Confidentiality in Practice — The Legal and Ethical Framework

Confidentiality is one of the oldest and most fundamental principles in medicine. Patients disclose sensitive personal information in the expectation that it will be kept private. Breaching that trust undermines the doctor-patient relationship and can cause real harm. This lesson covers the legal framework, GMC guidance, and practical application of confidentiality — all of which are heavily tested in the UCAT SJT.

---

Why Confidentiality Matters

The Ethical Foundation

Confidentiality is grounded in the ethical principle of autonomy. Patients have the right to control who has access to their personal health information. Without this right, patients may:

• Withhold important symptoms or history
• Avoid seeking medical help altogether
• Lose trust in the healthcare system

The Practical Consequence

If patients do not trust that their information will be kept confidential, they will not be honest with their doctors. Incomplete or inaccurate histories lead to missed diagnoses, inappropriate treatments, and patient harm.

SJT implication: The SJT expects you to understand that confidentiality is not just a rule — it protects patients and enables effective care.

---

The Legal Framework

Confidentiality in UK medicine is governed by a combination of legislation, common law, and professional guidance.

The Data Protection Act 2018 (and UK GDPR)

The Data Protection Act 2018 implements the UK General Data Protection Regulation (UK GDPR). Key principles:

1. Lawfulness, fairness, and transparency — Personal data must be processed lawfully and transparently
2. Purpose limitation — Data collected for one purpose should not be used for another without consent
3. Data minimisation — Only collect the minimum data necessary
4. Accuracy — Keep data accurate and up to date
5. Storage limitation — Do not keep data longer than necessary
6. Integrity and confidentiality — Keep data secure
7. Accountability — The data controller must demonstrate compliance

Health data is classified as special category data under the UK GDPR, which means it receives additional protections. Processing health data requires an explicit legal basis, such as:

• Explicit consent from the patient
• Necessity for the provision of health or social care
• Vital interests of the patient (in emergencies)
• Substantial public interest (e.g. notifiable diseases)

The Common Law Duty of Confidence

Even before data protection legislation, English common law recognised a duty of confidence arising from the doctor-patient relationship. This duty means:

• Information disclosed in confidence must not be shared without consent or other lawful justification
• The duty survives the death of the patient (there is a continued obligation of confidentiality)
• Breach of confidence can result in civil liability (the patient or their estate can sue)

The Human Rights Act 1998

Article 8 of the European Convention on Human Rights (incorporated into UK law by the Human Rights Act 1998) protects the right to respect for private and family life. Medical confidentiality is an aspect of this right.

However, Article 8 is a qualified right — it can be limited where necessary for:

• National security
• Public safety
• Prevention of crime
• Protection of health
• Protection of the rights and freedoms of others

---

GMC Guidance on Confidentiality

The GMC's guidance Confidentiality: Good Practice in Handling Patient Information (2017, updated) is the definitive professional standard. Key principles:

The Default Position

Patients have a right to expect that information about them will be held in confidence by their doctors. Confidentiality is central to trust between doctors and patients.

You must:

• Make sure that any personal information you hold about patients is effectively protected at all times
• Not access a patient's personal information unless you have a legitimate reason to do so
• Not share information with others unless the patient consents or there is a legal or ethical justification

Sharing Information Within the Healthcare Team

The GMC recognises that modern healthcare is delivered by teams. You can share information with colleagues who are directly involved in the patient's care, provided:

• The patient has been informed that information will be shared within the team (implied consent)
• The information shared is limited to what is necessary for care
• All team members understand their duty of confidentiality

Information Sharing: When Is It Appropriate?
═══════════════════════════════════════════════════════════
Scenario                              Share?  Basis
───────────────────────────────────────────────────────────
Colleague directly involved in care   Yes     Implied consent
Patient's GP (routine referral)       Yes     Implied consent
Patient's employer                    No*     Requires explicit consent
Patient's family member               No*     Requires explicit consent
Police (routine enquiry)              No*     Requires court order/consent
Public health (notifiable disease)    Yes     Statutory duty
Research (anonymised)                 Yes     No consent needed
Research (identifiable)               No*     Requires explicit consent
═══════════════════════════════════════════════════════════
* Unless an overriding exception applies (see below)

Exceptions to Confidentiality

There are specific circumstances in which confidentiality can — or must — be breached:

1. Patient Consent

If the patient gives explicit, informed consent to share their information, you may do so. Consent must be:

• Freely given (no coercion)
• Specific (the patient knows what is being shared and with whom)
• Informed (the patient understands the implications)

2. Statutory Requirements

Certain laws require disclosure regardless of patient consent:

• Notifiable diseases — Under the Health Protection (Notification) Regulations 2010, doctors must report certain infectious diseases (e.g. measles, tuberculosis, cholera) to Public Health England
• Road Traffic Act 1988 — Doctors must provide information about drivers involved in road traffic incidents when requested by the police
• Terrorism Act 2000 — There is a duty to disclose information relevant to terrorism
• Court orders — A court can compel disclosure of medical records

3. Public Interest