You must respect and protect patient information.²⁴⁶ See section on Patient records.

Patients must consent before you share any information about them. See section on Consent. When asking for consent you should tell the patient:

1. what information you want to share
2. who you want to share it with
3. how the information will be used.^{247, 248}

Anyone you employ must also protect patient information.

You must keep confidential all patient identifiable information, including information which is handwritten, digital, visual, audio or retained in your memory and this includes:

1. clinical information about a patient’s diagnosis or treatment
2. when the patient attended the practice
3. anything else that can be used to identify patients directly or indirectly, especially if combined with the patient’s name or address full postcode or date of birth.

If an adult patient with capacity tells you not to share information with other people, you should firstly discuss this with them, and explain why you need to share the information. If they still refuse, you should not share their information, even if failure to share would leave the patient (but no one else) at risk of serious harm or death. If you believe that the patient’s decision to refuse a service puts them at risk of serious harm, you must discuss this issue with appropriate colleagues,²⁴⁹ whilst respecting the patient’s confidence.²⁵⁰ This can be done by discussing the case in general without revealing details which may identify the patient. You can share patient identifiable information if you are required to do so by law, or disclosure is justified in the public interest.

There are exceptions to the rule of protecting patients’ confidentiality which are:

1. you may be required to provide information by law, for example if ordered by a court 
2. you may need to disclose information if it is in the public interest, for example where failing to disclose information would expose other members of the public to risk of death or serious harm.^{251, 252, 253}

You may disclose information without patient consent if you have reason to believe that asking for consent would put you or other people at risk of serious harm.²⁵⁴