Checking identity, consent and recorded authority

Before sharing patient information with a third party, staff must confirm who is asking, which patient is involved, what information is requested and whether the practice has a lawful and locally approved basis to share it.

Identity is only the first step

Identity checks confirm who the caller says they are. Authority checks determine whether that person may receive or act on the requested information. A caller can pass identity checks but still lack authority to receive results, appointment details or parts of a record.

Authority may come from the patient, recorded consent, formal proxy access, parental responsibility, a legal appointment, a best-interests decision, a safeguarding route, a statutory requirement or another approved process. Frontline staff should follow local procedures and escalate complex or unclear cases.

When the record is unclear

Consent and authority notes are sometimes old, vague or incomplete. An entry such as "daughter helps" does not make clear whether the daughter can receive results, book appointments or discuss sensitive consultations. If the scope is uncertain, pause and seek advice.

Do not try to resolve uncertainty by asking the third party to prove their role during the call. Use the approved process to contact the patient, check consent or escalate to a supervisor.

Practical checks

• Identify the patient: use the approved demographic checks for the patient concerned.
• Identify the caller: record their name, relationship, organisation and contact details where relevant.
• Check authority: look for consent, proxy access, nominated contact, carer note, legal role or professional pathway.
• Match the scope: check whether authority covers this type of information, not just any contact.

Authority should fit the request: permission for one task is not automatic permission for every part of the record.

Capacity and legal authority