Why third-party requests need careful handling

Third-party requests are routine in general practice: a relative asking about blood results, a carer reporting confusion, a school checking attendance, an employer requesting a sick note, or a police officer asking for an address. Each request requires care because patient information is confidential.

Helpful does not always mean authorised

Relatives and carers often provide useful context, for example about medication routines, transport, memory problems or safety concerns. That does not automatically give them the right to receive confidential details from the record.

Separate two questions: can we accept the information being offered, and can we disclose information back? Often you can record concerns or listen to relevant observations without confirming appointments, results, diagnoses or treatment.

Small disclosures can still matter

Staff may feel that brief confirmations are harmless – for example, saying a patient is registered, that a letter has arrived, or that a clinician has called. Even these small details can reveal private information when the caller is not authorised.

A practical habit is to describe processes rather than patient content. Explain how an authorised person can contact the practice, how to request proxy access, or how to pass on urgent concerns, without confirming confidential details.

Common risk points

• Assuming family status is enough: a spouse, adult child or sibling may still need consent or recorded authority.
• Oversharing during helpful conversation: small details can confirm more than intended.
• Using unsafe contact routes: call-backs, texts or voicemail may reveal information to the wrong person.
• Missing safeguarding clues: a caller may be controlling access rather than supporting it.

Third-party requests are not just admin tasks; they are confidentiality decisions that may also reveal care or safeguarding concerns.

Caldicott thinking