Confidentiality & Data Protection Remediation
Healthcare professionals handle some of the most sensitive information people ever share. When concerns arise about patient confidentiality, information sharing, privacy or data handling, remediation means understanding both your professional duty and the legal framework, reflecting on what happened, closing the real learning gap and showing that you now handle information more safely.
- UK healthcare focused
- Regulator-aware
- Evidence-led learning
- Independent provider
What happened with the information?
Choose the closest situation. See what is likely to be considered, what to do now and where learning should focus.
Select a situation to see where to start.
What is patient confidentiality?
Patient confidentiality is the duty to protect, and handle appropriately, information obtained through a professional relationship. It covers medical information, treatment and diagnoses, test results, photographs, appointment information, identifying details, what patients tell you during care, and any information that reveals something about a person's health.
The GMC's confidentiality guidance states that patients have a right to expect their personal information to be held in confidence by the professionals who care for them. Every UK healthcare regulator includes confidentiality in its core standards: for example, the NMC Code asks professionals to respect people's right to privacy and confidentiality (standard 5), and the HCPC's standards of conduct, performance and ethics include a standard on respecting confidentiality.
In law, the Information Commissioner's Office (ICO) confirms that health data is special category personal data under the UK GDPR, which means it receives additional protection. Health data is defined broadly and can include information about a person's past, current or future physical or mental health.
Are confidentiality and data protection the same thing?
No. They overlap, but they are not interchangeable, and a healthcare professional usually needs to consider both.
| Concept | Main focus | Main source |
|---|---|---|
| Confidentiality | The duty to protect information entrusted to you as a professional | Professional standards and the common law duty of confidence |
| Data protection | The legal framework for processing personal data | UK GDPR and the Data Protection Act 2018; guidance from the ICO |
| Information governance | Organisational systems and controls for managing information | Your employer's policies and procedures |
| Privacy | The individual's interests and rights over their personal information | Law, standards and patient expectations |
| Cybersecurity | Protecting information and systems from unauthorised access or attack | Organisational security policies |
What types of healthcare information are sensitive?
Health information
Diagnoses, treatment and medical history.
Clinical records
Notes, assessments and care plans.
Test results
Laboratory, imaging and other results.
Identifiers
Anything that identifies, or helps identify, a patient.
Images
Clinical photographs and other identifiable images.
Appointment information
Even the fact of an appointment can reveal health information.
Communication
Emails, messages, letters and conversations about patients.
Combinations
Details that are harmless alone can identify someone together.
What can lead to a confidentiality concern?
Disclosure
- Unauthorised disclosureSharing with someone not entitled to the information.
- Incorrect recipientLetters, emails or results sent to the wrong person.
- Workplace conversationsDiscussing patients where others can hear.
Access
- Inappropriate accessViewing records without a legitimate professional reason, including those of family, friends, colleagues or yourself.
- Shared loginsUsing or allowing others to use your access.
Handling and technology
- Insecure communicationPersonal email or unapproved messaging apps.
- Physical recordsDocuments left where others can see them.
- Digital recordsUnlocked screens, personal devices, screenshots.
- Social media and photographyPosts or images that could identify a patient.
Does a confidentiality breach automatically mean misconduct?
Not necessarily. Many confidentiality incidents are accidental, are reported promptly and are resolved through local learning. The regulatory significance of a concern depends on the facts, the applicable professional standards and your regulator's processes.
The single most important distinction is usually between accidental disclosure, such as an email sent to the wrong address, and deliberate access or disclosure without a legitimate reason. Deliberately accessing records out of curiosity is treated very differently from a mis-addressed letter, and knowingly or recklessly obtaining or disclosing personal data without the controller's consent can be a criminal offence under the Data Protection Act 2018.
Factors that are likely to be considered
- what information was involved
- who received or accessed it
- whether the patient was identifiable
- why it was accessed or disclosed
- whether there was a legitimate purpose
- accidental or deliberate
- the scale of the disclosure
- actual or potential impact
- whether it was repeated
- how you responded and reported it
- what now prevents recurrence
Why is confidentiality a professional responsibility?
Trust
Patients share what they need to for safe care only if they believe it will be protected.
Privacy
Healthcare involves some of the most personal information people have.
Patient safety
Appropriate sharing is often necessary for safe, coordinated care.
Accountability
Professionals must understand their responsibilities for the information they handle.
Is patient consent always required to share information?
Consent, confidentiality and data protection are related but separate concepts, and confusing them is one of the most common misunderstandings in this area.
The ICO explains that consent to healthcare treatment is not the same as consent as a lawful basis for processing personal data, and that in healthcare another lawful basis will often be more appropriate, depending on the circumstances. Whether and how patients should be involved in decisions about sharing their information is also a matter of professional guidance, which may expect you to respect patient wishes even where sharing would be lawful.
What UK GDPR means for healthcare professionals
Because health information is special category data, processing it generally requires both a lawful basis under Article 6 and a condition under Article 9 of the UK GDPR, with further requirements depending on the circumstances. In practice, most professionals rely on their organisation's established processes rather than making these decisions alone, so follow the information governance policies that apply to your role and seek advice from your information governance or data protection lead when unsure.
What does confidentiality remediation involve?
- 1
Understand the concern
What happened, exactly?
- 2
Identify the information
What was involved, and how sensitive?
- 3
Professional standard
What your regulator expects.
- 4
Data protection requirements
What the law and your organisation require.
- 5
Reflect
Why it happened, and your role.
- 6
Identify the learning need
Knowledge, habit or process.
- 7
Change practice
How you now handle information.
- 8
Demonstrate improvement
Evidence, handled safely.
What does insight mean in a confidentiality case?
"I understand confidentiality now" is not insight. Specific understanding and changed practice are. Useful questions include:
- What information was involved?
- Why was it confidential?
- Who received or accessed it?
- Why did the incident occur?
- What responsibility applied?
- What impact could it have had?
- What should have happened?
- What have I learned?
- What safeguards are now in place?
- How will similar incidents be avoided?
Insight into impact matters particularly here. A patient whose information was disclosed may experience distress, stigma or loss of trust in their care, even when no clinical harm follows. Showing that you understand this from the patient's perspective is often central.
How to reflect on a confidentiality concern
- What happened?
- What information was involved?
- Why was the handling inappropriate or concerning?
- What professional and legal requirements were relevant?
- What was my responsibility?
- What was the potential impact?
- What have I learned?
- What will I do differently?
- What evidence demonstrates the change?
Be careful when using patient information as evidence
Remediation evidence must not create a new confidentiality problem. Case reflections, audits, clinical examples, documentation samples and incident reviews all risk including patient information. Follow your organisation's and your regulator's requirements for anonymisation, confidentiality and secure handling.
Removing a name is not enough. Identifiability often comes from combinations of details.
If you are unsure whether evidence is sufficiently anonymised, ask your information governance lead before using it, and prefer summaries or reviewer reports over copies of records.
How confidentiality overlaps with other concerns
Documentation
Documentation asks whether the record is accurate, complete and appropriate. Confidentiality asks whether information is accessed, used and shared appropriately. Data protection asks whether personal data is processed lawfully.
Documentation remediationProbity
An accidental incident is not a probity issue. A probity concern may arise from deliberately misleading others, concealment, knowingly accessing information without a legitimate purpose, falsifying information about access or disclosure, or misrepresenting what happened.
Probity remediationProfessionalism
Confidentiality overlaps with professional responsibility, boundaries, communication, accountability, appropriate use of technology and respect for patient privacy, especially where concerns involve social media or personal devices.
Professionalism remediationSocial media and patient confidentiality
Risk areas include patient stories, photographs, screenshots, clinical scenarios, workplace information, identifiable details, private messaging, closed groups and comments about patients. A patient may be identifiable even where their name is not included, particularly to people who know them. The aim is not to avoid discussing healthcare online, but to apply professional standards and appropriate information handling.
Electronic records, email and digital communication
Common concerns include wrong email recipients, insecure messaging, screenshots, unauthorised system access, shared passwords, unlocked systems, information stored on unapproved devices, and personal accounts used for professional information. The exact requirements come from your employer's information governance policies and your professional standards.
Can confidentiality training help with remediation?
A relevant confidentiality or information governance course can address an identified learning need and form part of a wider remediation plan. Course completion alone does not necessarily show that a confidentiality concern has been fully addressed. That is shown by how you now handle information.
Learning that may be relevant
Depending on the concern: patient confidentiality, data protection and UK GDPR, information governance, privacy, secure communication, record handling, social media professionalism, cyber awareness, appropriate information sharing, consent and information sharing, professional standards, and safeguarding and information sharing. Match the learning to the actual concern and your role, rather than taking generic GDPR training.
What evidence may demonstrate improvement?
Relevant training
Targeted education on the specific issue.
Assessment
Demonstrates understanding.
Reflection
Learning and insight, fully anonymised.
Action plan
Structured steps to prevent recurrence.
Supervision
Supported development.
Feedback
Evidence of changed practice from colleagues.
Access audit or review
Where authorised, shows appropriate access over time.
Updated practice
Specific safeguards or process changes introduced.
- Specific
- Addresses the actual information-handling issue.
- Relevant
- Matches your role and the systems you use.
- Practical
- Changes how information is handled day to day.
- Proportionate
- Targets the actual risk.
- Evidence-based
- Supported by appropriate, anonymised evidence.
- Sustained
- Improvement continues over time.
Common confidentiality remediation mistakes
- "Never share information". Appropriate sharing is often essential.
- Consent as the only basis. Other lawful bases often apply in healthcare.
- Generic GDPR training. Unrelated to the specific concern.
- Certificates without changed practice. No evidence of safer handling.
- Identifiable information in reflections. Creating a new breach.
- Assuming no name means anonymous. Combinations identify people.
- Ignoring local policies. Information governance rules apply to you.
- Not reflecting on why it happened. Only on what happened.
- Disclosure, not process. The underlying process left unchanged.
- Treating an accident as deliberate. Or the reverse.
- No safeguards shown. Nothing demonstrates reduced risk.
- One framework for all regulators. Standards differ.
Confidentiality across UK healthcare regulators
Professional confidentiality requirements vary by profession and regulator, and your employer will also have its own information governance policies. For UK data protection law, the ICO is the authoritative source.
Confidentiality remediation by healthcare profession
If a confidentiality concern has become a regulatory issue
If your handling of confidential information is being considered by a regulator, employer or other formal body, this page provides general educational information rather than case-specific legal or regulatory advice. Where a concern could also involve a data protection offence, independent advice is particularly important.
Consider advice from a regulatory solicitor, your professional defence organisation, your trade union or another appropriate professional adviser.
IRR Practice is an independent education provider. Find your regulator.
What do you need to address?
How IRR Practice can support confidentiality learning
Understand
Professional confidentiality and information-handling principles.
Learn
Targeted education for the identified learning need.
Reflect
Consider what happened and what needs to change.
Evidence
A certificate and learning record for your wider evidence.
Educational learning may form part of a wider remediation process. IRR Practice does not determine regulatory outcomes and cannot guarantee that a regulator, employer or panel will accept a particular course or form of evidence.
Related learning
Insight
- Impact of disclosure on patients
- Understanding responsibility
- Expressing insight specifically
Structured CPD · 1.5 CPD ptsReflection and Reflective Practice
- Reflecting without identifying patients
- Analysing why an incident happened
- Linking reflection to safeguards
Structured CPD · 1.5 CPD ptsRemediation
- Building a confidentiality action plan
- Evidencing safer information handling
- Presenting evidence safely
Structured CPD · 1.5 CPD ptsConfidentiality
- The professional duty of confidentiality
- Appropriate information sharing
- Data protection principles in practice
Structured CPD · 1.5 CPD ptsSocial Media Professionalism
- Identifiability and online posting
- Messaging, groups and screenshots
- Professional standards online
Structured CPD · 2 CPD ptsPrivacy, Consent and Chaperone
- Privacy and dignity in care
- Consent and its limits
- Chaperones and intimate examinations
Structured CPD · 1.5 CPD ptsDepending on the concern, Documentation Professionalism, Probity or Professionalism for Healthcare Professionals may also be relevant.
Confidentiality remediation: FAQs
What is patient confidentiality?
Patient confidentiality is the duty to protect and appropriately handle information obtained through a professional relationship, including health information, results, images, appointments and identifying details. Every UK healthcare regulator includes it in its core standards.
What is confidentiality remediation?
It is the process of understanding a confidentiality or data handling concern, identifying the relevant professional and legal requirements, reflecting on why it happened, addressing the learning need, changing how you handle information and demonstrating that improvement safely.
Is health information protected under UK GDPR?
Yes. The ICO confirms that health data is special category personal data under the UK GDPR, which gives it additional protection. Processing it generally requires both an Article 6 lawful basis and an Article 9 condition.
Is confidentiality the same as data protection?
No. Confidentiality is a professional and common law duty to protect information entrusted to you. Data protection is the legal framework governing how personal data is processed. They overlap, but a professional usually needs to consider both.
Is patient consent always required to share information?
Not always. Consent to treatment is not the same as consent as a lawful basis for processing data, and in healthcare another lawful basis often applies. Professional guidance also sets expectations about involving patients in decisions about sharing. Follow your organisation's policies and professional guidance.
Is a confidentiality breach automatically misconduct?
No. Many incidents are accidental, reported promptly and resolved locally. The significance depends on what information was involved, who received it, whether it was accidental or deliberate, the impact and your response.
Can a confidentiality breach affect fitness to practise?
It can, particularly where access or disclosure was deliberate, repeated or without a legitimate purpose. Deliberately accessing records without a work reason is treated far more seriously than an accidental disclosure.
What does insight mean after a confidentiality concern?
It means understanding specifically what information was involved, why it was confidential, why the incident happened, your responsibility, the potential impact on the patient, what should have happened and what safeguards you have introduced.
How should I reflect on a confidentiality incident?
Work through what happened, the information involved, why the handling was inappropriate, the relevant requirements, your responsibility, the potential impact, what you have learned, what you will do differently and what evidence shows the change, without including identifiable patient details.
Can confidentiality training form part of remediation?
Yes, where it addresses the specific learning need. It is strongest when combined with reflection, changed practice and evidence such as an authorised access audit or feedback.
Can I use patient cases in my remediation evidence?
Only in line with your organisation's and regulator's requirements for anonymisation and information governance. Removing a name is not enough, as combinations of details can identify someone. If unsure, ask your information governance lead first.
Does confidentiality remediation differ between UK regulators?
Yes. Professional confidentiality standards vary by regulator, and employers have their own information governance policies. The ICO is the authoritative source for UK data protection law.
Sources for this guide
This guide draws on published professional standards and data protection guidance. Naming a regulator does not imply that it endorses IRR Practice or its courses.
Law and guidance change. Always check current guidance from your regulator, the ICO and your organisation.
- ICO Guidance on special category data and lawful basis under the UK GDPRAuthoritative source for UK data protection law
- GMC Confidentiality: good practice in handling patient informationCurrent published version
- NMC The Code, standard 5Current published version
- HCPC Standards of conduct, performance and ethicsCurrent published version
- National Data Guardian The Caldicott PrinciplesHealth and care in England
Take the next step in your confidentiality remediation
More from the IRR Practice blog
Practical articles on fitness to practise, insight, reflection, remediation and each UK regulator.
Dr Anthony Whitfield
Writes for IRR Practice on professional standards, fitness to practise, insight, reflection and remediation for UK healthcare professionals.
Last reviewed: September 2026