Confidentiality Policy
1. Purpose and commitment
We respect the privacy, dignity and autonomy of every person using our service. Confidentiality is central to the trust placed in our specialist nurse-led service, particularly when people discuss serious illness, advance decisions to refuse treatment (living wills), lasting powers of attorney (LPAs), mental capacity, family relationships and end-of-life care. This policy explains how confidential information is protected and when it may be shared lawfully.
2. Scope
This policy applies to founders, registered nurses, employees, contractors, students and anyone acting for the service. It covers verbal, written, electronic, audio and video information obtained during enquiries, consultations, education, administration and professional collaboration, including information about people who are not direct clients.
3. Legal and professional duties
We act in accordance with the common-law duty of confidentiality, UK GDPR, the Data Protection Act 2018, applicable safeguarding duties and the NMC Code. Data protection and confidentiality are related but distinct: identifying a lawful basis under data protection law does not automatically permit disclosure of information given in confidence. The applicable legal framework and professional duties must both be considered.
4. What is confidential
Confidential information includes identities and contact details, clinical histories, diagnoses, capacity concerns, personal values, care preferences, ADRTs, LPA information, family disputes, consultation notes, correspondence, financial information and recordings. Information can remain confidential even when it is not in a formal medical record. Staff must avoid discussing identifiable cases in public, on social media or with unauthorised people.
5. Collecting and discussing information
Only information necessary for the agreed purpose should be requested and recorded. Explain the purpose of questions, check privacy during telephone and video consultations, and offer alternative ways to communicate where a person cannot speak freely. Use private spaces, headphones where appropriate and secure approved systems. Avoid personal devices, personal email accounts and informal messaging channels unless specifically authorised with appropriate safeguards.
6. Consent, capacity and authority
Explain how information may be used and seek appropriate permission before sharing with relatives, attorneys or professionals unless another lawful justification applies. Capacity is decision-specific and time-specific; do not assume that a diagnosis removes capacity. Verify the identity and authority of anyone acting on another person’s behalf. A health and welfare LPA must be registered and its scope and applicability checked; an attorney does not have unrestricted access to all information merely by being appointed. Where a person lacks capacity for an information-sharing decision, consider the relevant legal framework, their wishes and interests, and seek appropriate senior advice.
7. Sharing information with healthcare professionals
Where authorised and appropriate, we may help a person share an ADRT, advance statement, LPA details or consultation summary with their GP, hospital team, hospice or other care provider. Agree what will be shared, with whom and by which secure method. Verify the recipient before sending, share only necessary material and record the person’s permission and the action taken. Sending information does not guarantee that a recipient will add it to, or make it accessible across, healthcare records.
8. Disclosures without consent
Absolute confidentiality cannot be promised. In limited circumstances, information may need to be shared without consent, including where required by law or where a properly justified disclosure is necessary to prevent serious harm or address safeguarding concerns. Such decisions require a clear lawful basis and confidentiality justification, must be necessary and proportionate, and should be escalated to the Clinical Lead or designated safeguarding lead whenever practicable. Record the facts, alternatives considered, recipient, rationale and information disclosed. Inform the person where safe and appropriate.
9. Safeguarding and coercion
Concerns about abuse, neglect, exploitation, coercion or undue influence must be managed under the Safeguarding Adults and Children Policy. A person choosing to refuse treatment, or expressing a preference that others disagree with, does not alone establish a safeguarding concern. Assess the specific indicators, immediate safety and relevant referral thresholds; do not promise secrecy where protective action may be needed.
10. Records, access and security
Keep accurate, objective and contemporaneous records in approved systems. Access is restricted to authorised personnel with a legitimate need. Use strong authentication, device locking, secure transfer and appropriate access controls. Do not leave paper records unattended; store and dispose of them securely. Recordings require a clear purpose, appropriate permissions and an agreed retention schedule. Apply the separate Privacy and Data Protection Policy for retention, subject access requests and other data protection rights.
11. Third-party information and complex family situations
People may disclose sensitive information about relatives, attorneys or clinicians. Record only relevant details and avoid unnecessarily reproducing allegations. Do not confirm a client’s engagement with the service to a third party without proper authority. Where family members disagree about an ADRT, LPA or care decision, remain impartial, verify authority and escalate complex questions rather than sharing information to resolve the dispute informally.
12. Supervision, teaching and case discussion
Use anonymised or appropriately de-identified case information for supervision, quality assurance and education wherever possible. Identifiable discussion is limited to authorised people with a legitimate professional purpose and suitable safeguards. Do not use real client material in marketing, testimonials or public teaching without a separate, valid permission process and appropriate review.
13. Breaches and incidents
Report any actual or suspected loss, misdirection, unauthorised access, inappropriate disclosure or insecure storage immediately to the designated lead. Preserve relevant evidence, contain the issue, assess risk to affected people and follow the incident and data breach procedures. The organisation must assess whether notification to the ICO is required within 72 hours of becoming aware of a notifiable personal data breach, and whether affected individuals must be informed without undue delay where the high-risk threshold is met.
14. Training, accountability and audit
All team members must receive confidentiality and information-governance induction and refresher training appropriate to their role. Confidentiality concerns should be discussed in supervision and reviewed through audits, incident learning and governance meetings. Breaches may result in remedial training, restrictions on access, contractual or professional action as appropriate.
15. Contact and complaints
People should be told how to raise confidentiality concerns or ask about the handling of their information. You can contact us through our contact page. Our designated leads are Sarah White and Sarah Malik. Complaints are handled promptly and fairly, with signposting to the Information Commissioner’s Office where relevant.
16. Review and related documents
Review at least annually and following a significant legal change, incident or change in service delivery. Read alongside the Privacy and Data Protection Policy, Safeguarding Adults and Children Policy, Incident Reporting Procedure, Records Retention Schedule and any approved information-sharing protocols.
17. Policy owner and review
- Policy owner: Sarah White & Sarah Malik
- Approved by: Sarah White & Sarah Malik
- Designated confidentiality and information-governance lead: Sarah White & Sarah Malik
- Version: 1.0
- Date approved: 10/11/2026
- Effective from: 10/11/2026
- Next scheduled review: 09/2027
- Earlier review triggers: a significant change in law or professional guidance, a confidentiality incident or data breach, or a change in how the service is delivered (see section 16).