A confidentiality scenario at the IMT interview asks one thing: do you know when you may disclose, and can you apply it calmly to a relative, a police officer or an employer asking for information? GMC Confidentiality: good practice in handling patient information 2017 gives the answer in a framework you can say in a minute.
Key takeaways
- GMC Confidentiality 2017, paragraph 9, says confidentiality is an important ethical and legal duty but not absolute, and lists the circumstances in which disclosure does not breach it.
- Those circumstances are consent (implied for direct care, explicit for other purposes), overall benefit to a patient who lacks capacity, a legal requirement, and the public interest.
- Paragraph 17 says you must disclose information if a statute requires it or a court orders it, and paragraph 18 says to tell the patient unless that would undermine the purpose.
- Paragraph 64 says public-interest disclosure may be justified if failure to disclose may expose others to a risk of death or serious harm, and the benefit must outweigh the patient's and the public's interest in confidentiality.
- Paragraph 69 says you must document your reasons for disclosing, with or without consent, and the steps you took to seek consent or inform the patient.
- The guidance came into effect on 25 April 2017 and was updated for data protection law in 2018 and for physician and anaesthesia associates in December 2024.
What is the duty of confidentiality, and why is it not absolute?
Confidentiality is the patient's right to expect that their personal information is kept private, and GMC Good medical practice 2024 says patients have that right. It is not absolute because, as GMC Confidentiality 2017 paragraph 22 puts it, there can be a public interest in disclosure that outweighs the interest in keeping information confidential.
The same paragraph makes the point the panel wants to hear: confidential medical care is itself recognised in law as being in the public interest, because people are encouraged to seek treatment when they trust that their information stays private.
What are the eight principles in GMC Confidentiality 2017?
Paragraph 8 of the guidance sets out eight principles that underpin every decision about patient information, aligned with the Caldicott principles.
- Use the minimum necessary personal information, anonymised where practicable.
- Manage and protect information against improper access, disclosure or loss.
- Be aware of your responsibilities and understand information governance appropriate to your role.
- Comply with the law.
- Share relevant information for direct care unless the patient has objected.
- Ask for explicit consent to disclose identifiable information for purposes other than care or local audit, unless the disclosure is required by law or justified in the public interest.
- Tell patients about disclosures they would not reasonably expect, and keep a record of decisions to disclose or not.
- Support patients to access their information.
When may you disclose without breaching confidentiality?
GMC Confidentiality 2017, paragraph 9, lists the lawful bases. The patient consents, implicitly for their own care or local audit and explicitly for other purposes. The disclosure is of overall benefit to a patient who lacks capacity and is made in line with capacity law. The disclosure is required by law. Or the disclosure is justified in the public interest.
Paragraph 10 then lists what you must do whenever you disclose: anonymise if practicable, be satisfied the patient has not objected, get explicit consent for non-care purposes unless law or public interest applies, keep the disclosure to the minimum necessary, and follow the law.
Implied and explicit consent
Paragraph 13 defines explicit consent as active oral or written agreement, and implied consent as circumstances in which it is reasonable to infer agreement. Paragraph 14 allows implied consent for direct care and local clinical audit, and asks for explicit consent in other cases unless it is not appropriate or practicable.
What does 'required by law' look like on a medical ward?
Paragraph 17 says you must disclose information if a statute requires it or a judge or presiding officer of a court orders it. The guidance's examples include notification of infectious diseases and the prevention of terrorism.
Paragraph 18 asks you to satisfy yourself the disclosure is genuinely required, disclose only what is relevant, and wherever practicable tell the patient, unless that would undermine the purpose, for example by prejudicing the prevention or prosecution of serious crime. Paragraph 19 warns that a law which merely permits disclosure does not settle the question; you still need one of the paragraph 9 bases.
How do you apply the public-interest test?
Paragraph 64 sets the test. If it is not practicable or appropriate to seek consent, or in exceptional cases where the patient has refused, disclosure may be justified in the public interest if failure to disclose may expose others to a risk of death or serious harm, and the benefit of disclosing outweighs both the patient's and the public's interest in confidentiality.
Paragraph 66 gives the examples that appear at interview: a patient who is not fit to drive, a serious communicable disease, or a patient who poses a serious risk to others by being unfit for work. Paragraph 65 adds the prevention, detection or prosecution of serious crime, especially crimes against the person.
Paragraph 68 lists what you must weigh: the harm or distress to the patient, the harm to trust in the profession generally, the harm to others if you do not disclose, and the likely benefit of disclosing. Paragraph 70 says to seek advice from a Caldicott guardian where practicable, without revealing the patient's identity if possible.
What is the worked scenario, answered aloud?
A patient with newly diagnosed epilepsy tells you he intends to keep driving his taxi. Said aloud: I would first explain the diagnosis and the legal requirement on him to inform the DVLA, and check he understands. I would give him the chance to do it himself and record that advice.
If he refuses and continues to drive, GMC Confidentiality 2017 paragraph 66 names unfitness to drive as a situation where failing to disclose may expose others to a risk of death or serious harm, and the GMC has separate guidance on reporting to the DVLA. Paragraph 67 says I should tell him of my intention to disclose unless it is unsafe to do so, consider his reasons, then disclose the minimum necessary and document why.
I would discuss it with my consultant first, because paragraph 70 says these decisions can be complex and advice should be sought where practicable.
What is the trap in a confidentiality scenario?
The trap is the relative on the telephone. Being a spouse or a daughter is not a basis for disclosure under paragraph 9, so the answer is to establish what the patient wants shared, and with whom, before any information leaves the ward. GMC Good medical practice 2024 paragraph 37 still requires you to be considerate and compassionate to those close to the patient.
The second trap is the opposite error: refusing to disclose when the law requires it or when a third party faces serious harm. Paragraph 60 reminds you that you also have a wider duty to protect and promote the health of patients and the public.
How do you escalate and document?
Escalate to your consultant, and where the decision is finely balanced to the Caldicott guardian, data protection officer or your defence body; the guidance's introduction names all four as sources of advice. Paragraph 69 requires you to record your reasons for disclosing or not, and the steps you took to seek consent or inform the patient.
How is a confidentiality answer scored?
The ethics, professionalism and governance area is scored 1 to 5 by each of two interviewers and weighted 1.2, with communication weighted 1.6 across the station. Marks come from naming the four lawful bases, applying the public-interest test explicitly, involving the patient, and saying who you would ask and what you would write down.
How this comes up at the IMT interview
At the IMT interview, confidentiality is a station 1 ethics, professionalism and governance scenario of up to five minutes, and it also appears inside station 2 cases when a relative asks for results or a patient discloses something with implications for others.
internalmedicineinterview's bank of 361 IMT questions includes confidentiality scenarios with AI-marked spoken practice, so you can hear whether you reached for the framework or for instinct.