If you disclose information about a patient, you must:

1. be satisfied that the patient:
   • has been informed that their personal information might be disclosed for the sake of their own care, or for local clinical audit, and that they can object
   • has not objected
2. get the patient’s consent if identifiable information is to be disclosed for purposes other than their care or local clinical audit, unless the disclosure is required by law or can be justified in the public interest. The public interest is unlikely to be justified if the same purpose can be achieved with anonymised information
3. keep disclosures to the minimum
4. observe all relevant legal requirements, including the common law and data protection legislation 
5. be able to justify why you disclosed the information
6. keep a record of when you disclose information, what you disclose, and to whom.

If you, or others, wish to use patient identifiable information for teaching or research purposes, for example patient photographs, you must apply the principles in this guidance by:

1. gaining patient consent
2. making sure the patient understands what they are consenting to and how the information will be used
3. only using or releasing the minimum information that is necessary for the purpose.

If you are using or disclosing information which does not require patient identifiable information, you should use anonymised or coded information, for example in clinical audit or for reporting quality measures.

Improper disclosures can be unintentional. You should not:

1. share identifiable information about patients where you can be overheard, for example in the practice reception area, a public place or in an internet chat forum
2. share passwords or leave patient records, either on paper or on screen, unattended or where they can be seen by other patients, unauthorised practice staff, or the public.

Employers must make sure staff are trained to avoid improper disclosures.