Ensuring Confidentiality in Healthcare Practice

This confidentiality training for healthcare professionals explains how patient information is protected in the UK and when it should be shared. Confidentiality is protected by the common law, by UK GDPR and the Data Protection Act 2018, by the Caldicott principles and by every regulator's standards. The course includes the changes made by the Data (Use and Access) Act 2025, whose main data protection provisions came into force in February 2026.

The course stresses balance. Appropriate sharing matters as much as protection, because failing to share information that is needed for care or safety can itself cause harm. It is self-paced, estimated at about 2 hours, with case illustrations, a 15-question assessment and a reflective account. See it alongside other titles in the course catalogue.

• All UK healthcare professionals. Case illustrations span physiotherapy, dentistry, nursing, general practice, pharmacy and hospital administration.
• Registrants responding to a concern, such as a misdirected letter, looking up a record without a reason, a social media post, or sharing with a relative without consent. Section 6 is written for this.
• Clinicians who regularly handle third-party requests from relatives, employers, insurers, solicitors or the police.
• Anyone whose information governance training is out of date. The law changed in 2025 and 2026.

1. Confidentiality in healthcare: an overview. Implied and explicit consent, anonymised and pseudonymised data, why the fact that someone is a patient is itself confidential, and why the duty continues after death.
2. Laws and regulations. The common law duty, UK GDPR and special category data, subject access and breach reporting timescales, and the criminal offence in section 170 of the Data Protection Act 2018. What the Data (Use and Access) Act 2025 changed. Regulators' standards, the eight Caldicott principles, and the lawful bases for disclosure, including the DVLA example and mandatory FGM reporting.
3. Confidentiality in clinical practice. Everyday habits, legitimate access only, and sharing on a need-to-know basis in multidisciplinary teams.
4. Challenges in healthcare settings. Third-party requests, transitions of care, electronic records and the national data opt-out, messaging and social media, young people and Gillick competence, adults who lack capacity, and use of information for teaching, research and audit.
5. Breaches and consequences. Common causes, the effect on patients and professionals, and how to respond, including the 72-hour ICO reporting window for qualifying breaches.
6. Remediating and strengthening your practice. Targeted learning, daily checking habits and reflection questions to find your blind spots.

For the wider expectations of each regulator, see our GMC and NMC pages.

After a breach, remediation should target the specific cause. That could be secure email practice, a new identity check before answering calls, or clearer handling of requests from relatives. The course makes this point directly and lists evidence that tends to carry weight: training certificates, reflective statements, audits showing changed practice, supervisor feedback, and records of discussions with your information governance lead or Caldicott Guardian.

It also explains why honesty matters. Concealing a breach, or delaying reporting it, is treated much more seriously than the breach itself. Being open with the affected patient is part of the duty of candour.

• Complete the course and its reflective account, focusing on the actual cause of your concern.
• Adopt and record the daily habits the course sets out, such as checking two identifiers and confirming the recipient before sending.
• Re-audit after a few months and keep the results.

Our confidentiality and social media pathway shows the full pack. If the concern also involves records, see the record keeping pathway. Draft your reflection with the reflective statement builder. Courses support remediation, but regulators and panels make the decisions.

The course ends with a 15-question scenario-based assessment. The pass mark is 12 out of 15 (80%). If you score lower, the course points you back to the sections behind the questions you missed so you can try again. When you pass, you can download a certificate of completion issued by Healthcare Practise UK. The course itself says plainly that passing supports your learning record but does not, on its own, demonstrate insight or remediation.

Assessment questions cover points that often cause uncertainty. One is whether the duty continues after death. Others are the usual basis for sharing within the care team, and how quickly a qualifying breach must be reported to the ICO. Record the time you actually spend. For NMC revalidation, self-directed learning usually counts as individual CPD. Doctors can reflect on it at appraisal.

• Professionalism and Boundaries in Use of Social Media: for concerns that started with a post, a group chat or a message.
• Privacy, Consent and Chaperone in Healthcare Practice: privacy and dignity in the consultation itself.
• Professionalism in Documentation: accurate, secure records and clearly marked late entries.

The Confidentiality and Social Media Pack brings these together with this course and our Reflection module. The which course do I need tool can help you choose.