Patient Confidentiality

Confidentiality is one of the most frequently tested topics in SJT. It appears in multiple forms: scenarios about sharing information with family, social media dilemmas, conversations in public spaces, and the critical question of when it is lawful and ethical to breach confidentiality. This lesson provides a comprehensive framework for handling every confidentiality scenario you may encounter.

---

Why Confidentiality Matters

Confidentiality is not just a rule — it serves vital purposes:

Purpose	Explanation
Trust	Patients must trust that their information will be kept private, or they will withhold important details
Autonomy	A patient's information belongs to them; sharing it without consent violates their right to control their own data
Safety	If patients fear their information will be shared, they may avoid seeking help for sensitive issues (mental health, sexual health, domestic abuse)
Legal obligation	The Data Protection Act 2018, the UK GDPR, and common law all impose duties of confidentiality
Professional duty	The GMC explicitly requires doctors to maintain confidentiality

---

The Default Position

The default is always to maintain confidentiality. Any departure from this default requires a specific justification.

This means:

• You do not share patient information with family members unless the patient consents
• You do not discuss patients by name in public areas
• You do not post anything about patients on social media — even without names
• You do not access patient records out of curiosity
• You do not share information with other healthcare professionals unless it is necessary for the patient's care

---

The Caldicott Principles

The Caldicott Principles provide a framework for handling patient-identifiable information within the NHS. They are named after Dame Fiona Caldicott, who chaired the review that produced them.

The Eight Caldicott Principles

#	Principle	Meaning
1	Justify the purpose	Every proposed use or transfer of personal information must have a clear, justified purpose
2	Use only when absolutely necessary	Do not use personal information unless it is essential
3	Use the minimum necessary	When personal information is needed, use only the minimum required
4	Access on a strict need-to-know basis	Only those who need the information to perform their role should have access
5	Everyone with access must understand their responsibilities	All staff must be trained in confidentiality obligations
6	Comply with the law	All use of personal information must be lawful
7	The duty to share can be as important as the duty to protect	Sharing information appropriately can protect patients and improve care
8	Inform patients about how their information is used	Patients should know how and why their data is used

SJT Application of Caldicott

When an SJT question asks about information sharing, apply these tests:

1. Is there a justified purpose? (Patient care, safety, legal obligation)
2. Is the sharing necessary? (Could the purpose be achieved without sharing?)
3. Am I sharing only the minimum? (Share only what is needed, nothing more)
4. Does the recipient have a legitimate need to know? (Are they involved in the patient's care?)

---

When Confidentiality Can Be Breached

The GMC identifies specific circumstances where confidentiality can or must be broken:

Mandatory Breaches (You Must Disclose)

Situation	Legal basis
Notifiable diseases	Public Health (Control of Disease) Act 1984 — certain infectious diseases must be reported
Court orders	A court can compel disclosure of patient information
Terrorism	The Terrorism Act 2000 requires disclosure of information about terrorist activities
Road traffic offences	The Road Traffic Act 1988 requires disclosure of driver identity to police
Drug trafficking	The Drug Trafficking Act 1994 requires disclosure in certain circumstances

Justified Breaches (You May Disclose)

Situation	Justification
Risk of serious harm to the patient or others	If maintaining confidentiality would place someone at risk of death or serious harm, disclosure is justified
Child safeguarding	If a child is at risk of abuse or neglect, you have a duty to share information with appropriate agencies
Adult safeguarding	If a vulnerable adult is at risk, information sharing may be necessary
Serious crime	Where there is a risk of serious crime (usually involving violence), disclosure to police may be justified
In the patient's best interest (when they lack capacity)	If the patient cannot consent and disclosure is in their best interest

The Threshold Test

Before breaching confidentiality, ask:

"Is the risk of harm from maintaining confidentiality greater than the harm of breaching it?"