Law, Confidentiality, and Patient Rights

Caldicott principle 6 requires that every use of confidential information complies with the law. In dental practice this sits alongside UK GDPR, the Data Protection Act 2018, common law confidentiality, GDC standards, contractual requirements for NHS or private work, safeguarding duties, and local practice policies. Dental nurses do not need to be legal experts, but they must recognise when a request needs escalation.

Typical requests include copies of records, enquiries from relatives, solicitor letters, police requests, insurance forms, complaints, safeguarding concerns, and patient requests to correct or delete information. A safe first response is factual and calm: identify the request, protect privacy, avoid promises, and refer it to the appropriate person.

Escalate before acting when

• a third party asks for patient information;
• a request involves a child, capacity, attorney, consent, or safeguarding;
• a patient asks for a full copy of records;
• police, solicitor, insurer, school, employer, or family member requests information;
• you are unsure whether sharing is lawful or expected.

Confidentiality is not absolute. Information may need to be shared to support care, protect a patient or another person, meet a legal duty, or respond to a valid rights request. Any decision to share must be justified, lawful, proportionate, and recorded.

Subject access and patient rights

If a request has legal, third-party, safeguarding, consent, or patient-rights implications, the dental nurse's role is to recognise it, protect privacy, record facts, and escalate.