Using and sharing information lawfully and fairly

Good information handling means using patient information for care, access, safety, safeguarding, administration and legal duties while protecting confidentiality.

Only share information for a clear purpose, follow practice processes and limit what you disclose to what is necessary.

Share for the right reason

Information may need to be shared within the practice so the right person can act. It may also be sent to another NHS service, pharmacy, hospital, community team, safeguarding route or emergency service. Such sharing must follow local procedures and be relevant to the purpose.

Be cautious if a request comes from outside normal care routes, for example a relative, employer, school, solicitor, police officer, social worker or private company. Some requests are legitimate, but they must follow the correct route.

Be transparent where appropriate

Patients should be able to understand, broadly, how the practice uses and shares their information. Privacy notices, registration materials and the practice website usually explain this. Reception staff do not need to give legal detail on a busy call, but should know where to signpost patients who ask.

If a patient objects to sharing or expresses concern about confidentiality, do not dismiss it. Record or escalate the concern according to local process so someone with the right authority can advise.

Do not use informal shortcuts

• Do not use personal phones or accounts for patient information unless an approved emergency policy allows it.
• Do not discuss identifiable patients casually in public areas, staff kitchens or social settings.
• Do not send information to an unverified email address because someone sounds urgent.
• Do not use screenshots or copied text outside approved systems.
• Do not access records for curiosity, family interest or gossip.

Common law confidentiality

Sharing can be safe and necessary, but only when it has a proper purpose, the right route and the minimum necessary information.