Consent, implied consent and sharing for direct care

Separate treatment consent, confidentiality consent and data-protection lawful basis, and apply proportionate information sharing for direct care, families and multidisciplinary teams.

• Distinguish consent to treatment from consent to disclose information.
• Explain implied consent for direct-care confidentiality without calling it the GDPR lawful basis.
• Apply reasonable expectations and minimum necessary sharing within care teams.
• Respond appropriately to patient objections.
• Manage family and carer communication without assuming automatic entitlement.

Consent operates in more than one framework. Consent to an examination or treatment is not automatically consent to every use or disclosure of information, and consent under the common law duty of confidence is not the same as choosing Article 6 consent as the data-protection lawful basis.

GMC guidance allows information to be shared on the basis of implied consent for direct care when the relevant conditions are met. The patient should have access to information about how their information is used, have the opportunity to object, and sharing should be relevant and proportionate.

Healthcare organisations commonly rely on public task, legal obligation or other lawful bases together with a special-category condition for health care rather than GDPR consent for routine care processing.

Relatives and carers can provide useful information, and clinicians can listen without disclosing confidential information in return. Whether information can be shared back depends on consent, capacity, best interests/overall benefit, risk and other legal authority.

A patient objection matters. It should be explored and respected where possible. Where non-disclosure would create significant risk or another legal duty applies, the clinician may need to seek senior, safeguarding, IG or legal advice.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A patient expects their GP and hospital team to share relevant medication information for direct care.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A competent patient asks that a diagnosis not be discussed with an adult child who regularly attends appointments.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A spouse phones with important safety information but asks the clinician not to reveal that they called.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• Implied consent is the GDPR lawful basis for direct care.
• Relatives are automatically part of the care team.
• If a patient objects, sharing is always forbidden.
• If a family member tells you something, you must keep it secret from the patient.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• Treatment consent and information-disclosure consent are different.
• Common-law implied consent is not the same as UK GDPR consent.
• Relevant direct-care sharing can be appropriate within reasonable expectations.
• Minimum necessary still applies to care teams.
• Patients should be informed about expected information uses.
• A patient objection should be explored and recorded.
• Relatives do not have automatic access rights.
• Clinicians can receive information without disclosing information back.
• Capacity and risk may change the disclosure analysis.
• Escalate where an objection conflicts with serious safety concerns.

Check current versions for time-sensitive decisions.

• R1 - GMC: Confidentiality: good practice in handling patient informationOpen official source
• R2 - GMC: Disclosing patients’ personal information: a frameworkOpen official source
• R5 - ICO: A guide to lawful basisOpen official source
• R6 - ICO: Data sharing: a code of practiceOpen official source