Core Revision
Revision aid, not clinical advice. This page is educational material written for exam preparation. It is not a substitute for the current guideline or for clinical judgement, and must not be relied on for the care of any individual. Always check up-to-date national guidance and verify independently before acting on anything here.
Chapter 5 of 11 · Ethics, Law & Safeguarding
Confidentiality: the two systems you must satisfy
Every disclosure has to clear two separate hurdles — the common law duty of confidence and data protection law. Most exam answers go wrong by only clearing one.
The GMC’s Confidentiality: good practice in handling patient information has been in effect since 25 April 2017 (last updated December 2024). It has not been rewritten, and it remains the framework the AKT tests.
Two systems, both mandatory
| System | What it asks | How you satisfy it |
|---|---|---|
| Common law duty of confidence | Is there a legal justification for breaking confidence? | One of three: consent; required by law; or an overriding public interest. (Plus the s251 statutory gateway for research and planning.) |
| UK GDPR / Data Protection Act 2018 | Is there a lawful basis for processing, and a condition for special category data? | An Article 6 basis and an Article 9 condition. NHS direct care normally runs on Art 6(1)(e) public task plus Art 9(2)(h) health or social care purposes. |
Consent is not the NHS’s usual lawful basis for processing under data protection law. Clinicians say “the patient consented” and mean the common-law duty; the Article 6 basis is public task. Both statements can be true at once, and an exam option that says the lawful basis is consent is usually wrong.
Implied consent for direct care
You do not take explicit consent every time you write to a hospital colleague. Implied consent covers information sharing for the patient’s own direct care when all four of the following hold:
- You are accessing the information to provide or support that patient’s care
- Information is readily available to patients explaining how their data is used, and their right to object
- You have no reason to believe the patient has objected
- The recipient understands the information is given in confidence
If the patient would be surprised to learn of the disclosure, implied consent is not enough — ask.
The National Data Opt-Out never blocks direct care. It applies to confidential patient information used for research and planning, and it does not apply to anonymised data, explicit consent, public health and communicable disease work, legally mandated disclosure or court orders.
A police officer telephones the surgery. He is investigating a burglary and asks you to confirm whether a named man is registered with the practice and whether he attended last Tuesday.
What do you do?
Police have no automatic right of access to health records. Even confirming registration is confidential information.
The three gateways are consent, a legal requirement, or an overriding public interest. Investigating a burglary does not on its own reach the public-interest threshold, which requires a risk of death or serious harm, or the prevention/detection/prosecution of a serious crime.
Offer the officer the proper route: seek the patient’s consent, or obtain a court order. Record the request and your response.
The fact that a person is your patient is itself confidential. Salami-slicing does not create a lawful basis.
The obligation sits with the practice as data controller and with you as a professional. Passing the request on does not create a justification.
Pick an option to see the answer.
Patient access to records
A subject access request under UK GDPR must be answered within one month — running from receipt of the request, or from receipt of any identity verification or fee you reasonably require, whichever is later. That can be extended by up to two further months where the request is complex or there are several — but you must tell the patient, and explain why, within the first month. It is free, except for a reasonable fee where a request is manifestly unfounded or excessive, or for further copies.
Two exemptions matter clinically: information likely to cause serious harm to the physical or mental health of the patient or another person, and third-party data where that third party has not consented and is not a health professional acting in their professional capacity.
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and most of its data-protection provisions commenced on 5 February 2026. Two practical changes: a controller need only conduct a reasonable and proportionate search, and the clock can be stopped while you seek genuinely necessary clarification. UK GDPR was not renamed.
Online access to the GP record (England)
Practices in England are contractually required to give patients online access to new (prospective) record entries as they are added, unless there is a data-protection reason not to, or the patient has said they do not want it. Redaction remains available for safeguarding and serious-harm reasons.
This has a direct safeguarding consequence: in domestic abuse, coercive control and child protection, assume the record may be read by someone other than the patient. Keep sensitive detail out of records visible through proxy access or the app, and use your practice’s agreed protected coding.
Confidentiality after death
Two things surprise people. First, UK GDPR does not apply to the deceased — data protection rights end at death. Second, the common law duty of confidence survives death, so you are still bound.
Access is governed by the Access to Health Records Act 1990. Only two categories may apply:
- The personal representative (executor or administrator) — who may see the whole record
- Any person who may have a claim arising out of the patient’s death — who may see only what is relevant to that claim
“Next of kin” has no standing under the AHRA. A grieving daughter who is not the executor and has no claim has no legal right to her mother’s record — though the GMC expects you to be as helpful as you properly can be, and much of what families want (an explanation of what happened) can be given without disclosing the record itself.
A patient dies. Three people ask for her records: her husband, who is the named executor; her estranged son, who thinks the practice missed a diagnosis and is considering a claim; and her sister, who simply wants to understand what happened.
Who is entitled to what?
The duty of confidence survives death. Data protection rights end; the common-law duty does not.
The personal representative (the executor) may access the whole record. Someone who may have a claim arising out of the death is entitled only to information relevant to that claim. The sister falls into neither category and has no statutory right — although you can and should offer to meet her and explain what happened, with the executor’s agreement.
All three are subject to the exemptions: information the patient asked not to be disclosed, third-party identifying data, and notes made before 1 November 1991 unless needed to make later entries intelligible.
No court order is needed. The AHRA gives the personal representative a direct statutory right.
The AHRA exists precisely to provide lawful routes. Blanket refusal is not the answer.
Pick an option to see the answer.
Self-testA husband telephones and asks what you discussed with his wife at her appointment this morning. She is not present. What do you say?
You cannot confirm that she attended, let alone what was discussed, without her consent. A neutral response that neither confirms nor denies is the practised skill: explain that you cannot discuss any individual’s care without their permission, that this applies to everyone including spouses, and invite him to speak with his wife.
Note that even saying “I can’t tell you what we discussed” confirms an appointment happened. The safer formulation is about policy, not about her.
Self-testYou are asked to write an insurance report. What are the specific consent requirements?
You need the patient’s written consent, and it must be informed: they should know what the report will contain and who will see it. Under the Access to Medical Reports Act 1988 the patient has the right to see the report before it is sent, if they say so when consent is given, and to ask for amendment of anything they believe is incorrect (or attach a statement of their view if you disagree).
Disclose only what is relevant to the request — not the whole record — and do not include third-party information.
Written and checked by NHS GPs. Last reviewed 24 August 2026. UK law and guidance change — always follow current local policy and your defence organisation’s advice in a real case.
The whole AKT, not just the ethics
2,000+ AKT-style questions, timed mocks, the Core Compass and a revision plan that fits round clinics. Start with 20 free questions.
Start free