Foundations of confidentiality and information governance

Build the five-layer model for confidentiality decisions and distinguish professional duties, common law, data-protection law, statutory authority and organisational governance.

• Explain why confidentiality is central to trust but is not absolute.
• Use the five-layer model to identify which framework is answering which question.
• Distinguish a professional duty from a legal basis, statutory power and local policy.
• Apply minimum-necessary and purpose-specific reasoning.
• Use CLEAR to structure a defensible information decision.

Healthcare confidentiality is not a single rule. A practical decision may engage professional standards, the common law duty of confidence, UK data-protection law, a specific statutory duty or power, and local information-governance controls at the same time.

A lawful data-protection basis does not automatically answer whether a confidential disclosure is professionally or legally justified under the duty of confidence. The questions overlap, but they are not interchangeable.

Confidentiality is important because patients need confidence that sensitive information will be protected. It is not absolute: consent, law, statutory processes and sufficiently strong public-interest reasons can justify disclosure in defined circumstances.

The default is neither 'share everything' nor 'share nothing'. The defensible approach is to identify purpose, authority, recipient, necessity, proportionality and safeguards, then disclose the minimum necessary information.

Organisational policies convert law and professional standards into operational controls. They are important, but they should not be described as Acts of Parliament or GMC rules when they are local governance arrangements.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A ward nurse asks for information needed to administer treatment, while an unrelated colleague asks out of curiosity.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A manager says GDPR prevents sharing a discharge summary with the community team providing direct care.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A local policy requires senior IG advice for an unusual disclosure even though a legal basis appears to exist.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• GDPR means we cannot share.
• If data protection permits processing, confidentiality is solved.
• Local policy is the law.
• Confidentiality means never disclosing without written consent.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• Confidentiality has overlapping professional, legal and governance layers.
• Confidentiality is not absolute.
• Data-protection law and the duty of confidence answer different questions.
• A lawful basis does not remove the need for necessity and proportionality.
• The minimum necessary principle applies to disclosure.
• Direct-care sharing can be appropriate without explicit GDPR consent.
• Organisational policy is not the same as statute.
• CLEAR is a reasoning scaffold, not a legal test.
• Information should be protected against improper access as well as disclosure.
• A defensible decision should be recorded when it is unusual or contested.

Check current versions for time-sensitive decisions.

• R1 - GMC: Confidentiality: good practice in handling patient informationOpen official source
• R2 - GMC: Disclosing patients’ personal information: a frameworkOpen official source
• R6 - ICO: Data sharing: a code of practiceOpen official source
• R24 - National Data Guardian: The Caldicott PrinciplesOpen official source