Professional Development
Professional 4: Digital professionalism and safe information handling
Apply confidentiality and professional standards to email, messaging, electronic records, online tools, social media and emerging AI-enabled workflows.
Clinical safety: Use current guidance, local policy and patient-specific judgement.
Learning objectives
Apply confidentiality principles to common digital workflows. Use the minimum necessary personal information and recognise legitimate-access requirements. Identify risks associated with messaging, screenshots, cloud tools, social media and generative AI. Separate approved organisational systems from convenient but unapproved tools. Respond appropriately to a suspected information-security or confidentiality incident.
Core reading: professional standards travel with the information
Digital convenience does not reduce the duty of confidentiality. Before placing identifiable patient or staff information into an email, messaging system, cloud service, online form or AI-enabled tool, ask whether the system is approved for that purpose, whether the information is necessary, who will receive or process it, and whether a less identifiable form would achieve the task. The GMC emphasises using the minimum necessary personal information, protecting information against improper access or loss, understanding information governance appropriate to the role, and accessing patient information only for a legitimate reason. Local NHS policy may impose additional controls. A useful default is: approved system, legitimate purpose, minimum data, correct recipient, secure device, and an auditable route where the context requires it.
AI and emerging tools
Generative AI can assist with drafting, summarising or structuring work, but public or non-approved systems should not be treated as confidential clinical environments. Do not paste identifiable patient information, confidential employment material or sensitive organisational data into a tool unless your organisation has explicitly approved that use and the relevant governance conditions are met. AI output also requires professional checking. Plausible text can still be wrong, outdated or incomplete. The clinician remains responsible for decisions, records and communication made in their professional role.
If something goes wrong
A misdirected email, lost device, inappropriate access, screenshot or accidental disclosure should be addressed promptly through local information-governance or incident routes. Immediate containment may matter more than perfect retrospective explanation. Preserve facts, avoid deleting evidence unless instructed, and follow local reporting requirements.
