Confidentiality Explained Simply

Care Principles Made Simple – Part 6 of 10

Confidentiality can sound like a complicated legal subject, but its everyday purpose is simple: people should be able to trust care workers with their personal information.

That does not mean information must never be shared. Good care depends on sharing the right information with the right people for the right reason—and keeping it away from everyone else.

An everyday confidentiality situation

Mrs Ahmed receives support at home. During a visit, she tells her care worker that she has recently been diagnosed with a health condition. She is worried and asks the worker not to mention it to her daughter.

Later that day, Mrs Ahmed’s daughter telephones and asks:

“Has Mum received any new medical results?”

The care worker knows the answer, and the daughter sounds genuinely concerned. Should the worker tell her?

The safest response would be calm and professional:

“I understand why you are concerned, but I cannot discuss someone’s personal information without checking their wishes and following our procedure.”

The worker should not confirm the diagnosis, hint at the answer or provide information simply because the caller is a relative.

What confidentiality means

Confidentiality means treating personal information respectfully, protecting it from unauthorised access and only discussing or sharing it when there is an appropriate reason.

The Skills for Care Code of Conduct states that adult social care workers should treat information about people using care services and their carers as confidential. Workers should only disclose it in accordance with legislation and their organisation’s agreed ways of working.

Confidentiality helps people feel safe enough to speak honestly about their:

• Physical and mental health
• Medication and treatment
• Personal-care needs
• Relationships and family circumstances
• Finances
• Religious beliefs
• Sexuality and gender identity
• Past experiences
• Fears and concerns
• Support arrangements

If people believe their information will become workplace gossip, they may stop sharing details that are important to their care.

Protecting confidentiality is therefore part of providing safe, dignified and person-centred care.

Confidential information takes many forms

Confidentiality does not apply only to medical records. Information may be confidential whether it is:

• Spoken during a conversation
• Written in a care plan
• Recorded in daily notes
• Stored in an electronic care system
• Sent in an email
• Discussed during a handover
• Shown in a photograph
• Heard during a telephone call
• Displayed on a computer or telephone screen
• Written on a medication record
• Shared by a relative or professional

Even confirming that someone receives a particular service could reveal information they may not want disclosed.

Health information receives additional protection under data-protection law because it is considered special-category data.

Use the need-to-know principle

A simple question can guide many everyday decisions:

Does this person need this information to provide safe care or carry out an authorised responsibility?

Being employed by the same organisation does not automatically entitle someone to see every person’s records. Staff should only access information required for their work.

For example:

• A care worker may need to know that someone has a swallowing risk.
• The worker probably does not need every detail of an unrelated family disagreement.
• A nurse may need information about a change in someone’s condition.
• A colleague who is curious but not involved in the person’s care does not need that information.

Accessing a record without a work-related reason is inappropriate, even if the worker does not tell anyone what they have read.

Sharing information can be necessary

Confidentiality does not mean keeping every piece of information secret.

Current NHS England guidance on information sharing in social care explains that relevant information should be shared with professionals directly involved in someone’s care when it is needed to support that care.

Failing to communicate an important risk can be just as harmful as disclosing information inappropriately.

You might need to share information when:

• Giving an authorised handover
• Reporting a change in someone’s health
• Alerting a senior colleague to a medication concern
• Updating an authorised health or social care professional
• Reporting an accident or incident
• Following a safeguarding procedure
• Responding to a lawful request
• Acting during an emergency

Share through the correct channel, follow your employer’s policy and provide only the information necessary for the purpose.

If you are unsure, ask a manager or senior colleague before disclosing anything.

What about relatives and friends?

Relatives may know the person well and play an important role in their support. However, being someone’s child, spouse, sibling or close friend does not automatically provide unrestricted access to confidential care information.

Before sharing, consider:

• Has the person agreed that information may be shared?
• What information have they agreed can be shared?
• Is the caller or visitor definitely who they claim to be?
• Does the person have any relevant legal authority?
• Is sharing necessary for the person’s care or safety?
• What does the care plan or communication record say?
• What is your organisation’s procedure?

Where someone lacks the mental capacity to make a particular decision, information-sharing decisions must be made through the appropriate lawful process and in the person’s best interests. A care worker should seek guidance rather than deciding alone.

Confidentiality and safeguarding

Someone might tell you about abuse, neglect or exploitation and then say:

“Please promise you won’t tell anyone.”

Do not promise complete secrecy.

Listen calmly and explain that you may need to share the concern with people responsible for helping to keep them safe.

NHS England advises that information may sometimes need to be shared without consent when a child or adult is at risk of serious harm. Only necessary information should be shared, and a manager or safeguarding lead should be involved where possible.

Follow your safeguarding procedure immediately. Do not investigate the concern yourself or discuss it with colleagues who are not involved.

Our guide to safeguarding explained simply provides further examples of how to recognise, record and report concerns.

Protect conversations

Confidentiality can be broken without anyone opening a care record. Ordinary conversations can reveal a great deal.

Avoid discussing people:

• In corridors where visitors can hear
• In lifts, cafés or on public transport
• At reception desks in front of others
• In shared staff areas when unauthorised people are present
• At home with your family
• With colleagues who are not involved
• On speakerphone where other people can listen

During a handover, use the designated private area and keep your voice at an appropriate level.

In someone’s home, be mindful of neighbours, visitors and open windows. Ask the person where they would feel comfortable discussing sensitive matters.

Keep paper and electronic records secure

The Care Quality Commission’s Regulation 17 guidance requires care records to remain secure and only be accessed, changed or destroyed by authorised people.

In practice:

• Lock your screen when leaving a device.
• Keep passwords private.
• Use only approved systems and accounts.
• Do not leave care notes visible in a vehicle or public place.
• Return paper records to their designated secure location.
• Check the recipient before sending an email or message.
• Do not download records onto a personal device.
• Dispose of confidential paperwork through the approved process.
• Report lost devices, records or keys immediately.

Never photograph care plans, medication records or personal documents using your own telephone unless an authorised procedure specifically permits it.

Confidentiality and social media

Do not post information about the people you support on social media.

Removing someone’s name may not make a post anonymous. A photograph, location, unusual incident, date, family detail or description of the service could still identify them.

Avoid:

• Photographs taken during care without proper authorisation
• Stories about “a difficult client”
• Complaints about a shift that reveal personal details
• Screenshots of care records
• Videos recorded in a care setting
• Private messages about people using your personal account
• Accepting or sending friend requests where this conflicts with professional boundaries

Your organisation’s social-media, photography and information-governance policies should always be followed.

Record information carefully

Confidentiality does not mean leaving important information out of care notes.

Records should be accurate, relevant and written through the approved system. Include what colleagues need to provide safe, continuous care, but avoid unnecessary personal commentary.

Write facts rather than gossip or insulting opinions.

For example, instead of writing:

“Mrs Green was being impossible again.”

Write:

“Mrs Green declined support with washing at 8:15 a.m. She stated that she felt tired and asked staff to return after breakfast. The senior carer was informed.”

The second version is respectful, factual and useful.

The ICO’s data-protection principles include using information lawfully and fairly, keeping it accurate, limiting it to what is necessary and protecting it securely.

What if you disclose something accidentally?

Mistakes can happen. You might send information to the wrong recipient, lose paperwork, leave a screen visible or discuss something where it is overheard.

Do not hide the mistake or attempt to quietly correct it without telling anyone.

Take immediate action where possible, then report it through your organisation’s data-breach or incident procedure. Prompt reporting allows the organisation to reduce possible harm and decide whether further action is required.

Be clear about:

• What information was involved
• Who may have received or seen it
• When it happened
• What you have already done
• Whether the person may face any immediate risk

A simple confidentiality check

Before accessing, discussing or sharing information, ask:

1. Purpose: Why is this information needed?
2. Authority: Am I permitted to access or share it?
3. Recipient: Is this the correct person?
4. Minimum: Am I sharing only what is necessary?
5. Security: Am I using an approved, private method?
6. Record: Do I need to document what was shared and why?

If any answer is unclear, pause and ask a senior colleague.

Returning to Mrs Ahmed

Mrs Ahmed’s care worker does not disclose the diagnosis to her daughter.

Instead, the worker records the conversation appropriately and discusses the situation with the manager. They check Mrs Ahmed’s wishes and explain how involving someone she trusts might help her, while respecting her right to make the decision where she has capacity.

If a safety concern develops, the worker follows the correct reporting and information-sharing procedure.

This approach protects Mrs Ahmed’s privacy without allowing confidentiality to become a barrier to safe care.

The simplest way to remember it

Confidentiality means:

Protect personal information, share it only for a proper reason and use the safest authorised method.

Do not gossip, guess or disclose information simply because someone asks. Equally, do not keep information to yourself when it must be shared to provide safe care or protect someone from harm.

When uncertain, pause and seek guidance. Protecting information is not only an administrative responsibility—it is part of earning and keeping a person’s trust.

This article provides general information for adult social care in England. Workers should follow their employer’s policies, training and agreed ways of working. It is not a substitute for legal or professional advice.