should advise them to inform their employer. 1
- You should put any advice in writing and keep a clear record of your actions including any correspondence, for example, with the patient, other healthcare professionals and other external agencies, as well as documenting if the patient advises that they will self-report to the DVLA/DVA. For further information, see standard on maintaining adequate patient records in the standards.
- If you have followed all the steps above, but you consider that the patient will not or cannot inform the DVLA/DVA themselves, please see the section below for the steps you should take to disclose information to the DVLA/DVA.
Disclosing to the DVLA/DVA without consent
- If the criteria in paragraph 25 apply, and you are not able to seek consent from your patient, you should notify the DVLA/DVA if you believe that a patient will continue to drive despite advice not to do so.
- In disclosing information to the DVLA/DVA you should:
- first, inform the patient that you intend to notify the DVLA/ DVA and you have a duty to cooperate fully with the DVLA/DVA and provide all relevant information as requested;
- notify the DVLA/DVA (current contact details are set out below) and provide all relevant information that is requested;
- consider whether you need to notify other healthcare professionals, such as the patient’s GP, if possible; and
-
keep a clear record of your actions and any advice given. For more information, please refer to Standard 8 (7).
- The DVLA/DVA make the ultimate decision of whether to revoke a driving licence and may make further enquiries and/or require further assessments to establish whether the patient’s licence should be revoked.
Communicating effectively with patients
- You should communicate clearly and effectively with your patients and give them information in a way that they can understand. Informing a patient that they may have to stop driving can be a sensitive and difficult subject to raise and you should communicate this with empathy and compassion. Providing patients with information about resources they can access for assistance, for example about alternative means of transport, could be helpful.
- For more information on communicating effectively with patients, please refer to Standards 2 and 4 (annex 1).
- A flowchart showing the process to be followed when making a decision is available.
- Contact details for the DVLA (England, Scotland and Wales) and DVA (Northern Ireland) can be found on their websites.
1 Whilst this guidance is focused on road safety, the principles also apply to drivers of other transport (including rail), seafarers and pilots. If you are concerned that a train driver, pilot or seafarer’s vision means they may not be able to do their job safely, you can contact the Office of Rail and Road, the UK Civil Aviation Authority or the Maritime and Coastguard Agency respectively for advice.
Other disclosures in the public interest
- There may be other circumstances where there is a risk of serious harm to individuals or the wider public and, accordingly, you need to make the decision as to whether there is a public interest in disclosing information that outweighs your duty of confidentiality. Examples include (but are not limited to):
- evidence of suspected abuse;
- evidence of serious crimes, including terrorism 2; and
- evidence of serious communicable or transmissible diseases
- This list is not exhaustive and there may be other circumstances where you need to balance your duties of public protection and patient confidentiality. In all such circumstances, you should follow the same thought process set out below.
- When considering whether to disclose information in such circumstances, you should weigh your duty to protect the public with the benefit of keeping your patient’s information confidential. You may wish to consider:
- Is there potential for harm to others if information is not disclosed?
- Would sharing anonymised information be sufficient to avoid harm?
- To whom does the information relate, and is it sensitive to more than one patient? and
- What are the potential effects on the patient of accessing future treatment and/or engaging with healthcare services?
- If you decide to disclose information in the public interest, you should consider advising your patient of your intentions. However, this may not always be appropriate (i.e. if advising the patient would defeat the purpose of the disclosure), and if you believe this to be the case, you should document the reasons why.
- If you are unsure about your decision in any way, you should seek further advice from a colleague, representative or professional body, indemnity insurer or independent legal adviser, taking care to maintain confidentiality so far as possible.
Exception: Female genital mutilation
- In England and Wales, there is a mandatory legal duty for all regulated healthcare professionals to report to the police where:
- a child or young person (under the age of 18) has told you that they have been subject to female genital mutilation (FGM); or
- you have observed a physical sign appearing to show your patient (under the age of 18) has been subject to FGM.
- If you encounter such a situation as set out above, you must call 101 as soon as possible to report it to the police and consult the Department of Health advice on this subject.
- Whilst the scope of practice of optometrists and dispensing opticians means that it is less likely that you will encounter such situations, patients may still confide in you as a healthcare professional and you need to be aware of the reporting requirements in these circumstances.
2 It is an offence under section 38b of the Terrorism Act 2000 to fail to report information about acts of terrorism.
Complying with external investigations
- There are a very small number of circumstances where you may encounter requests for information from authorities that have the power to request this from you as part of their role. These include:
- the police and other statutory enforcement authorities such as HMRC;
- the NHS Counter-Fraud Authority;
- the court or a judge/coroner of the court; and
- the GOC.
- When asked for information about your patients by an authority in relation to an investigation, you should ask authorities to provide you with details about their power to request information (i.e. under which statute they are asking for the information), what specific information they require and why they want it. You should ask for them to provide this in writing.
- Once you have received these details from the relevant authority, you may then disclose information to fulfil their request.
- Such authorities do not have an automatic right to all information you hold about your patients and you should only ever disclose the minimum amount possible to fulfil the request. If you feel a request for information is too broad, or you are unsure about the legitimacy of the request, ask the requesting authority for more information and/or seek further advice from a colleague, professional body, indemnity insurer or independent legal adviser.
- If there is a court order or warrant in place, you may be legally compelled to release certain information. If this is the case, you should seek legal advice or advice from your professional indemnity insurer.
- When requesting information from you in respect of a fitness to practise investigation, we will set out the statutory basis upon which the request is made. You should be aware that, as a GOC registrant, you have an obligation pursuant to the GOC Standards of Practice to co-operate with GOC investigations, but the provisions of paragraph 53 above apply equally to GOC requests for information.
Annex 1
Standard 14: Maintain confidentiality and respect your patients’ privacy (Standards of practice for optometrists and dispensing opticians) 14.1 Keep confidential all information about patients in compliance with the law, including information which is handwritten, digital, visual, audio or retained in your memory. 14.2 Ensure that all staff you employ or are responsible for, are aware of their obligations in relation to maintaining confidentiality. 14.3. Maintain confidentiality when communicating publicly, including speaking to or writing in the media, or when writing and sharing images online, including on social media. 14.4. Co-operate with formal inquiries and investigations and provide all relevant information that is requested in line with your obligations to patient confidentiality. 14.5. Provide an appropriate level of privacy for your patients during consultation to ensure that the process of information gathering, examination and treatment remains confidential. Different patients will require different levels of privacy and their preferences must be taken into account. 14.6. Only use the patient information you collect for the purposes it was given, or where you are required to share it by law, or in the public interest. 14.7. Securely store and protect your patient records to prevent loss, theft and inappropriate disclosure, in accordance with data protection law. If you are an employee, then this would be in accordance with your employer’s storage policy. 14.8. Confidentially dispose of patient records when no longer required in line with data protection requirements. |
Standard 13: Maintain confidentiality and respect your patients’ privacy (Standards for optical students) 13.1 Keep confidential all information about patients in compliance with the law, including information which is handwritten, digital, visual, audio or retained in your memory. 13.2 Maintain confidentiality when communicating publicly, including speaking to or writing in the media, or when writing and sharing images online, including on social media. 13.3 Co-operate with formal inquiries and investigations and provide all relevant information that is requested in line with your obligations to patient confidentiality. 13.4 Provide an appropriate level of privacy for your patients during consultation to ensure that the process of information gathering, examination and treatment remain confidential. Different patients will require different levels of privacy and their preferences must be taken into account. 13.5 Only use the patient information you collect for the purposes it was given, or where you are required to share it by law, or in the public interest. 13.6 Securely store and protect your patient records to prevent loss, theft and inappropriate disclosure, in accordance with data protection law as outlined in the policies of your training provider. 13.7 Confidentially dispose of patient records when no longer required in line with data protection requirements. |
Standard 11: Protect and safeguard patients, colleagues and others from harm (Standards of practice for optometrists and dispensing opticians) 11.1 You must be aware of and comply with your legal obligations in relation to safeguarding of children, young people and vulnerable adults. 11.2 Protect and safeguard children, young people and other vulnerable adults from abuse. You must: 11.2.1 Be alert to signs of abuse and denial of rights. 11.2.2 Consider the needs and welfare of your patients. 11.2.3 Report concerns to an appropriate person or organisation. 11.2.4 Act quickly in order to prevent further risk of harm. 11.2.5 Keep adequate notes on what has happened and what actions you took. 11.3 Promptly raise concerns about your patients, colleagues, employer or other organisation if patient or public safety might be at risk and encourage others to do the same. Concerns should be raised with your employing, contracting, professional or regulatory organisation as appropriate. This is sometimes referred to as ‘whistle-blowing’ and certain aspects of this are protected by law. 11.4 If you have concerns about your own fitness to practise, whether due to issues with health, character, behaviour, judgement or any other matter that may damage the reputation of your profession, stop practising immediately and seek advice. 11.5 If patients are at risk because of inadequate premises, equipment, resources, employment policies or systems, put the matter right if that is possible and/or raise a concern. 11.6 Ensure that any contracts or agreements that you enter into do not restrict you from raising concerns about patient safety including restricting what you are able to say when raising the concern. 11.7 Ensure that when reporting concerns, you take account of your obligations to maintain confidentiality as outlined in Standard 14. 11.8 If you have a serious communicable disease, or have been exposed to a serious communicable disease, and believe you could be a carrier, you should not practise until you have sought appropriate medical advice. You must follow the medical advice received, which may include the need to suspend, or modify your practice and/or guidance on how to prevent transmission of the disease to others. For guidance on serious communicable diseases, refer to current public health guidance. |
Standard 10: Protect and safeguard patients, colleagues and others from harm (Standards for optical students) 10.1 Protect and safeguard children, young people and vulnerable adults from abuse. You must: 10.1.1 Be alert to signs of abuse and denial of rights. 10.1.2 Consider the needs and welfare of your patients. 10.1.3 Report concerns to an appropriate person or organisation, whether this is your tutor, supervisor or training provider. 10.1.4 Act quickly in order to prevent further risk of harm. Seek advice immediately if you are unsure of how to proceed. 10.1.5 Keep adequate notes on what has happened and what actions you took. 10.2 Promptly raise concerns about your patients, peers, colleagues, tutor, supervisor, training provider or other organisation, if patient or public safety might be at risk and encourage others to do the same. Concerns should be raised with your supervisor, training provider or the General Optical Council as appropriate. This is sometimes referred to as ‘whistle-blowing’ and certain aspects of this are protected by law. 10.3 If you have concerns about your own fitness to practise, whether due to issues with health, character, behaviour, judgement, or any other matter which may compromise patient safety or damage the reputation of your profession, do not participate in any further clinical training and seek advice from your employer and training provider immediately. 10.4 If patients are at risk because of inadequate premises, equipment, resources, employment policies or systems, put the matter right if that is possible and/or raise a concern with your training provider. 10.5 Ensure that when reporting concerns, you take account of your obligations to maintain confidentiality as outlined in Standard 13. 10.6 If you have a serious communicable disease, or have been exposed to a serious communicable disease, and believe you could be a carrier, you should not practise until you have sought appropriate medical advice. You must follow the medical advice received, which may include the need to suspend, or modify your practice and/or guidance on how to prevent transmission of the disease to others. For guidance on serious communicable diseases, refer to current public health guidance. |
Standard 2: Communicate effectively with your patients (Standards of practice for optometrists and dispensing opticians) 2.1 Give patients information in a way they can understand. Use your professional judgement to adapt your language and communication approach as appropriate. 2.2 Identify yourself and your role and advise patients who will provide their care. Explain to patients what to expect from the consultation and ensure they have an opportunity to ask questions or change their mind before proceeding. 2.3 Be alert to unspoken signals which could indicate a patient’s lack of understanding, discomfort or lack of consent. 2.4 Ensure that the people you are responsible for are able to communicate effectively with patients and their carers, colleagues and others. 2.5 Ensure that patients or their carers have all the information they need to safely use, administer or look after any appliances, drugs or other treatment that they have been prescribed or directed to use in order to manage their eye conditions. This includes being actively shown how to use any of the above. 2.6 Be sensitive and supportive when dealing with relatives or other people close to the patient |
Standard 2: Communicate effectively with your patients (Standards for optical students) 2.1 Give patients information in a way they can understand. Work with your tutor to achieve this. 2.2. Identify yourself and your role and advise patients who will provide their care. Explain to patients what to expect from the consultation and ensure they have an opportunity to ask questions or change their mind before proceeding. 2.3 Be alert to unspoken signals which could indicate a patient’s lack of understanding, discomfort or lack of consent. 2.4 Develop and use appropriate communication skills to communicate effectively with patients and their carers, colleagues and others. Consult your tutor or supervisor when unsure of how to proceed. 2.5 Ensure that patients or their carers have all the information they need to safely use, administer or look after appliances, drugs or other treatment that has been prescribed or they have been directed to use in order to manage their eye conditions. This includes being actively shown how to use any of the above. 2.6 Be sensitive and supportive when dealing with relatives or other people close to the patient. |
Standard 3: Obtain valid consent (Standards of practice for optometrists and dispensing opticians) 3.1 Obtain valid consent before examining a patient, providing treatment or involving patients in teaching and research activities. For consent to be valid it must be given: 3.1.1 Voluntarily 3.1.2 By the patient or someone authorised to act on the patient’s behalf. 3.1.3 By a person with the capacity to consent. 3.1.4 By an appropriately informed person. In this context, informing means explaining what you are going to do and ensuring that patients are aware of any risks and options in terms of examination, treatment, supply of appliances or research they are participating in. This includes the right of the patient to refuse treatment or have a chaperone or interpreter present. 3.2 Be aware of your legal obligations in relation to consent, including the differences in the provision of consent for children, young people and vulnerable adults. When working in a nation of the UK other than where you normally practise, be aware of any differences in consent law and apply these to your practice. 3.3 Ensure that the patient’s consent remains valid at each stage of the examination or treatment and during any research in which they are participating. |
Standard 3: Obtain valid consent (Standards for optical students) 3.1 Obtain valid consent before examining a patient, providing treatment or involving patients in teaching and research activities. For consent to be valid it must be given: 3.1.1 Voluntarily. 3.1.2 By the patient or someone authorised to act on the patient’s behalf. 3.1.3 By a person with the capacity to consent. 3.1.4 By an appropriately informed person. In this context, informing means explaining what you are going to do and ensuring that patients are aware of any risks and options in terms of examination, treatment, supply of appliances or research they are participating in. This includes the right of the patient to refuse treatment or have a chaperone or interpreter present. 3.2 Be aware of your legal obligations in relation to consent, including the differences in the provision of consent for children, young people and vulnerable adults. When in a nation of the UK, other than where you normally study or undertake supervised practice, be aware of any differences in consent law and apply these appropriately. 3.3 Ensure that the patient’s consent remains valid at each stage of the examination or treatment and during any research in which they are participating. |
Standard 4: Show care and compassion for your patients (Standards of practice for optometrists and dispensing opticians) 4.1 Treat others with dignity and show empathy and respect. 4.2 Respond with humanity and kindness to circumstances where patients, their family or carers may experience pain, distress or anxiety, including when communicating bad news. |
Standard 4: Show care and compassion for your patients (Standards for optical students) 4.1 Treat others with dignity and show empathy and respect. 4.2 Respond with humanity and kindness to circumstances where patients, their family or carers may experience pain, distress, or anxiety, including when communicating bad news. |