What happens if you breach patient confidentiality?
Most breaches are found through routine checks. Electronic records log every access, organisations audit them, and patients can ask who has viewed their record. Once a breach is identified, several things can follow, sometimes at once.
| Possible consequence | What it involves |
|---|---|
| Employer investigation | An information governance review and often a disciplinary process. Outcomes range from advice and retraining to a final warning or dismissal |
| Regulator referral | The GMC, NMC, HCPC or GPhC may look at fitness to practise, especially for deliberate, repeated or dishonest breaches |
| Report to the ICO | The organisation must report certain personal data breaches to the Information Commissioner's Office within 72 hours of becoming aware of them |
| Criminal prosecution | Knowingly or recklessly obtaining or disclosing personal data without the controller's consent can be an offence under section 170 of the Data Protection Act 2018. The ICO has prosecuted NHS staff for this |
| Complaint or claim | The patient may complain or bring a civil claim |
What counts as a breach of confidentiality?
The most common breaches are not dramatic leaks. They are everyday lapses by people who did not intend harm.
| Breach | Example |
|---|---|
| Accessing records without a care reason | Looking up a relative's results, a colleague's admission or someone in the news |
| Accessing your own record through work systems | Checking your own blood results on the hospital system, which many policies prohibit |
| Talking in public | Discussing a patient in a lift, café or on a train |
| Misdirected information | A letter to an old address, an email autocompleting to the wrong person, a document left on a printer |
| Insecure messaging | Sharing a photo of an X-ray or wound in a personal WhatsApp group |
| Lost devices or papers | A handover sheet left on a bus or an unencrypted memory stick |
| Telling family without consent | Giving a relative a diagnosis over the phone without checking the patient's wishes or the caller's identity |
What are the rules on patient confidentiality?
Several overlapping sets of rules apply. You do not need to be a lawyer, but you do need to know the main ones.
- The common law duty of confidentiality: information given in confidence must not be disclosed without consent unless there is a legal basis or an overriding public interest.
- UK GDPR and the Data Protection Act 2018: personal data must be handled lawfully, fairly, securely and only as far as necessary. Health data is special category data.
- The Human Rights Act 1998: Article 8 protects private and family life, including health information.
- Professional standards: the GMC, NMC, HCPC and GPhC all require you to protect confidentiality and share information appropriately.
- Employer policies on information governance, acceptable use, messaging and social media.
In England, the eight Caldicott Principles guide how confidential information is used. In short: justify the purpose, use it only when necessary, use the minimum needed, give access on a need-to-know basis, make sure everyone understands their responsibilities, comply with the law, remember that the duty to share for individual care can be as important as the duty to protect confidentiality, and tell people how their information is used.
When can you lawfully share confidential information?
Most sharing within a care team happens under implied consent: a patient who agrees to a referral can reasonably expect relevant information to go to the specialist. That covers people directly involved in care, not a curious colleague in another department. Beyond direct care, the GMC sets out lawful routes, and other regulators take a similar approach.
- With consent: The patient has capacity and agrees, understanding what will be shared, with whom and why. Express consent is needed for most purposes beyond direct care, such as insurance reports.
- Required by law: For example notifiable infectious diseases, a court order, or the mandatory reporting of female genital mutilation in under-18s by regulated professionals in England and Wales. Share only what is required.
- In the public interest: Where the public interest in disclosure outweighs the interest in confidentiality, usually to prevent serious harm to others or detect serious crime. Seek consent first unless that would increase risk or is not practicable.
- For a patient who lacks capacity: Where sharing is in their best interests, following the Mental Capacity Act 2005.
- For safeguarding: Where a child or adult at risk may be suffering, or likely to suffer, significant harm. Follow local procedures and involve your safeguarding lead.
A police request alone does not oblige you to disclose. Unless there is a court order or a legal requirement, decide whether disclosure is justified in the public interest, seek advice from your Caldicott Guardian, information governance team or defence organisation, and record your decision and reasons. Even when sharing is justified, share the minimum necessary.
Can I use WhatsApp to share patient information?
NHS England's guidance on mobile messaging accepts that messaging can help in urgent situations, but sets clear expectations. Your organisation's policy may be stricter, so check it.
- Use approved, secure apps where they are available.
- Protect any device you use with a passcode and the ability to wipe it remotely.
- Share only the minimum information needed.
- Do not treat messages as the clinical record. Transfer relevant information into the record.
- Delete messages and images from your device once they are recorded.
What should I do immediately after a breach?
- Contain it: Stop it spreading. Retrieve documents, ask a wrong recipient to delete an email and confirm they have, and secure anything lost if you can.
- Report it straight away: Tell your line manager and report it through your incident system and to the information governance team or Data Protection Officer. The 72-hour ICO deadline runs from when the organisation becomes aware, so delay causes problems.
- Be honest: Give an accurate account. If you looked at a record without a reason, say so. Audit trails show what was accessed and when, so any inaccuracy will be found and treated as dishonesty.
- Support openness: The organisation will decide how the patient is told. People must be told without undue delay where a breach is likely to put them at high risk.
- Get advice: If disciplinary or regulatory action is possible, contact your trade union, defence organisation or professional body before giving a formal statement.
Will I be struck off for a confidentiality breach?
A single careless breach, reported promptly and handled honestly, is usually dealt with by the employer. Regulators are more likely to be involved, and outcomes more serious, where access was deliberate and repeated, many patients were affected, information was used for personal gain or to cause harm, or the professional was dishonest. Repeated access over days or weeks suggests a pattern rather than a lapse, and needs a correspondingly thorough response.
Lucy, a staff nurse, saw her neighbour being admitted to another ward. Worried, she opened his record four times over two days, read his scan report, and mentioned the result to his wife, who had not yet been told. The patient complained and an audit confirmed the accesses. Lucy was not involved in his care.
I only looked because I was worried about him and wanted to help his family. I did not change anything. Lots of staff check on people they know. I have redone my information governance training.
I opened my neighbour's record four times over two days with no role in his care and no lawful reason. I then told his wife his scan result before he had heard it himself, which took away his right to receive his own news from his doctors, in his own way. My worry for him does not change that. I now understand that being staff gives me no right to look. I told my manager the full truth when asked, I have completed information governance training and discussed the Caldicott Principles with my manager, and I now refer any concern about someone I know to the team caring for them.
The strong version is precise about what happened, names the harm to the patient, does not hide behind good intentions or what others do, and describes specific changes.
Learning from a breach
This guide is general information, not legal advice. Follow your organisation's information governance policy and seek advice from your union or defence organisation if you are being investigated.
Our course Confidentiality and Data Protection Breaches covers the legal framework, lawful disclosure, the common breaches including record access and messaging apps, the immediate steps after a breach and a guided reflection and remediation plan. The courses on medication errors and record keeping are also available if your learning plan includes them.
Frequently asked questions
Can I be sacked for looking at a family member's medical records?
Yes, it is possible. Accessing a record without a legitimate reason connected to that person's care usually breaches employer policy, and outcomes range from retraining to dismissal depending on how often it happened, what was done with the information and how honest you were. It can also lead to a regulator referral or prosecution.
Is accessing patient records without a reason a criminal offence?
It can be. Under section 170 of the Data Protection Act 2018, knowingly or recklessly obtaining or disclosing personal data without the consent of the data controller can be an offence. The Information Commissioner's Office has prosecuted NHS staff who looked at records without a valid reason.
Can I look at my own medical records on the hospital system?
Many NHS organisations prohibit staff from accessing their own records through work systems and require them to use the same routes as any other patient, such as a subject access request or the NHS App. Check your organisation's policy, because breaching it can lead to disciplinary action.
When can a nurse break confidentiality?
When the patient consents, when the law requires it, when there is an overriding public interest such as preventing serious harm to others, when sharing is in the best interests of a patient who lacks capacity, or for safeguarding. Share only the minimum necessary and record your reasons.
Will I be referred to the NMC for a confidentiality breach?
Not always. Many single, careless breaches that are reported promptly and handled honestly are dealt with by the employer. Referral is more likely for deliberate or repeated access, breaches affecting many patients, personal gain, or dishonesty during the investigation. Get advice from your union early.
What should I do if I sent patient information to the wrong person?
Act at once. Ask the recipient to delete or return it and confirm they have done so, tell your manager, and report it through your incident system and to the information governance team. Your organisation may need to report it to the ICO within 72 hours of becoming aware.
Related courses
Confidentiality and Data Protection Breaches
This course explains the duty of confidentiality, the legal framework for handling patient information in the UK, and the situations in which…
Medication Errors: Reflection and Remediation
This course explains why medication errors happen, what you must do when one occurs, and how to show a regulator or employer that you have understood…
Record Keeping and Documentation: Remediation Course
This course explains what good clinical documentation looks like, why record-keeping concerns arise, and why altering or falsifying a record is…
Sources and further reading
- Confidentiality: good practice in handling patient information. General Medical Council.
- The Code: Professional standards of practice and behaviour for nurses, midwives and nursing associates. Nursing and Midwifery Council.
- The Caldicott Principles. National Data Guardian.
- Data Protection Act 2018. legislation.gov.uk.
- Personal data breaches: a guide. Information Commissioner's Office.
- Information governance guidance: using mobile messaging. NHS England.
Practitioner Insight is an independent education provider. It is not affiliated with or endorsed by the GMC, MPTS, NMC, HCPC, GPhC or any NHS organisation, and this information is not legal advice. If you have been referred to a regulator, speak to your defence organisation, trade union or legal representative.
More guides
The Mental Capacity Act 2005 Five Principles and Valid Consent Explained
The Mental Capacity Act 2005 five principles explained with examples, plus the capacity test, best interests and what makes consent valid after Montgomery.
Chaperones and Intimate Examinations: GMC and NMC Guidance Explained
Chaperone and intimate examination guidance explained: GMC and NMC expectations, NHS England principles, consent, who can chaperone and what to record.
DNACPR and the ReSPECT Form Explained for Clinicians
DNACPR and ReSPECT explained for UK clinicians: what each means, who decides, the duty to consult, capacity, recording the decision and handling disagreement.