Concern: confidentiality and social media
Remediation after a confidentiality or social media concern
A record opened without a care reason, a message in the wrong group or a post that said too much can all lead to a concern. This page explains what UK regulators look for and sets out a five-course pack to help you learn, reflect and keep evidence.
Confidentiality breach remediation: where to start
Confidentiality breach remediation starts with an honest account of what happened. Concerns in this area usually involve one of a small number of events: opening a patient record without a care reason, sharing details in a messaging group, posting something online that let a patient be recognised, sending information to the wrong person, or discussing a case where others could hear. Most begin with a habit or a shortcut rather than an intention to cause harm. Regulators still take them seriously, because people only share sensitive information with professionals they trust to protect it.
This page is for doctors, nurses, midwives, allied health professionals, dental and pharmacy professionals, optometrists, osteopaths, chiropractors and social workers who are facing an employer process or a regulator concern about confidentiality or online conduct. It covers what the regulators expect, the patterns behind most concerns, how to show insight, and a five-course pack with the reasons each course is included. If you want a guided route, the free remediation pathway takes you from your regulator and concern to a readiness check, courses, a reflective statement and an evidence portfolio.
One point matters before anything else. Courses help you learn and give you dated evidence of that learning, but they do not decide your case. Panels and case examiners look at the whole picture: what happened, what you understand now, what you have changed and whether it is likely to happen again. If you have received a letter from your regulator, speak to your defence organisation, union or a solicitor before you send anything.
What UK regulators expect on confidentiality and online conduct
Every UK healthcare and social work regulator treats confidentiality as a core professional duty, and several publish separate guidance on social media. The wording differs, but the expectations are close: protect information, share it only where there is a lawful and proper reason, and remember that online conduct reflects on your profession even in a personal account.
- GMC (doctors, physician associates, anaesthesia associates): Confidentiality: good practice in handling patient information, read alongside Good medical practice 2024.
- NMC (nurses, midwives, nursing associates): the Code, supported by guidance on using social media responsibly.
- HCPC (15 professions): the Standards of conduct, performance and ethics, supported by guidance on use of social media.
- GDC (the dental team): the Standards for the Dental Team, supported by guidance on using social media.
- GPhC, GOC, GOsC, GCC and Social Work England: each sets confidentiality duties in its professional standards. Check the current wording on your regulator's website.
The law sits alongside these standards. UK GDPR and the Data Protection Act 2018 govern how personal data is processed, and the common law duty of confidence still applies. In NHS settings the Caldicott principles shape how information is shared. Your employer may handle the same event as an information governance incident under its own policies, and that process can run alongside a regulator's. Each looks at it through a different lens: the employer at systems and policy, the regulator at your fitness to practise.
Recommended bundle
The courses below address this concern together. Add them to your basket in one step.
Confidentiality and Social Media Pack
Confidentiality covers UK GDPR, Caldicott and disclosure; Social Media covers jigsaw identification, messaging groups and online boundaries; Privacy and Consent covers dignity; Documentation covers record access; Reflection evidences learning.
- Ensuring Confidentiality in Healthcare Practice£69 + VAT
- Professionalism and Boundaries in Use of Social Media£79 + VAT
- Privacy, Consent, and Chaperone in Healthcare Practice£69 + VAT
- Professionalism in Documentation for Healthcare Professionals£69 + VAT
- Reflection for Healthcare Professionals£45 + VAT
Pack saving: 25% off these courses, plus the Reflective Practice Workbook for 12 months.
5 courses, pack price Separately £331 £248.25 + VAT
Common patterns behind confidentiality and social media concerns
Understanding which pattern your concern fits helps you choose the right learning and explain your insight clearly.
Messaging groups and personal devices
Ward, practice or team chats on personal phones are convenient, and that is the problem. Clinical details, photographs of notes or screenshots can be forwarded beyond the group, stay on devices after people leave, and sit outside any audit trail. A concern often follows a single message that was shared further than intended.
Jigsaw identification
A post can identify a patient without a name. A date, a location, an unusual condition and a comment about a shift can be enough for someone who knows the person. Many professionals who post "anonymised" stories have not thought about what others can piece together.
Access without a care reason
Looking up a relative, a colleague, a neighbour or a well-known patient in an electronic record is a breach even if nothing is shared. Audit logs make this easy to detect, and it raises questions about judgement and respect for boundaries.
Disclosures to third parties
Requests from family members, employers, the police or insurers need a lawful basis and, often, consent. Concerns arise when information is given out under pressure, by phone, without checking identity or authority.
Online conduct that is not about patients
Some concerns involve no patient data at all: offensive or discriminatory posts, harassment of colleagues, sharing health misinformation, or promoting products in breach of advertising rules. Regulators may still consider these because of their effect on public confidence in the profession.
Showing insight after a confidentiality breach
Insight is your understanding of what went wrong, why it happened, who it affected and what you would do differently. The NMC describes evidence of insight as usually central to its decisions about current impairment (NMC FtP library). For doctors, MPTS tribunals have used the Guidance for MPTS tribunals since 24 November 2025; read the current version for how it treats insight. Social Work England's guidance asks decision makers to look for objective evidence of insight rather than assertion (impairment and sanctions guidance).
For a confidentiality concern, good insight usually covers these points:
- Exactly what information was accessed or shared, with whom, and how.
- Who could have been affected, even if no one complained or came to harm, and how the person might feel on finding out.
- Why confidentiality matters to trust in your profession, not only to the individual.
- What personal habits and system factors contributed, without using the system to excuse your part.
- What you now do differently, with examples and dates.
Avoid minimising language such as "it was only a group of colleagues" or "no names were used". Panels tend to read that as a sign that the risk is not fully understood.
- InsightUnderstanding what went wrong, why, and its effect on others and on trust.
- RemediationPractical steps that address the concern, such as targeted learning and supervised practice.
- ReflectionShowing what you learned and how your practice has changed.
The Confidentiality and Social Media Pack: five courses and why each fits
The pack combines the law and standards on confidentiality with the specific risks of online and messaging conduct, then adds records, privacy and reflection so that your learning turns into evidence. Learning times come from each course outline.
| Course | What it covers for this concern | Learning time |
|---|---|---|
| Ensuring Confidentiality in Healthcare Practice | UK GDPR and data protection law, regulator guidance, the Caldicott principles, when disclosure is permitted or required, third-party requests, electronic records and data sharing, confidentiality in messaging and on social media, common causes of breaches and how to respond to one. | About 2 hours |
| Professionalism and Boundaries in Use of Social Media | Guidance from the GMC, NMC, HCPC, GDC, GPhC, GOC and Social Work England; jigsaw identification; clinical images; messaging apps and professional groups; friend requests and searching for patients; freedom of expression; advertising rules; what to do if you post something you regret; building a personal social media policy. | About 3 hours |
| Privacy, Consent, and Chaperone in Healthcare Practice | Dignity and physical privacy, privacy in different settings, balancing transparency with privacy, informed consent and documenting it well. | About 2 hours |
| Professionalism in Documentation for Healthcare Professionals | Access, retention and security of records; electronic records, templates and AI scribes; correcting errors; the role of records in regulatory processes. | About 2 hours |
| Reflection for Healthcare Professionals | The UK regulatory context for reflection, structured models such as Gibbs' cycle, moving from reflection to insight, writing and recording reflection, and what is and is not legally protected. | About 2 hours |
Together that is about 11 hours of self-directed learning. Each course ends with 15 scenario-based questions with a pass mark of 80% and a reflective account, and you receive a certificate of completion from Healthcare Practise UK. Current prices show on each course card, and you can buy the courses one at a time or as a set from the bundles page.
Turning learning into evidence of safer practice
A certificate shows that you completed a course. It does not show what you learned or how your practice has changed. The NMC's guidance on whether a concern has been addressed looks at the steps a professional has taken and how they relate to the concern (FTP-16b). Relevance and application matter more than volume.
Evidence that tends to help in confidentiality and social media cases includes:
- A personal information audit: the groups you have left or reset, privacy settings you have changed, clinical images deleted from personal devices, and the date of each step.
- A written personal social media policy: the social media course walks you through building one. Keep it dated and follow it.
- Workplace training records: your employer's information governance or data security training, alongside the courses above.
- Supervision or mentoring notes: discussions with a senior colleague about real situations where you handled information differently.
- Testimonials: from people who know about the concern and have seen your practice since.
- A reflective statement in your own words: the reflective statement builder gives you regulator-specific prompts and flags details that could identify a patient.
- Index and chronologyWhat happened and what you have done since, in date order.
- Reflective statementsYour own account of what you learned and changed.
- CertificatesCourses completed, with dates and what each covered.
- TestimonialsSigned, dated, from people who know the concerns.
- CPD logRelevant learning with notes on how you applied it.
- Action planWhat you will keep doing so it does not happen again.
A practical order of work
- Get advice. Contact your defence organisation, union or a solicitor before you respond to your regulator.
- Stop the risk. Remove patient information from personal devices and chats, and change settings that allowed the breach.
- Check your readiness. The free remediation readiness check shows where your evidence is strong and where the gaps are.
- Learn. Start with the confidentiality course, then the social media course, then the others in the pack.
- Apply and record. Note specific situations where you now act differently, with dates.
- Reflect. Write your statement after the learning, not before, so it shows real change.
- Assemble. Put certificates, reflection, testimonials and your policy into one indexed portfolio, and review it with your representative.
Getting support and keeping things in proportion
Being the subject of a concern is stressful, and online concerns can feel especially public. You do not have to work through it alone. Defence organisations, unions and professional bodies offer advice, and NHS Practitioner Health and your GP can help if the process is affecting your health.
Healthcare Practise UK is an independent online CPD provider. We are not part of, or recognised by, any regulator or the NHS. Nothing on this page is legal advice, and nothing here predicts the outcome of any case. Your regulator and its panels make the decisions.
Frequently asked questions
Is every confidentiality breach a fitness to practise matter?
No. Many breaches are handled by the employer as information governance incidents. Whether a regulator becomes involved depends on the seriousness, the circumstances and any pattern. If you are unsure, ask your defence organisation or union.
Will completing the pack mean my case is closed?
No course can do that. The pack gives you structured learning, dated certificates and a basis for reflection. Decision makers weigh it with everything else, including your insight, what you have changed and the risk of repetition.
Can I still share anonymised patient stories online?
Be very cautious. Removing a name is often not enough, because details can be pieced together to identify someone. The social media course covers jigsaw identification and when consent is needed. Check your regulator's social media guidance as well.
I have left the messaging group. Is that enough?
It is a sensible first step, but on its own it shows a change of setting rather than a change of understanding. Pair it with learning, a written personal policy and a reflection on why the group felt acceptable at the time.
Which course should I take first?
Start with Ensuring Confidentiality in Healthcare Practice, because it sets out the law and the regulators' expectations. Then take the social media course if your concern involved messaging or posting.
Do these courses count towards my CPD?
They are self-directed online learning. Most regulators accept relevant self-directed learning, but they count it in different ways. For example, the NMC asks for 35 hours of CPD, at least 20 of them participatory, so these courses would count towards the individual learning part (NMC CPD requirement).
Not sure where to start?
Tell us your regulator and the concern. The pathway shows the courses that fit, helps you write your reflection and puts your evidence in order. It is free and nothing leaves your browser.