What information is confidential and who owes the duty

Recognise confidential information across records, conversations, images and digital systems, and understand access, anonymisation, pseudonymisation and confidentiality after death.

• Recognise identifiable and potentially identifiable confidential information.
• Explain why access permission is not the same as a clinical need to know.
• Distinguish anonymised from pseudonymised information.
• Identify risks from images, free text, family information and rare clinical details.
• Explain why professional confidentiality can continue after death.

Confidential information includes more than the formal health record. It can include conversations, letters, emails, photographs, recordings, test results, genetic information, free-text notes and information about relatives or other third parties.

A system login may make information technically accessible without making access professionally justified. Need-to-know and role-based access remain essential safeguards.

Removing a name does not necessarily anonymise a record. A combination of dates, rare diagnoses, occupation, location or narrative details may still allow identification.

Pseudonymised information remains personal data where the person can be re-identified using additional information. Genuine anonymisation requires the re-identification risk to be sufficiently remote in the relevant context.

UK GDPR protects living identifiable people, but professional and common-law confidentiality can continue after death. Separate legislation may govern access to records of deceased patients.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A clinician opens the record of a celebrity admitted to another ward because colleagues are discussing the case.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A teaching slide removes the patient name but includes a rare diagnosis, exact age, job and admission date.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A relative asks for a deceased patient’s full record immediately after the funeral.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• If I can open the record, I can look.
• No name means anonymous.
• Pseudonymised data is no longer personal data.
• Confidentiality ends when the patient dies.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• Confidential information exists in many formats.
• Access rights do not create a need to know.
• Curiosity viewing is not legitimate access.
• Indirect identifiers can identify a patient.
• Pseudonymised data remains personal data.
• Anonymisation is context-dependent.
• Images and recordings can be highly identifying.
• Third-party information in a record also needs protection.
• Professional confidentiality can continue after death.
• Audit logs support accountability for access.

Check current versions for time-sensitive decisions.

• R1 - GMC: Confidentiality: good practice in handling patient informationOpen official source
• R9 - GMC: Managing and protecting personal informationOpen official source
• R16 - ICO: PseudonymisationOpen official source
• R17 - ICO: Anonymisation guidanceOpen official source