1. In our guidance Confidentiality: good practice in handling patient information we say:

115. Third parties, such as a patient’s insurer or employer, or a government department, or an agency assessing a claimant’s entitlement to benefits, may ask you for personal information about a patient, either following an examination or from existing records. In these cases, you should:

a. be satisfied that the patient has sufficient information about the scope, purpose and likely consequences of the examination and disclosure, and the fact that relevant information cannot be concealed or withheld

b. obtain or have seen written consent to the disclosure from the patient or a person properly authorised to act on the patient’s behalf. You may accept an assurance from an officer of a government department or agency, or a registered health professional acting on their behalf, that the patient or a person properly authorised to act on their behalf has consented

c. only disclose factual information you can substantiate, presented in an unbiased manner, which is relevant to the request. You should not usually disclose the whole record, although it may be relevant to some benefits paid by government departments and to other assessments of a patient’s entitlement to pensions or other health- related benefits

d. offer to show your patient, or give them a copy of, any report you write about them for employment or insurance purposes before it is sent, unless:

i. they have already indicated they do not wish to see it

ii. disclosure would be likely to cause serious harm to the patient or anyone else

iii. disclosure would be likely to reveal information about another person who does not consent.1

About this guidance

2. One of the core duties of a doctor is to make the care of your patient2 your first concern. There are, however, many circumstances in which you might be asked to disclose information from existing records or after examining a patient, and in which you face dual obligations. By this we mean that you have obligations both to the patient and to the person or organisation that has requested the information.

3. This explanatory guidance sets out how the general principles in our guidance Confidentiality apply when patient information is being disclosed in these circumstances. The guidance applies to disclosure of information obtained directly from a patient, or from a patient’s medical record, or from another health professional. It does not apply if your opinions are based solely on information provided by the person or body that is commissioning the opinion.

When do dual obligations arise?

4. Usually, dual obligations arise when a doctor works for, is contracted by, or otherwise provides services to:

  • a patient’s employer (as an occupational health doctor)
  • an insurance company
  • an agency assessing a claimant’s entitlement to benefits
  • the police (as a police surgeon)
  • the armed forces
  • the prison service
  • a sports team or association.3

5. Alternatively, a person or organisation you have previously had no direct relationship with, such as your patient’s employer or insurance company, might ask you to provide a medical report or information about a patient. You might be offered payment for your own or your staff’s time and effort, giving rise to an obligation in addition to the one you have to your patient.

How much information should you disclose?

6. You should only disclose information that is relevant to the request, which means you should not usually disclose a patient’s whole record.4 There are two exceptions to this general rule.

  • Benefit claims: the patient’s whole record may be relevant to some benefits paid by government departments or agencies.5
  • Legal processes: a solicitor may need to see their client’s whole record to assess which parts are relevant, for example, to personal injury claims. If the claim goes ahead, the person against whom the claim is made may ask for copies of important documents, which could include records containing the patient’s medical history. Under court rules in England and Wales, they can see the patient’s whole record and the solicitor should explain this to the patient. In Northern Ireland and Scotland, you should disclose your patient’s record in accordance with their wishes or as ordered by a court.6

Writing reports

7. When writing a report7 you must:

a. make sure it is not false or misleading – you must take reasonable steps to check the information in the report is correct, and you must not deliberately leave out relevant information

b. restrict the report to areas in which you have direct experience or relevant knowledge

c. make sure any opinion you include is balanced, and be able to state the facts or assumptions on which it is based.

Disclosing a report about a patient

8. You do not need to ask for separate consent to release a report following an examination as long as you are satisfied that the patient has given informed consent both for the examination and for the release of any subsequent reports (see paragraph 115 of Confidentiality, which is reproduced at the top of this explanatory guidance).

9. You should, however, usually offer to show your patient or give them a copy of any report you write about them for employment or insurance purposes before it is sent.8

10. If a patient asks you to amend a report, you should correct any errors of fact and any opinion that is based on errors of fact. You should not remove information, opinion or advice if you believe the report would be false or misleading as a result.

11. If a patient withdraws consent for the report to be disclosed, it may be appropriate for you to tell the patient that their decision may lead to adverse consequences for them. For example, the absence of occupational health information could disadvantage the patient in negotiations with their employer. You must, however, abide by the patient’s wishes unless the disclosure is required by law (see paragraph 14) or can be justified in the public interest (see paragraph 15).

12. If a patient withdraws consent for a report to be disclosed, or fails to attend an appointment, you can let the report commissioner know but you should not disclose any further information.

13. When you are satisfied that a report should be disclosed, you should complete and send the report without unreasonable delay.

Disclosures required by law

14. You must disclose information if it is required by law or by the courts. If a disclosure is required by law, you should follow the guidance at paragraphs 87–94 of Confidentiality. If you are not sure whether a disclosure is required by law, you should ask the person or body requesting the information to identify the legal basis, or seek independent legal advice.

Disclosures in the public interest

15. Disclosing personal information about a patient without consent may be justified in the public interest if failure to do so may expose others to a risk of death or serious harm. This could arise, for example, if a patient may pose a serious risk to others through being unfit for work or if conditions at work are unsafe.9 If you think that a disclosure may be justified in the public interest, you should follow the guidance at paragraphs 63–70 of Confidentiality.