When Can a Doctor Share Patient Information in the UK? Confidentiality Explained
A relative on the phone, a police officer at reception, a patient who should not be driving: confidentiality dilemmas turn up every week in NHS work and at almost every NHS interview. Doctors trained abroad often find the UK rules different from what they are used to. This guide explains when you can, must and must not share patient information.
Quick answer
In the UK a doctor may share confidential patient information in three situations: with the patient's consent (implied consent covers sharing within the team providing their care), when the law requires or permits it, or when disclosure is justified in the public interest, usually to prevent death or serious harm or a serious crime. In every case, share only the minimum necessary and record your reasoning.
What you will learn in our free Confidentiality, Information Governance and AI in Clinical Practice course
Information governance is on NHS person specifications, and confidentiality dilemmas are classic interview questions. Know exactly when to share, when not to — and how to use AI tools safely. Our free online Confidentiality, Information Governance and AI in Clinical Practice course is written for NHS doctors and international medical graduates. You study at your own pace in 6 short modules, with worked examples, interactive exercises and a short quiz at the end. There is no sign-up, and your progress is saved so you can stop and come back.
The 6 modules
Foundations: why confidentiality matters: What confidentiality means in everyday NHS work, The legal and professional framework, The eight Caldicott Principles
Sharing information: consent, law and public interest: When can you share? Three routes, Disclosing in the public interest, Information the law requires you to share, Share or not share? Test yourself
Common dilemmas: DVLA, police, relatives and more: Fitness to drive and the DVLA, Police, knife and gunshot wounds, Relatives, carers and the telephone, Young people, safeguarding, death and the media
Records, rights and data security: Patients' rights to their records, Good record keeping, Everyday data security, Data breaches
AI and digital tools: AI scribes in NHS practice, Chatbots and other AI tools
Your evidence: CV and interviews: Record a disclosure decision, Confidentiality questions at interview
By the end of the course you will be able to
Explain the duty of confidentiality and the legal framework (common law, UK GDPR, Data Protection Act 2018, Human Rights Act)
Apply the eight Caldicott Principles, including the duty to share for individual care
Decide when to share with consent, when the law requires disclosure, and when it is justified in the public interest
Handle common dilemmas: DVLA, police requests, gunshot and knife wounds, relatives, young people and safeguarding
Respond to subject access requests and understand patients' rights to their records
Keep good records and prevent and report data breaches
Use AI tools, including ambient scribes, safely, lawfully and honestly
Record and explain disclosure decisions, and answer confidentiality questions at interview
Why it helps your NHS application
Clear answers for real dilemmas: the DVLA, police requests, relatives on the phone, knife wounds
Up to date with 2026: new data law, the NHS AI scribe registry and the MHRA's ruling on AI scribes
A disclosure decision record you can download and use on your next shift
How to write it on your NHS application
In your CV and on NHS Jobs or Trac: list it under "Courses and CPD" (or in the training and courses section of the form), for example:
Confidentiality, Information Governance and AI in Clinical Practice, online CPD course, CareerPro UK. Certificate of completion, [month and year]; verifiable online, ID CP-XXXXXXXX.
In your supporting statement: show what you learned and how you use it. For example (adapt it so it is true for you):
"I completed a course on confidentiality and information governance, including the Caldicott Principles and the safe use of AI tools, and I follow GMC guidance whenever I share patient information."
At interview: the course also prepares you for questions such as "A patient with epilepsy tells you he will keep driving. What do you do?"
Your certificate of completion
When you pass the quiz, you can download a certificate pack:
A verifiable PDF certificate of completion with your name, the course, your CPD time and a QR code that shortlisters and appraisers can scan
An appraisal-ready reflective note, pre-filled with the course learning outcomes
A ready-to-paste line for your NHS Jobs or Trac application and CV, and a one-click "Add to LinkedIn" button
Studying is free. The certificate pack is a one-off £5, and you pay only after you pass
Online course — does not replace mandatory data security awareness training.
Why confidentiality matters, and why it is not absolute
Patients tell doctors things they tell nobody else. If they cannot trust us with that information, they may stay away or hold back what matters. The GMC's guidance, Confidentiality: good practice in handling patient information, makes respect for confidentiality a core professional duty.
The duty covers more than the diagnosis. Telling an unknown caller that someone is on Ward 5 reveals confidential information, because it confirms that the person is a patient at all.
Confidentiality is not absolute, though. Refusing to share can hurt patients too, for example by leaving the GP without a discharge summary.
The legal framework in brief
Several layers apply at once. You don't need to be a lawyer, but it helps to know what each one adds:
The common law duty of confidentiality: information given in confidence must not be disclosed without a lawful basis.
UK GDPR and the Data Protection Act 2018: health data is "special category" data. It must be processed lawfully, fairly, securely and only as far as needed. The Data (Use and Access) Act 2025 is changing parts of this law in stages, so follow your organisation's current policies.
Human Rights Act 1998, Article 8: the right to respect for private and family life.
GMC guidance: your personal professional standard, with explanatory guidance on specific situations such as driving and knife wounds.
On top of these sit the eight Caldicott Principles, last updated by the National Data Guardian in 2020. In summary: justify the purpose; use confidential information only when necessary; use the minimum necessary; access on a strict need-to-know basis; everyone must understand their responsibilities; comply with the law; the duty to share information for individual care is as important as the duty to protect confidentiality; and tell patients how their information is used. Every NHS organisation has a Caldicott Guardian who can advise you.
The three routes for sharing information
When you are unsure, work through these routes in order. If none applies, do not share, though you can still listen.
Consent. Implied consent usually covers sharing relevant information with the people providing the patient's direct care, as long as the patient knows and has not objected. For other purposes, such as a report for an employer or insurer, you need explicit consent.
Required or permitted by law. Examples include notifying certain infectious diseases to the health protection team, complying with a court order, and the personal duty to report known cases of female genital mutilation in girls under 18 to the police (England and Wales). Share only what the law requires. A solicitor's letter is not a court order.
Public interest. You may disclose without consent if the benefits outweigh the patient's and the public's interest in confidentiality. This usually means preventing a risk of death or serious harm, or helping to prevent or detect a serious crime. The bar is high. Ask for consent first unless that is unsafe or impracticable, disclose the minimum, tell the patient unless that would be unsafe, and record your decision, including any decision not to disclose.
If unsure, ask a senior, your Caldicott Guardian or your medical defence organisation, but don't let this delay an urgent disclosure.
Classic dilemmas: the DVLA, the police and relatives
The patient who keeps driving. The legal duty to tell the DVLA (or the DVA in Northern Ireland) belongs to the driver. GMC guidance sets out the doctor's steps:
Explain that the condition may affect driving and that the patient must tell the DVLA. Record your advice.
If they disagree with the diagnosis, offer a second opinion and advise them not to drive in the meantime.
If you learn they are still driving, make every reasonable effort to persuade them to stop.
If they carry on, and you believe this puts others at risk of death or serious harm, contact the DVLA's medical adviser promptly.
Try to tell the patient before you contact the DVLA, then confirm in writing afterwards and record it.
If a patient can't understand the advice, for example because of dementia, inform the DVLA as soon as practicable.
The police at reception. The police have no general right to medical information or to be told whether someone is a patient. You need consent, a legal requirement or a public interest justification. Ask what they want and why, and follow your organisation's process for police requests. A minor offence is unlikely to justify disclosure on its own. A serious crime or an immediate risk to someone's life changes the balance.
Gunshot and knife wounds. GMC guidance says the police should usually be told when someone arrives with a gunshot wound (even an accidental one) or a wound from an attack with a knife or other blade. The first contact usually does not include the patient's name or address. Knife wounds that look accidental or self-inflicted are not usually reported. Any child with such an injury raises safeguarding concerns.
Relatives on the phone. Next of kin has no legal right to information. Ask patients early who they are happy for you to talk to, and record it. Check the caller's identity and share only what the patient has agreed to. Listening to a worried relative is never a breach.
Using AI tools with patient data
NHS England has published guidance on adopting ambient voice technology (AVT, or "AI scribes"), and in January 2026 launched a self-certified supplier registry. Listing on it is not an NHS England endorsement. In July 2026 the MHRA clarified that products used only to transcribe, summarise, draft letters or suggest codes for a clinician to review are not currently medical devices. Products that support diagnosis or treatment, or take automated clinical actions, are regulated as medical devices.
In practice:
Use only tools your organisation has approved for that purpose, after its information governance and clinical safety checks.
Never paste patient information into public or unapproved chatbots. Removing the name is not enough when a rare diagnosis, age and home village could still identify someone.
Tell patients when a scribe is being used, following local process, and respect objections.
Read, correct and approve every AI-generated note or letter. You remain responsible. Check allergies, doses, laterality and negatives, which are where these tools often go wrong.
How this looks on an NHS application and at interview
Person specifications often ask for "an understanding of information governance". A strong answer to an interview scenario:
Puts the patient first and checks for any immediate risk.
Names the route: consent, law or public interest.
Shares the minimum necessary, on a need-to-know basis.
Involves a senior, the Caldicott Guardian or information governance team.
Tells the patient, unless that is unsafe.
Documents the decision and the reasons.
On your application, a short real example works better than a list of laws. For instance: "When a patient's daughter phoned for an update, I checked with the patient first, confirmed her identity and shared only what he agreed to." Our guide to the NHS person specification explains how to map examples like this to the criteria, and how to write an NHS supporting statement shows how to present them.
Our free Confidentiality, Information Governance and AI in Clinical Practice course lets you practise these "share or not share?" decisions on realistic cases and build a disclosure decision record you can download.
Start the free course
The Confidentiality, Information Governance and AI in Clinical Practice course covers the GMC framework, the Caldicott Principles, the DVLA, police requests, records and data breaches, and safe use of AI scribes, in short modules that are free to study. It ends with a quiz, and you can add an optional verifiable certificate and a reflective note for your appraisal. It is not accredited and does not replace your employer's mandatory data security training. If you'd like your NHS application reviewed and rewritten (£35), email cvreviewexperts@gmail.com.
Frequently asked questions
Do I need a patient's consent to share information with other clinicians caring for them?
Usually not explicitly. Implied consent covers sharing relevant information with the team providing direct care, as long as the patient knows this happens and has not objected.
Can I tell the police whether someone is a patient in my hospital?
Not simply because they ask. You need the patient's consent, a legal requirement such as a court order, or a public interest justification such as preventing serious harm or a serious crime. Follow your organisation's process and involve a senior.
Must a doctor report a patient to the DVLA?
The legal duty to tell the DVLA belongs to the patient. A doctor should advise and try to persuade them. If the patient keeps driving and this puts others at risk of death or serious harm, the doctor should contact the DVLA's medical adviser promptly and tell the patient.
Can relatives be told about a patient's condition?
If an adult patient has capacity, they decide who is told about their health, and next of kin has no automatic right to information. If the patient lacks capacity, share what relatives need to know to support them and to help with best-interests decisions, unless the patient objected earlier.
Can I use ChatGPT or another AI tool with patient information?
Only if your organisation has approved that tool for that purpose. Putting identifiable patient information into a public or unapproved AI tool is a data breach, and you remain responsible for checking any AI-generated output.
Comments