Disclosure to third parties

  • Obtain consent to disclose identifiable patient information unless it is required by law or justified in the public interest.
  • Be prepared to justify disclosures in the public interest.
  • Follow relevant guidance from the GMC and the NHS.

Disclosures with patient consent

Consider whether information can be anonymised or if it is really necessary to disclose identifiable patient information. Most such disclosures require consent, including:

  • Sharing information with other members of the healthcare team.
  • Discussing the patient's diagnosis or care with family members and carers.
  • Writing reports for insurers or the patient's employer.
  • Disclosing medical records to solicitors – most solicitors provide the patient's signed consent when requesting information.
  • Using case studies or images for research, education and training.
  • Release of information to the media or online.

Obtaining consent

Implied consent

You can share personal information within the healthcare team to support patient care, provided the patient does not object. You should ensure information is readily available about this in the form of leaflets, posters, etc.

If a patient objects, you should explain the implications for their care but ultimately you should respect their wishes, unless disclosure is justified in the public interest (see below).

Express consent

When disclosures are for purposes other than patient care, you should be satisfied the patient has capacity and understands:

  • who will see the information
  • what is being disclosed
  • the purpose of disclosure
  • the significant foreseeable consequences.

The patient can give verbal or written consent. Seek MDU advice if you are unsure.

Patients without capacity

Decide whether the disclosure is in the patient's best interests. Factors to consider include the patient's privacy and dignity; whether they might regain capacity; their previously expressed wishes and the views of those close to the patient.

Record why you decided the patient did not have capacity and why you believe you were justified in disclosing information.

Young patients

Follow the confidentiality guidance set out in the GMC's 0-18 years: guidance for all doctors and the MDU's own guide.

Mandatory disclosures

You may be obligated to disclose patient information in certain situations. These include:

Courts, tribunals and coroners' inquiries

When giving evidence and directed by a judge or presiding officer, you can disclose information about a dead patient to the coroner or procurator fiscal on request, but obtain consent if it relates to living patients.

The police

In most cases, you can disclose information only with the patient's consent or if you believe it is justified in the public interest. However, there are limited exceptions:

  • If a driver suspected of a road traffic offence seeks treatment, the police can ask for their name and address under the Road Traffic Act 1988.
  • You must disclose information which might be of material assistance in preventing an act of terrorism or securing the arrest of someone for a terrorist offence. Failure to do so without reasonable excuse is a criminal offence.
  • Patients with gunshot or knife wounds should be reported to the police when admitted. This does not apply to knife injuries which are accidental or self-inflicted, but seek advice from a colleague if you are unsure. Do not disclose personal information, such as the patient's name and address, at this point.
  • (in England and Wales) You must inform the police if you discover an act of female genital mutilation (FGM) appears to have been carried out on a girl under the age of 18. See the MDU's guidance for more information.
  • When the police have obtained a valid court order compelling you to disclose information.

Regulatory bodies

You may be required to disclose information to organisations such as the GMC, CQC, the Parliamentary and Health Service Ombudsman (PHSO) and Accountable Officers (controlled drugs).

The PHSO has the power to require disclosure to help it fulfil its statutory duties.

CQC and Accountable Officers say that requests for information should be proportionate and the minimum necessary. It may be possible to provide anonymised information, so seek MDU advice.


Following a written request from a tax inspector under Schedule 36, Part 1 of the Finance Act 2008.

Disease notification

Cases of certain diseases, such as acute meningitis and measles, must be notified to the proper officer of your local authority or health board.

Contact the MDU if you are unsure whether you are legally required to disclose patient information.

Disclosures in the public interest


You can disclose information, even without the patient's consent, to protect individuals or the wider public from serious harm. In such cases, the patient's right to confidentiality is outweighed by the public interest. Examples include:

  • you suspect a child is at risk of abuse
  • a patient has confessed to a serious crime
  • you are concerned a patient poses a risk to the public, eg they are alcohol-dependent and continue to drive despite repeated warnings.

Before disclosing information in the public interest, you should:

  • Weigh the possible harm of disclosure without consent (both to the patient, and to trust in the profession) against the harm that is likely to arise from not disclosing the information.
  • Inform the patient that a disclosure will be made and why, unless it would be impracticable, put others at risk of harm, or prejudice the purpose of the disclosure.
  • Act promptly to disclose relevant information.
  • Keep disclosures of identifiable information to the minimum necessary and make sure you do not compromise the confidentiality of others.

Deceased patients

Your duty of confidentiality continues after a patient has died. If you receive a request to disclose information about a deceased patient, you should consider the following:

  • Whether the patient left any instructions.
  • If no instructions were left, whether releasing information is likely to cause distress to the patient's family or breach the confidentiality of others.
  • The purpose of the disclosure. The GMC has set out a list of circumstances when information about a dead patient should be released, such as when a parent asks for information about the circumstances and causes of a child's death.
  • Your legal obligations, for example when someone has a right of access to records. The MDU has published detailed guidance on the steps to take in this situation.

Seek help from the MDU if you are unsure.

This page was correct at publication on 30/08/2018. Any guidance is intended as general guidance for members only. If you are a member and need specific advice relating to your own circumstances, please contact one of our advisers.