Confidentiality and Privacy

#Related but distinct ideas

Confidentiality is the duty to protect information entrusted within a relationship, such as information shared during healthcare. It concerns who may receive that information and under what circumstances. Professional duties, employment obligations and law can all shape what confidential handling requires in a particular setting.

Information privacy is broader. It concerns how personal information is collected, used, stored, shared and deleted, and what rights people have over those activities. Privacy questions can arise before a clinical relationship begins and can involve organisations or systems that do not directly provide care.

#Appropriate use and protection

Confidentiality does not mean that information can never be shared. Relevant information may need to move between people involved in care or for other lawful purposes. Sharing should have an appropriate basis, a clear purpose and limits suited to the sensitivity and context of the information.

Practical protections include limiting access by role, checking recipients, securing communications and keeping records of access where appropriate. Collecting only necessary information and setting justified retention periods can also reduce risk. Technical security supports privacy, but secure storage does not make an unnecessary or unjustified use acceptable.

#Rights, exceptions and transparency

Privacy laws may provide rights to receive explanations, access records, seek corrections or object to certain uses. These rights and their exceptions differ by jurisdiction. Consent is one possible basis for handling information, but it is not the only basis and may not be appropriate for every activity.

Some circumstances permit or require disclosure without agreement, including specific legal duties or serious safety concerns. The applicable threshold depends on law and context. Clear explanations of routine uses, possible disclosures and complaint routes help people understand the boundaries of confidentiality without promising that information will never be shared.

#Common misunderstandings

Confidentiality does not always mean that information stays between one patient and one clinician. Relevant details may be shared with other people involved in care, subject to applicable rules and safeguards. Equally, working in a healthcare organisation does not automatically entitle someone to view every record.

Privacy is not only about keeping diagnoses secret. Names, contact details, appointment messages, photographs and information about family circumstances can also reveal personal matters. Even information without a name may sometimes identify someone when combined with other details.

Consent is important, but it is not the only possible basis for handling or disclosing health information. Requirements vary by location and circumstances, and some disclosures may be permitted or required without consent.

Another misunderstanding is that strong security guarantees confidentiality. Passwords and protected systems help, but appropriate access, careful conversations, staff practices and clear accountability matter too. A secure system can still be used inappropriately.

#Questions worth asking a clinician

• Who on your team can access what I tell you, and how do you decide who needs to know?
• When might you be required to share my confidential information without my permission?
• How is my personal information collected, stored, and protected in your records system?
• Will you ask my permission before sharing my information for research, teaching, or purposes unrelated to my care?
• How can I access my records, request corrections, or raise concerns about how my information has been handled?