Dr Gerard Panting discusses the statutory and ethical case on revealing confidential patient information: when to obtain consent, and when there is an obligation to release details

Confidentiality is a central plank of medical ethics, and with good reason. If patients cannot confide in their doctor without the risk of personal, sensitive, or embarrassing information being broadcast to the rest of the community, they are unlikely to be open with him or her, thereby prejudicing their clinical care.

On the face of it, confidentiality appears to be a very straightforward principle, simply requiring that the information provided by or about patients is kept secret unless they consent to disclosure. However, translating the principle into practice often proves problematical, as illustrated by the fact that the most common reason for doctors to seek legal advice is over confidentiality issues.

The legal principle

Confidentiality is now well established as a legal principle. Health professionals the world over will find a confidentiality clause in their contract; the Data Protection Act1 and the Freedom of Information Act2 are examples of statutes that set out the legal duties of individuals who are in possession of personal data; and court decisions have established common law duties to preserve professional confidence. Last, but by no means least, the General Medical Council publishes guidance on the subject of confidentiality, which doctors are expected to follow or risk being charged with misconduct.3

Confidentiality goes beyond an undertaking not to divulge patient information, and encompasses a responsibility to keep confidential information secure. Confidential records should not be left lying around where other people may have casual access to them, and information about patients should be sent under private and confidential cover. Patient information to be sent to others should not be transferred via the internet or other non-secure means, to avoid the risk of it going astray.

Confidentiality is not an absolute principle, however; there are a number of exceptions.

Disclosure with patient consent

The first and most obvious exception to the confidentiality rule is disclosure with the consent of the patient. Insurance companies, employers, and people involved in legal proceedings frequently request information about patients. This is something the patient may be unaware of when consulting their doctor about a condition that happens to be relevant to a later insurance claim, or which raises a question over their suitability for a particular job—an issue glossed over on the pre-employment questionnaire.

Patients have a right to view reports prepared for employment or insurance purposes by a doctor who is or has been responsible for their care. If the report undermines their insurance claim by revealing pre-existing injuries or threatens their livelihood, the doctor may be asked to change the report so it is less damning. This will only be possible if there has been an error, or if issues have been overstated. At this point, patients may wonder if it was in their best interest to have been so open about their alcohol intake, smoking, and other habits.

Publishing case reports

Consent is also required before individual case histories or photographs can be published in journals or books, or before they can be used while presenting a lecture, even if these have been anonymised.

People requesting disclosure

Requests for access to confidential information on a patient may come from several groups of people.


Solicitors will request medical information in connection with all sorts of claims. These may be:

  • involving personal injury claims
  • following road traffic accidents
  • in employment disputes—describing the stress a patient was subjected to in a particular job
  • during the throes of divorce proceedings
  • as a result of dismissal—the impact of illness on the patient’s ability to perform certain tasks, or their mental state and suitability for specific roles.

If the solicitor acts for the patient, it is safe to assume that the request is made on the client’s (patient’s) instructions and no separate consent from the patient is required. However, a solicitor acting for another party needs the patient’s consent just like anyone else.

In preparing a report, the doctor is not acting as the patient’s advocate but is giving an objective assessment of the patient’s condition, and may in due course be required to give evidence on oath based on the contents of the report.

Clinical team members

Patient care is frequently team based. Unless notified to the contrary, doctors can discuss the details of their patient’s illness with colleagues to facilitate and secure the best interests of the patient. However, this does not mean that other doctors have any right to obtain confidential information. In one case (Cornelius v Dr Taranto4), a forensic psychiatrist, who had examined a patient during the course of an unfair dismissal claim, and who wrote to the GP suggesting various therapeutic ideas to help the patient, was found to have breached confidence as this had been done without consent.


Discussing a patient’s care with relatives can be problematical. In general, the information should be given to the patient who can pass it on, as he or she sees fit, to the family. However, it would be extremely callous for a doctor to refuse to say anything to concerned relatives, from whom it is often necessary to obtain elements of the patient’s case history.

Individuals with lasting powers of attorney (under the Mental Capacity Act 20055) may have authority to consent to medical treatment on behalf of a patient who can no longer do so for themselves. Clearly, in cases such as this the attorney requires the necessary information to make a decision.

If discussing an issue with a patient personally would pose a serious threat to their physical or mental health, detailed information can be revealed to relatives to protect the patient’s best interests. However, these circumstances are exceptionally rare and this is the sort of issue on which doctors should seek advice.

The police

In general, the police have no more right to be given access to confidential information than anybody else. Exceptions to this occur:

  • under road traffic legislation, when the police may require the doctor to reveal the name and address of someone suspected of some form of traffic offence
  • if the doctor is satisfied that any request for disclosure of medical information is made with the patient’s consent
  • in compliance with a Court order
  • if the public interest in disclosing information outweighs the public interest in preserving patient confidentiality—this usually turns on the threat of serious harm potentially occurring to others if the police are not notified to enable them to make an arrest. These cases are often finely balanced and are well worth discussing with an advisor before deciding how best to proceed.

Disclosure for child protection

In any case involving the welfare of a child, their best interests are paramount. This may require disclosure of confidential information about the parents to social services and/or the police. As a matter of good practice, the doctor’s responsibilities should always be explained to the parents and, where possible, their consent to the passing on of information about themselves should be obtained so that, so far as is possible, a constructive relationship is maintained.

Disclosure without consent

In some circumstances, doctors have a statutory duty to report certain information—for example, notification of births, deaths, infectious diseases, and terminations of pregnancy. In these cases, no consent from the patient is required and, even if he or she objects, the doctor is obliged to make the notification.

The GMC booklet on Confidentiality: Protecting and providing information3 cites a number of examples where the doctor should take positive action. Examples might be:

  • where a driver who is unfit continues to drive, having been advised that it is no longer safe to do so
  • where a medical practitioner who is unfit for work fails to limit his practice in accordance with advice from occupational health doctors or those treating him.

Court orders

Court orders are just that—orders requiring the recipient to comply. So if a doctor is directed in open court to answer questions, notwithstanding the patient’s failure to consent, he or she should comply, having previously alerted the judge to the fact that no consent to disclosure has been obtained. Equally, if a court order is served on a record holder obliging disclosure of health records, the lack of consent must be brought to the court’s attention before disclosure is granted. The mere threat of a court order, however, is not sufficient authority to disclose, and any likely inconvenience to the doctor is no excuse to breach confidentiality.

Confidentiality after death

The duty of confidentiality does not end with death. Rights of access to the health records of a dead patient exist under the Access to Health Records Act 1990,6 where any person has a claim arising from the estate. In all other circumstances, the consent of all the executors or administrators of the estate should be obtained before disclosure is made.


Confidentiality generates some of the most difficult issues for practising doctors. The implications of getting it wrong can be serious for everyone involved. Therefore, it is always best to seek advice sooner rather than later.


  1. Her Majesty’s Stationery Office. Data Protection Act 1998. London: The Stationery Office Ltd, 1998. www.opsi.gov.uk/ACTS/acts1998/19980029.htm
  2. Her Majesty’s Stationery Office. Freedom of Information Act 2000. London: The Stationery Office Ltd, 2000. www.opsi.gov.uk/Acts/acts2000/20000036.htm
  3. General Medical Council. Confidentiality: Protecting and providing information. London: GMC, 2004. www.gmc-uk.org/guidance/current/library/confidentiality.asp
  4. CORNELIUS v. Dr TARANTO [2002] EMLR 6, [2001] EWCA Civ 1511, (2002) 68 BMLR 62.
  5. Her Majesty’s Stationery Office. Mental Capacity Act 2005. London: The Stationery Office Ltd, 2005. www.opsi.gov.uk/acts/acts2005/20050009.htm
  6. Her Majesty’s Stationery Office. Access to Health Records Act 1990. London: The Stationery Office Ltd, 1990. www.opsi.gov.uk/acts/acts1990/Ukpga_19900023_en_1.htmG