Confidentiality and consent


The purpose of the Policy is to set out the obligations for all working at Horizon Health Centre concerning the confidentiality of information held about patients and Horizon Health Centre.

This protocol is relevant to all employers and anyone who works at Horizon Health Centre including non-clinical staff. Individuals on training placements and visitors/observers on the premises must also adhere to this.

This protocol will be reviewed annually to ensure that it remains effective and relevant.

Importance of confidentiality

Confidentiality is a fundamental part of health care and crucial to the trust between doctors and patients. Patients entrust their practice with sensitive information relating to their health and other matters in order to receive the treatment and services they require. They should be able to expect that this information will remain confidential unless there is a compelling reason why it should not. All staff in the NHS have legal, ethical and contractual obligations of confidentiality and must ensure they act appropriately to protect patient information against improper disclosure.

Some patients may lack the capacity to give or withhold their consent to disclosure of confidential information but this does not diminish the duty of confidence. The duty of confidentiality applies to all patients regardless of race, gender, social class, age, religion, sexual orientation, appearance, disability or medical condition.

Information that can identify individual patients must not be used or disclosed for purposes other than healthcare unless the patient (or appointed representative) has given explicit consent, except where the law requires disclosure or there is an overriding public interest to disclose. All patient identifiable health information must be treated as confidential information, regardless of the format in which it is held. Information which is effectively anonymised can be used with fewer constraints.
The confidentiality of other sensitive information held about the practice and staff must also be respected.

Obligations for all staff

All staff must:

1) Always endeavour to maintain patient confidentiality;
2) Not discuss confidential information with colleagues without patient consent (unless it is part of the provision of care);
3) Not discuss confidential information in a location or manner that allows it to be overheard;
4) Handle patient information received from another provider sensitively and confidentially;
5) Not allow confidential information to be visible in public places;
6) Store and dispose of confidential information in accordance with the Data Protection Act 1998 and the Department of Health’s Records Management Code of Practice (Part 2);
7) Not access confidential information about a patient unless it is necessary as part of their work;
8) Not remove confidential information from the premises unless it is necessary to do so to provide treatment to a patient, the appropriate technical safeguards are in place and there is agreement from the information governance lead or Caldicott Guardian;
9) Contact the information governance lead or Caldicott Guardian if there are barriers to maintaining confidentiality;
10) Report any loss, inappropriate storage or incorrect disclosure of confidential information to the information governance lead or Caldicott Guardian;
11) If applicable, document, copy, store and transfer information in the ways agreed with other providers (see Annex 1);

It is expected that members of staff will comply with the law and guidance/codes of conduct laid down by their respective regulatory and professional bodies.

Information disclosures:

When a decision is taken to disclose information about a patient to a third party due to safeguarding concerns/public interest, the patient should always be told and asked for consent before the disclosure unless it would be unsafe or not practical to do so.

In the circumstances that consent cannot be sought, then there must be clear reasons and necessity for sharing the information.

Disclosures of confidential information about patients to a third party must be made to the appropriate person or organisation and in accordance with the principles of the Data Protection Act 1998 (Annex 1), the NHS Confidentiality Code of Practice (see below) and the GMC’s Good Medical Practice.

Obligations for employers

The employers at the practice must:

1) Ensure that confidential information can be stored securely on the premises and that there are processes in place to guarantee confidentiality;
2) Make sure that all individuals to whom this protocol is relevant have read, understood and signed this protocol;
3) Review and update this protocol on a regular basis.



The purpose of this protocol is to set out the Horizon Health Centre’s approach to consent and the way in which the principles of consent will be put into practise. It is not a detailed legal or procedural resource due to the complexity and nature of the issues surrounding consent.

Where possible, a clinician must be satisfied that a patient understands and consents to a proposed treatment, immunisation or investigation. This will include the nature, purpose, and risks of the procedure, if necessary by the use of drawings, interpreters, videos or other means to ensure that the patient understands, and has enough information to give ‘Informed Consent’.

For more information click here:

Implied Consent

Implied consent will be assumed for many routine physical contacts with patients. Where implied consent is to be assumed by the clinician, in all cases, the following will apply:
• An explanation will be given to the patient what he / she is about to do, and why.
• The explanation will be sufficient for the patient to understand the procedure.
• In all cases where the patient is under 18 years of age a verbal confirmation of consent will be obtained and briefly entered into the medical record.
• Where there is a significant risk to the patient an “Expressed Consent” will be obtained in all cases (see below).

Expressed Consent

Expressed consent (written or verbal) will be obtained for any procedure which carries a risk that the patient is likely to consider as being substantial. A note will be made in the medical record detailing the discussion about the consent and the risks.

Obtaining Consent

• Consent (Implied or Expressed) will be obtained prior to the procedure.
• The clinician will ensure that the patient is competent to provide a consent (16 years or over) or has Fraser Guidelines (formally “Gillick Competence”) if under 16 years. Further information about Fraser Guidelines and obtaining consent for children is set out below.
• Consent will include the provision of all information relevant to the treatment.
• Questions posed by the patient will be answered honestly, and information necessary for the informed decision will not be withheld unless there is a specific reason to withhold. In all cases where information is withheld then the decision will be recorded in the clinical record.
• The person who obtains the consent will be the person who carries out the procedure (i.e. a nurse carrying out a procedure will not rely on a consent obtained by a doctor unless the nurse was present at the time of the consent).
• The person obtaining consent will be fully qualified and will be knowledgeable about the procedure and the associated risks.
• The scope of the authority provided by the patient will not be exceeded unless in an emergency.
• The HHC acknowledges the right of the patient to refuse consent, delay the consent, seek further information, limit the consent, or ask for a chaperone.
• Clinicians will ensure that consents are freely given and not under duress (e.g. under pressure from other present family members etc.).
Other aspects which may be explained by the clinician include:

• Details of the diagnosis, prognosis, and implications if the condition is left untreated
• Options for treatment, including the option not to treat.
• Details of any subsidiary treatments (e.g. pain relief)
• Patient experiences during and after the treatment, including common or potential side effects and the recovery process.
• Probability of success and the possibility of further treatments.
• The option of a second opinion


Informed consent must be obtained prior to giving an immunisation. There is no legal requirement for consent to immunisation to be in writing and a signature on a consent form is not conclusive proof that consent has been given, but serves to record the decision and discussions that have taken place with the patient, or the person giving consent on a child’s behalf.

Consent for children

Everyone aged 16 or more is presumed to be competent to give consent for themselves, unless the opposite is demonstrated. If a child under the age of 16 has “sufficient understanding and intelligence to enable him/her to understand fully what is proposed” (known as Fraser Guidelines), then he/she will be competent to give consent for him/herself.
When consent is not necessary
There are a few exceptions when treatment can go ahead without consent.
Where an adult patient does not have the capacity to give or withhold consent to a significant intervention, this fact should be documented in Mental Capacity Assessment Form (Appendix 1); why the health professional believes the treatment to be in the patent’s best interests, and the involvement of people close to the patient.

The standard consent forms should never be used for adult patients unable to consent for themselves. For more minor interventions, this information should be entered in patient notes.

An apparent lack of capacity to give or withhold consent may in fact be the result of communication difficulties rather than genuine incapacity. You should involve appropriate colleagues in making such assessments of incapacity, such as specialist learning disability teams and speech and language therapists, unless the urgency of the patient’s situation prevents this. If at all possible, the patient should be assisted to make and communicate their own decision, for example by providing information in non-verbal ways where appropriate