Checking identity and authority before disclosure

Before sharing patient information, staff must confirm who they are speaking to and whether that person is authorised to receive the requested information. A caller's tone, confidence or stated family relationship is not sufficient.

Identity checks protect patients and staff and reduce the risk of accidental disclosure, particularly when phones are shared, family relationships are complicated or safeguarding concerns exist.

Identity and authority are different

Identity is confirming who the person is. Authority is confirming what they may receive or what actions they may take. A person can pass identity checks but still lack authority to receive another patient's information.

For example, a daughter may confirm her own name and relationship but that does not automatically authorise disclosure of her parent's test results.

Use the local procedure

• For the patient: confirm identity using the agreed checks before discussing personal information.
• For a proxy or carer: check recorded consent, proxy access or legal authority.
• For urgent safety information: receive relevant information even if you cannot disclose information back.
• For uncertainty: pause and ask a supervisor, clinician or information governance lead.

Being helpful does not mean bypassing identity or authority checks.

Third-party nuance