X | @rali2100 - Linkedin|R Ali
Created: 2025-10-15
These principles are the foundation for every decision you make when a third party calls. They are derived from GMC guidance, the Data Protection Act 2018 (incorporating UK GDPR), and common law.
Duty of Confidentiality: This is the default position and your paramount duty. The duty is owed to the patient, not to their family or society. It does not cease on the patient's death. You cannot disclose any information about a patient without their explicit consent, unless there is a legal or overwhelming public interest justification.
Consent: For any information to be shared, the patient must give their consent. This consent must be voluntary, informed, and the patient must have the capacity to make that decision. For practical purposes in a GP practice, consent should be explicit and documented.
Mental Capacity: An adult is always presumed to have capacity to make their own decisions unless it is established that they lack it. The Mental Capacity Act 2005 (MCA) applies in England and Wales.1 A person lacks capacity if they have an impairment of the mind or brain and, because of it, cannot do one or more of the following: understand, retain, use or weigh the relevant information, or communicate their decision. This assessment is decision-specific.
Best Interests: If an adult patient is assessed as lacking the capacity to consent to information sharing, any decision made on their behalf (including whether to share information with a relative) must be made in their 'best interests' as defined by the MCA.2 This is not the same as what the family wants; it is a holistic assessment of what is best for the patient.
Parental Responsibility: For children, decisions are typically made by those with Parental Responsibility (PR). This gives them the right to access their child's records and be involved in decisions. However, this right is not absolute and diminishes as the child gains competence.
Gillick Competence: A child under 16 may have the capacity to consent to their own medical treatment and to control the confidentiality of their information, without parental knowledge or consent.3 This is known as being Gillick competent. It requires that the child has sufficient maturity and understanding of what is being proposed.
Your approach must be tailored to the patient in question.
A. Calls Concerning Adults (18 years and over)
Adults with Capacity:
Default Position: You must not share any information without explicit, verified consent from the patient. This includes confirming appointments, sharing results, or discussing their health.
Receiving Information: You can, and often should, listen to the concerns of a third party. This can provide vital clinical information. The correct response is: "Thank you for providing that information. I cannot discuss [patient's name]'s care with you, but I will make a note of your concerns in their record and ensure they are seen by the appropriate clinician."
Obtaining Consent: It is good practice to proactively ask patients if they consent to you speaking with specific individuals. This consent must be documented clearly in the medical record, stating who you can speak to and what information can be shared (e.g., "Patient consents to us speaking to wife, Mrs Jane Smith, about blood results only").
Adults Lacking Capacity:
First, establish lack of capacity: This must be a formal assessment for the specific decision at hand (i.e., consenting to share information). Document this assessment.
Check for Legal Proxies: Does the patient have a Lasting Power of Attorney (LPA) for Health and Welfare? If so, the attorney is the decision-maker and you can (and should) communicate with them. You must verify the LPA is registered.
Best Interests Decision: If there is no LPA, you must make a decision in the patient's best interests. This involves consulting with family members and carers to understand the patient's likely wishes, beliefs, and values. However, the final decision to share information rests with the clinician, not the family. You must weigh the benefits of sharing (e.g., better care coordination) against the harms (e.g., loss of privacy, potential distress). Document your reasoning thoroughly.
B. Calls Concerning Children and Young People (under 18)
This is more complex and depends on the child's age and maturity.
Young Children (e.g., under 12-13):
You can generally share information with individuals who hold Parental Responsibility (PR).
It is crucial to verify the caller has PR. Do not assume. The mother always has PR. The father has it if he was married to the mother or is named on the birth certificate (after 1st December 2003 in England/Wales).
Be cautious in cases of family breakdown or safeguarding concerns. Information should only be shared if it is in the child's best interests.
Adolescents and Gillick-Competent Children:
As children mature, their right to confidentiality grows. Your duty of confidentiality is to the young person, not the parent.
If a young person is deemed Gillick competent for a particular issue, their consent is required to share information with their parents. They can also refuse consent.
For 16- and 17-year-olds, the law presumes they have the capacity to consent to their own medical treatment. This strengthens the argument for respecting their confidentiality.
When a parent calls about a teenager, the safest approach is to say: "To respect the confidentiality of all our patients, including young people, I cannot discuss this with you directly. The best thing is to encourage your son/daughter to make an appointment to speak with us themselves."
Caller Identification: How do you know the caller is who they say they are? A practice should have a system (e.g., confirming multiple demographic details) before even considering sharing information.
Coercion and Domestic Abuse: A request for information can be a form of coercive control. Sharing information could put the patient at serious risk. Be extremely vigilant if a partner or family member seems overly insistent.
Weaponising Information: In acrimonious family separations, one parent may seek medical information to use against the other in legal proceedings. Your duty is to the child's welfare, not to either parent's legal case.
Documentation: Failure to document the call, your decision-making process, and the rationale for sharing (or not sharing) information is a significant medicolegal risk. Every such interaction must be recorded in the patient's notes.
Reception Staff: Your administrative staff are on the frontline. They are often pressured by callers and may not be fully aware of the medicolegal complexities. They need robust training and clear, unambiguous protocols to follow. They should never be making the decision to share clinical information. Their role is to take a message and pass it to a clinician.
Develop a Clear Protocol: Create a written practice policy on handling third-party calls, covering all the scenarios above.
Train All Staff: Regular, mandatory training for both clinical and non-clinical staff is essential. Use scenarios and role-play.
Implement a Consent System: Proactively record patients' sharing preferences in a designated, easily visible place in the electronic record.
Empower Reception Staff: Provide them with clear, supportive scripts to manage difficult conversations. For example: "Our practice policy, which is in place to protect every patient's confidentiality and safety, means I cannot give you that information. I can take a message and pass it to the doctor."
Listen, Don't Tell: Adopt this as a mantra. You can almost always listen to what a caller has to say, but you can almost never share information without verified, documented consent.
All the rules, guidance, and laws you must navigate when a third party calls are built upon the interplay of three core, and sometimes conflicting, first principles.
Principle 1: The Trust Imperative
Fundamental Truth: Medicine cannot function without trust.
Deconstruction: Why do we have confidentiality? It is not an arbitrary rule of professional etiquette. It is the absolute bedrock of the doctor-patient relationship. A patient will only reveal the necessary, often sensitive, information required for a safe and accurate diagnosis if they have an absolute assurance that this information will not be disclosed without their permission. If this assurance is broken, patients will withhold information. If information is withheld, diagnoses will be missed, treatments will be incorrect, and patients will be harmed. Therefore, confidentiality is not simply a patient's right; it is a functional necessity for a safe healthcare system.
System Implication: Your default position for any external request must be to protect confidentiality, not as a matter of policy, but as a matter of protecting the integrity of the entire medical system.
Principle 2: The Sovereignty of the Individual (Autonomy)
Fundamental Truth: A person with capacity is the sole authority over their own body and their personal information.
Deconstruction: We start from the premise that an adult is a sovereign individual. They own their body, their thoughts, and the data about them. Medical treatment is an intervention on that body, and sharing information is a transaction of that data. Neither can happen without the explicit, informed permission of the sovereign owner. This is not something a doctor 'grants'; it is a fundamental right the doctor must respect. Consent is the mechanism by which the individual temporarily permits an intervention into their sovereign domain.
System Implication: Any action, from a blood test to a conversation with a relative, is an intrusion that requires justification. The only valid justification for a capable adult is their consent. The question is never "Why shouldn't I share this information?"; it is "By what authority am I permitted to share this information?".
Principle 3: The Duty to Protect from Harm (Beneficence & Non-Maleficence)
Fundamental Truth: A clinician's primary purpose is to prevent harm and promote well-being.
Deconstruction: This principle is the active agent in medicine; it is the reason doctors exist. It compels you to act. Normally, this duty aligns with autonomy (Principle 2) because the patient consents to actions that prevent them from harm. The conflict arises when a patient cannot exercise their autonomy, or when exercising their autonomy would lead to harm to others.
System Implication: This is the principle that creates and governs all the exceptions.
Incapacity: If an individual loses their sovereignty (lacks capacity, Principle 2), the Duty to Protect (Principle 3) becomes paramount. You then act in their 'best interests', a process designed to construct a decision that best prevents harm and promotes their well-being.
Childhood: A child is a sovereign-in-development. 'Parental Responsibility' is a legal construct that temporarily entrusts the Duty to Protect (Principle 3) to parents, on the assumption they will act in the child's best interests. Gillick competence is the point at which the child's own sovereignty (Principle 2) is mature enough to retake its primary position.
Public Interest: In very rare cases, an individual's right to sovereignty over their information (Principle 2) is overridden by the duty to protect the wider community from serious harm (Principle 3).
Every third-party call you receive is a test of how you balance these three principles.
A relative calls about an adult patient. Principle 2 (Sovereignty) is immediately invoked. You have no authority to act without the patient's consent. Upholding this strengthens Principle 1 (Trust).
A parent calls about a young child. Principle 3 (Duty to Protect) is invoked, via the proxy of parental responsibility. You share information to enable the parent to fulfil their duty of care.
A parent calls about a 15-year-old requesting contraception. Now Principle 2 (Sovereignty), in the form of Gillick competence, competes with Principle 3 (Duty to Protect) as exercised by the parent. The guidance prioritises the young person's burgeoning sovereignty to ensure they are not harmed by avoiding medical care for fear of disclosure (which upholds Principle 1).
A daughter calls, deeply concerned that her elderly father with dementia is not taking his medication. The patient cannot exercise Principle 2 (Sovereignty). Your Principle 3 (Duty to Protect) is activated. Listening to the daughter is essential to fulfilling this duty, and sharing information with her may be justified as part of a 'best interests' decision to prevent him from harm.
By deconstructing the situation to these truths, you are no longer just following a flowchart. You are reasoning from the foundational logic of medicine and law, allowing you to handle any novel situation with clarity and confidence.