## Learning Outcomes

- Understand what confidentiality means in health and social care practice
- Identify how UK GDPR and the Data Protection Act 2018 protect personal information
- Explain the difference between protecting information and sharing it for safe care
- Recall and apply the eight Caldicott Principles to healthcare scenarios
- Describe safe ways to manage paper records, digital records, and information sharing
- Recognise common breaches of confidentiality and how staff should respond

## T Level Health (Core) Syllabus

For the T Level Health (Core), you are expected to understand confidentiality, data protection, and information-sharing in healthcare, with a focus on the following syllabus points:

- Know that personal information in healthcare must be collected, stored, used, and shared lawfully and securely
- Identify the seven UK GDPR principles, including data minimisation, accuracy, storage limitation, and accountability
- Understand that health data is especially sensitive and requires extra protection
- Explain when information should remain confidential and when it may need to be shared for direct care, safeguarding, legal duty, or emergencies
- Know the eight Caldicott Principles and how they guide practical decisions in health and social care
- Identify the meaning of a need-to-know basis and why staff must only access relevant information
- Understand the role of organisational policies, secure record keeping, and breach reporting
- Recognise the role of a Caldicott Guardian in advising on confidentiality and information sharing

## Test Your Knowledge

_Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, look more closely at that area during your revision._

1. What is the difference between personal data, confidential information, and health data?
2. Why is consent not always the main legal basis for using information in direct care?
3. Name three of the UK GDPR principles.
4. What does the Caldicott Principle about a need-to-know basis mean in practice?
5. Give two examples of a confidentiality breach in a healthcare setting.

## Introduction

Managing personal information is a basic part of safe healthcare. Staff collect details about symptoms, diagnoses, medicines, family circumstances, allergies, and many other parts of a person’s life. That information helps professionals give the right care, but it also creates risk if it is seen, discussed, or shared in the wrong way.

For the exam, you need more than a simple idea that information should be “kept private”. You need to understand how **confidentiality**, **UK GDPR**, the **Data Protection Act 2018**, and the **Caldicott Principles** work together. You also need to apply them to realistic situations, such as handovers, safeguarding concerns, wrong emails, unlocked screens, or requests for records.

> **Key Term: confidentiality**
> Keeping private information secure and only sharing it with people who have a proper reason to know it.

### What information is protected and why the distinction matters

In health settings, students often treat all information as one single category. Exams may test whether you can separate different kinds of information clearly.

**Personal data** is any information that identifies a living person, directly or indirectly. This includes a name, NHS number, address, date of birth, email address, and sometimes location or online identifiers.

**Health data** is more sensitive. It includes diagnosis, symptoms, treatment, test results, mental health information, and care records. This is treated as **special category data**, so it needs extra protection.

Confidential information is slightly different again. It is information a person would reasonably expect to be kept private. In healthcare, many records are both personal data and confidential information. That means staff must think about both data protection law and professional confidentiality.

> **Key Term: personal data**
> Information relating to an identified or identifiable living person.
>
> **Key Term: special category data**
> More sensitive personal data that needs extra protection, including health data.
>
> **Key Term: confidential information**
> Information given in circumstances where privacy is expected and which should not usually be disclosed without good reason.

This distinction matters because a healthcare worker may process data lawfully under UK GDPR but still breach confidentiality if they share it inappropriately. For example, a nurse may be allowed to access a patient file for direct care, but if they later discuss the case loudly in a café, that is a confidentiality breach even though the original access was proper.

The reason healthcare collects information is practical, not optional. Without it, diagnosis may be wrong, treatment unsafe, and continuity of care poor. If a patient has a penicillin allergy and that is not accurately recorded and shared, the result could be serious harm. So information must be protected, but it must also be available to the right people at the right time.

> **Test Tip:** If a question asks why records matter, do not stop at “privacy”. Link records to safe diagnosis, correct treatment, continuity of care, safeguarding, and legal accountability.

### How UK GDPR and the Data Protection Act 2018 protect information

The **Data Protection Act 2018** brings UK GDPR rules into UK law. In practice, this framework controls how organisations collect, store, use, and share personal data.

The seven UK GDPR principles are central exam knowledge:

- lawfulness, fairness and transparency
- purpose limitation
- data minimisation
- accuracy
- storage limitation
- integrity and confidentiality
- accountability

A strong answer does not just list them. It explains what they mean in healthcare.

**Lawfulness, fairness and transparency** means organisations must have a proper reason for processing data and should be open about how it is used. Patients should not be left guessing why information is being collected.

**Purpose limitation** means data should only be used for the reason it was collected. If a GP practice collects details for treatment, that does not mean staff can casually use them for unrelated purposes.

**Data minimisation** means collecting and sharing only what is necessary. If a physiotherapist only needs mobility notes, they do not need irrelevant details from the whole record.

**Accuracy** matters because incorrect information can directly harm patients. A wrong dose, wrong allergy record, or outdated address can all create risk.

**Storage limitation** means records should not be kept longer than necessary. Old records must not simply pile up forever without reason.

**Integrity and confidentiality** means information must be secure, whether paper or digital.

**Accountability** means organisations must be able to show they are following the rules, not just claim that they are.

> **Key Term: UK GDPR**
> The legal framework that sets rules for how personal data must be processed lawfully, fairly, securely, and transparently.
>
> **Key Term: accountability**
> The duty to show and record that data protection rules are being followed.

One point students often miss is that consent is not always the main legal basis for using information in direct care. In health and social care, information is often processed because care providers have a public task, legal duty, or need to protect the person’s vital interests in emergencies. That is why “the patient did not sign a consent form” does not automatically mean information cannot be used for their treatment.

But that does not mean staff can ignore the person. Good practice still involves informing patients how their information is used and respecting objections where appropriate.

A patient also has rights over their information, including the right to be informed, right of access, and right to have inaccurate information corrected. If a living patient asks to see their records, this is usually done through a **Subject Access Request**.

> **Key Term: Subject Access Request (SAR)**
> A request made by a living person to access personal information held about them.

### Confidentiality, lawful sharing, and the common mistakes students make

A major exam distinction is this: **data protection law** and the **duty of confidentiality** are linked, but they are not identical.

Confidentiality is based on trust. Patients tell professionals deeply private things because they expect that information to be protected. If that trust is broken, patients may withhold information or avoid care. That can make treatment less safe.

However, confidentiality is not absolute. Information may need to be shared when:

- it is necessary for direct care
- there is a safeguarding concern
- there is a legal obligation
- there is a serious public interest reason
- there is an emergency and sharing protects life

This is where students sometimes become too rigid. “Never share without consent” is not a safe healthcare rule. If a child is at risk of serious harm, or an unconscious patient arrives in A&E, waiting for consent could itself be dangerous.

The key question is not simply “Can I share this?” but “Why am I sharing it, who needs it, and what is the minimum necessary?”

For direct care, sharing within the care team is often expected. A handover on a ward, a referral from GP to specialist, or a pharmacist checking allergies before dispensing medicine are all examples of proper sharing. But even then, only relevant information should be shared.

A friend asking you to check their partner’s sexual health record “just in case” is not direct care. It is curiosity and misuse.

> **Key Term: direct care**
> Activities directly involved in a person’s diagnosis, treatment, care, or support.
>
> **Key Term: need-to-know basis**
> Information should only be accessed or shared with people who genuinely need it for their role in the person’s care or safety.

The need-to-know rule is practical. It stops “just looking” at records, gossiping, or sharing excessive detail. For example:

- A receptionist may need appointment and contact details, but not necessarily full clinical notes.
- A district nurse may need wound care information, but not unrelated historic information unless it affects treatment.
- A student on placement should only access records under proper supervision and for legitimate tasks.
  > **Test Tip:** In scenario questions, always explain both sides: why confidentiality matters and why sharing may still be necessary. High marks come from balanced judgement, not extreme rules.

### The Caldicott Principles and how to apply them in practice

The Caldicott Principles were first developed after a review of patient information handling in the NHS, chaired by Dame Fiona Caldicott. They remain a major guide for day-to-day decision-making in health and social care. The current framework contains eight principles:

1. Justify the purpose for using confidential information.
2. Do not use confidential information unless it is necessary.
3. Use the minimum necessary confidential information.
4. Access should be on a strict need-to-know basis.
5. Everyone with access should understand their responsibilities.
6. Comply with the law.
7. The duty to share can be as important as the duty to protect confidentiality.
8. Inform patients and service users how their information is used.
   > **Key Term: Caldicott Principles**
   > Eight principles used in health and social care to guide the safe, lawful, and proportionate use of confidential information.

Students often remember Principles 1, 3, and 4, but Principle 7 is just as important. It corrects a common mistake in healthcare: not sharing when sharing is needed for safe care. If a professional withholds relevant information because they are overly cautious, the patient may be harmed.

For example, if a safeguarding concern exists, or if a patient with severe allergies is being transferred between departments, failing to share can be more dangerous than sharing.

Principle 8 adds transparency. Patients should be told how information is used. This supports trust and reduces fear that “my records are being passed around for no reason”.

Some organisations also appoint a **Caldicott Guardian**. This is a senior person who advises on difficult confidentiality and information-sharing decisions.

> **Key Term: Caldicott Guardian**
> A senior person in a health or care organisation who advises on confidentiality and appropriate information sharing.

Applying the principles in practice means thinking through real behaviours:

Paper records

- keep notes in secure storage
- do not leave files on desks, trolleys, or in public view
- dispose of records securely, not in ordinary bins
- transport files carefully between settings

Digital records

- use secure passwords
- lock screens when stepping away
- do not share logins
- only access records needed for your role
- check email recipients carefully before sending information

Sharing information

- verify identity before giving information
- share only relevant details
- avoid discussing patients in corridors, lifts, public transport, or social media
- record what was shared, with whom, and why if required by policy

A common breach example is sending a patient summary to the wrong email address. That is a personal data breach because it involves unauthorised disclosure. Another is opening a record out of curiosity. Another is posting about a patient experience on social media in a way that makes them identifiable.

If a breach happens, staff should not try to hide it. They should contain it where possible, report it immediately through organisational procedures, and document what happened. Serious breaches may need to be reported to the Information Commissioner’s Office within 72 hours.

## Key Point Checklist

_This article has covered the following key knowledge points:_

- Confidentiality means keeping private information secure and only sharing it for a proper reason
- Personal data identifies a living person, while health data is special category data needing extra protection
- Many healthcare records are both personal data and confidential information
- UK GDPR principles include lawfulness, fairness, transparency, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability
- Direct care often uses lawful processing bases other than consent alone
- Confidentiality and data protection are linked but not exactly the same
- Information may need to be shared for direct care, safeguarding, legal duty, or emergencies
- Need-to-know access means staff only use information relevant to their role
- The eight Caldicott Principles guide safe, lawful, and proportionate handling of confidential information
- Caldicott Principle 7 states that the duty to share can be as important as the duty to protect confidentiality
- A Caldicott Guardian advises on difficult confidentiality and sharing decisions
- Secure handling of paper records, digital records, and breach reporting is essential in everyday healthcare practice

## Key Terms and Concepts

- confidentiality
- personal data
- special category data
- confidential information
- UK GDPR
- accountability
- Subject Access Request (SAR)
- direct care
- need-to-know basis
- Caldicott Principles
- Caldicott Guardian


Managing personal information - Confidentiality, GDPR, and Caldicott principles