Police, courts, regulators, employers and other third parties

Distinguish a request from a legal duty, verify authority, limit disclosure and manage police, court, regulator, employer, insurer and solicitor requests safely.

• Separate requests, legal powers, statutory duties and court orders.
• Verify identity, purpose and authority before disclosing.
• Apply minimum-necessary disclosure to police and legal requests.
• Recognise obligations to employers, insurers and other commissioning bodies without abandoning the duty to the patient.
• Escalate uncertainty rather than treating official letterhead as automatic authority.

An official-looking request does not itself establish a duty to disclose. The first task is to identify the requester, purpose and precise legal authority.

Where disclosure is required by statute or ordered by a court, the clinician should comply with the requirement but should disclose only information relevant to that requirement. If scope is unclear, seek clarification rather than sending the entire record automatically.

Police requests can arise under many legal routes. Some statutes create powers to request or disclose; others create duties. A general request from police is not automatically a legal obligation.

Employers, insurers and similar third parties usually require the patient’s informed written consent or other appropriate authority, and the report should stay within the agreed scope and purpose.

Solicitors may act for the patient, another party, an insurer or an employer. Their request should be analysed by authority and scope; a solicitor’s letter is not itself a court order.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. Police telephone a ward asking for the address of a patient wanted for questioning.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A court order requires specified records for a defined period, but the file also contains irrelevant sensitive information.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. An insurer sends a broad consent form and asks for the entire GP record.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• If the police ask, we must tell them.
• A court request means send the whole record.
• A solicitor’s letter is equivalent to a court order.
• Patient consent authorises any amount of information.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• A request is not the same as a legal duty.
• Verify identity and authority before disclosure.
• Distinguish statutory permission from statutory requirement.
• Court orders should be followed within their actual scope.
• Seek clarification where legal scope is unclear.
• Police requests require a specific authority or other justification.
• Employers and insurers do not automatically receive the whole record.
• Consent should be informed and scope-specific.
• Minimum necessary applies to third-party disclosures.
• Document the request, authority, decision and information disclosed.

Check current versions for time-sensitive decisions.

• R2 - GMC: Disclosing patients’ personal information: a frameworkOpen official source
• R11 - GMC: Using and disclosing patient information for secondary purposesOpen official source
• R34 - GMC: Disclosing information for employment, insurance and similar purposesOpen official source