Information requests, sharing and reporting breaches

Good data protection does not mean never sharing information. It means sharing the right information with the right person, for a legitimate purpose, by the safest practical route, and recording or escalating where required.

Sharing information safely

• Check the purpose: why is the information needed?
• Check authority: is the requester the patient, an authorised representative, a professional with a legitimate role, or someone with a lawful route?
• Use minimum necessary: provide no more information than the purpose requires.
• Use an approved method: follow local rules for email, post, portals, telephone calls and handovers.
• Record or escalate: follow local procedure when sharing is unusual, sensitive or uncertain.

When information may need sharing

Information may be shared for direct care, referrals, safeguarding, complaints, legal requirements, police requests, insurance or patient rights. Support staff should not make complex disclosure decisions alone. Escalate if a request is unusual, urgent, legal, safeguarding-related or unclear.

Subject access requests can be verbal or written and do not need to mention data protection law. Pass possible SARs to the manager or information lead promptly because organisations usually must respond within one month.

Police, solicitor, insurer, court or other legal requests should go through the manager, data protection lead or an authorised local route. Do not confirm or send patient information at reception simply because a request sounds official.

Breaches and near misses

A personal data breach is not only hacking. It can be an email sent to the wrong person, lost paperwork, a screen visible to the public, a record accessed without authority, a message sent to an old number, or a patient image shared in the wrong place. Report possible breaches immediately so the practice can contain, assess, record and decide follow-up.

Breach reporting and ICO timescales

Report possible breaches quickly. A fast, honest report gives the practice the best chance to contain harm and meet its duties.