Your browser is no longer supported

For the best possible experience using our website we recommend you upgrade to a newer version or another browser.

Your browser appears to have cookies disabled. For the best experience of this website, please enable cookies in your browser

We'll assume we have your consent to use cookies, for example so you won't need to log in each time you visit our site.
Learn more

HCAs and patient confidentiality


Patients have the right to confidentiality from all healthcare professionals, including HCAs, reports Adrian O’Dowd

Patient confidentiality is a fundamental part of health care that should be at the heart of everything that HCAs and all NHS staff do.

The concept of confidentiality is enshrined in law, NHS codes and contracts of employment. It is guaranteed by both common law - the decisions of the courts - and statute law, which is passed by Parliament. It is also an underlying part of professional practice that protects human rights, as spelled out in the European Convention of Human Rights.

The common law of confidentiality says that people have a right to expect that information given to a healthcare professional is only used for the reason it was given but also that it will not be disclosed without permission.
People have the right to control access to their own personal health information, which means healthcare professionals cannot discuss matters relating to patients outside the clinical setting, nor discuss a case in public where they could be overheard, nor leave records unattended where they may be read by others.

Martine Tune, NMC professional adviser (nursing), who is lead officer on patient confidentiality and the nurses and midwives’ code of conduct, says: ‘A patient wants to walk into a healthcare setting and know that any information they give to the person they are dealing with when receiving a service about their health is for the purposes of that service being delivered and not for any other purpose.

‘That is so they can have trust and confidence in the people who are giving them the service. A patient should be certain that, whatever their  issues are, they won’t be shared with anybody else unnecessarily. That’s a basic right of every patient.’

The rules

All healthcare professionals are bound by the common duty law of confidence.

Ms Tune says: ‘Anyone entering health, social care or any other aspect of professional practice knows this duty is absolute and there are a range of bodies that regulate and have explicit responsibility for ensuring that confidentiality is in place.

‘Bodies like the new Care Quality Commission and PCTs have got responsibilities to make sure confidentiality is in place in their organisations.’

HCAs need to be aware of legislation that relate to confidentiality. These include: the Data Protection Act 1998, which governs the processing of information; the Human Fertilisation and Embryology Act 1990, which regulates reproductive technology services and bans the disclosure of information concerning donors and people receiving treatment; the Mental Capacity Act 2005, which provides a legal framework to empower and protect those who may lack capacity to make decisions. Ms Tune points out many support workers are also covered by NHS codes of practice.

‘There is a code of practice on confidentiality and it is regarded as an authoritative source of information,’ she says. ‘Healthcare support workers are also covered by their contract of employment. I don’t know of any contract that does not include a confidentiality clause.’


Disclosure, or giving information, is only considered lawful and ethical if the individual has given full and explicit consent to it being passed on, whether verbally or in writing.

‘Disclosure of information is for the purposes of services and for the protection of that person to ensure they receive the service or care that they need,’ Ms Tune explains.

Consent to disclosure of information can also be implied - when it is assumed the person in the care of a healthcare professional understands that information may be shared within the healthcare team - required by law or be justified by reason of ‘the public interest’.

The latter enables staff to disclose information to prevent, or to support detection, investigation and punishment of serious crime and/or to prevent abuse or serious harm to others, in cases such as rape, child abuse, or murder.

The Police and Criminal Evidence Act (1984) allows healthcare professionals to pass on information to the police if they believe that someone may be seriously harmed or death may occur if the police are not informed.
No one should have to make these decisions by themselves and it is always advisable to gain advice and support before making decisions of this nature.

Ms Tune advises HCAs to consult nurses or other professionals if they have concerns.

While the NMC’s code of conduct does not apply to HCAs, Ms Tune hopes HCAs look at it and try to follow the spirit of the code.

‘I would like to think that in the workplace, registered and unregistered nurses discuss these things because they are working in a team.’

Click here for NMC guidance on confidentiality


Readers' comments (7)

  • i am a 51 year old male nurse with 35 years experience in nursing. I am currently being investigated for breach of patient confidentiality on FaceBook. Am I alone in making the mistake of assuming that my so called "private chat" wasn't private at all? I made some silly comments during a time of upset and anxiety using patients first names. I also assumed that when I deleted my chat history - which I did almost daily, that one to one chat dissapeared completely......that apparently isn't so. At what point does the NHS provide a hard hitting policy on social networking sites and their use? I have seen guidance only. So - 35 years of good nursing is under severe threat because I did not understand the lack of privacy on a social site. That seems extremely unfair. I love my job.

    Unsuitable or offensive? Report this comment

  • michael stone

    Just to be clear about this, in case it it appears otherwise from the piece above.

    The Mental Capacity Act is a very uneasy bedfellow with the concept of Patient Confidentiality in many situations, and if you read the first six sections of the MCA, the ones which address best interests decision making, you won't find any reference to patient confidentiality.

    There is mention of patient confidentiality in the Code of Practice, but no clear explanation as to how one works around the apparent paradox that the section 4 test 'always starts by asking a decision maker 'can I work out what the patient would say to me, if I could somehow ask him'', if the patient has never been asked directly - in that situation, you cannot logically do other than to ask 'people who really know the patient' the question 'Faced with these clinical prognoses, do you think you know what he would decide he wanted to happen ?'.

    You cannot ask the question, without describing the clinical prognoses: but you have to ask the question, it appears, in order to claim that you have properly considered section 4(6).

    This is one of several problems, plaguing the behaviour of clinicians when the MCA comes into play - at the moment, it is invariably fudged (the current version of the Joint CPR Guidance contains an explicit paradox for that conflict).

    I would add, that nurses seem to be in a more 'stressful position' re MCA issues than are doctors, because of the pseudo-legal hierarchies that section 42 allows to be created. It needs sorting out, properly !

    Unsuitable or offensive? Report this comment

  • michael stone

    spcBritAm | 20-Oct-2011 2:44 pm

    I have some sympathy with you, but I'm not a user of facebook nor am I familiar with NHS guidance in that area.

    However, if you only used first names, and did not post anything that could connect your comment to a particular patient, I cannot see where you have breached patient confidentiality.

    In fact, unless whoever is investigating you can tell you the name of the patient involved, then I would say to the investigator 'I cannot reveal the details of the specific patient, because that would breach my duty of patient confidentiality'.

    But I should point out, that my analytical acuity has been known to cause offence - however, I don't see how you can breach patient confidentiality if it is not possible to identify the particular patient involved(that doesn't necessarily mean the NHS agrees with me - I often find 'the NHS' does not agree with me !).

    Unsuitable or offensive? Report this comment

  • It never fails to amaze me that people simply do not understand that social networking is exactly that - SOCIAL. It is no more confidential than having a loud conversation in a public place or pinning something on a noticeboard or sending a postcard that anyone can pick up and read.

    Unsuitable or offensive? Report this comment

  • can someone please tell me the year this article was written in please?

    Unsuitable or offensive? Report this comment

  • Yes I would also like to know, but I dont want to subscribe

    Unsuitable or offensive? Report this comment

  • You should have known better than to go on Facebook and bad mouth patients. You say that you have 35 years of nursing so why did you not know the strict rules of confidentiality? You should have known that nothing on Facebook is private. I hope that all went well for you but as a nurse manager myself if I were the investigator and I found that you were guilty as charged I would have dismissed you and probably report you to the NMC.

    Unsuitable or offensive? Report this comment

Have your say

You must sign in to make a comment

Please remember that the submission of any material is governed by our Terms and Conditions and by submitting material you confirm your agreement to these Terms and Conditions. Links may be included in your comments but HTML is not permitted.