Confidentiality Policy

Eudai Clinic

Policy Details

Document Type: Governance
Document Version: 1.0
Ratified Date: April 2026
Document Manager: Dr Dimitris Vichas
Approved Date: April 2026
Review Date: April 2028
Signed and Approved By: Dr Dimitris Vichas

Document Control

Introduction

All staff working within the service have a legal, ethical, and contractual duty to protect personal and sensitive information encountered during the course of their work. This duty of confidentiality applies to all information, whether it relates to patients, staff, or the organisation itself.

This obligation arises not only from employment contracts but also from data protection legislation, professional codes of practice, and common law duty of confidentiality. It is underpinned by the following key frameworks:

• Data Protection Act 2018
• UK General Data Protection Regulation (UK GDPR)
• Common law duty of confidentiality
• Caldicott Principles

A duty of confidentiality exists when information is shared in circumstances where it is reasonable to expect it will be kept private.

Patients generally have the right to object to the disclosure of identifiable confidential information, even where this may affect their own care. However, in specific situations, disclosure may be legally justified or required without patient consent.

In certain situations, confidential information may be disclosed to external authorities, such as the police, without the patient’s explicit consent, where it is:

• Required by law
• Justified in the public interest
• Permitted under a legal exemption within the Data Protection Act 2018

Examples include:

• Terrorism Acts
• Serious Crime Prevention
• Safeguarding Children or Vulnerable Adults
• Reporting Notifiable Diseases

Under Schedule 2, Part 1, Paragraph 2 of the Data Protection Act 2018, police may request personal information using a “Schedule 2 request”, replacing the former Section 29(3) under the 1998 Act.

This exemption applies where disclosure is necessary for:

• The prevention or detection of crime
• The apprehension or prosecution of offenders

Police requests must be made in writing and accompanied by an appropriate form, often signed by an officer of at least Inspector rank, detailing the purpose and legal basis of the request.

Where possible and appropriate, patient consent should be obtained before disclosing identifiable information.

All disclosures, whether with or without consent, must be:

• Necessary and proportionate
• Documented clearly
• In line with internal data protection policies and Caldicott principles

Information may be disclosed without the patient’s consent if it is in the public interest for disclosure.

This refers to Section 60 of the Health and Social Care Act. A request for the disclosure of confidential patient information without the patient’s consent can also be undertaken by using a Section 60 request form as part of the Health and Social Care Act, Section 60.

Scope and Aim

The purpose of this policy is to clearly state that all staff must adhere to the organisation’s confidentiality policy and understand the lawful exceptions that permit the sharing of confidential information.

Patients, staff members, and the public have a reasonable expectation of privacy and are entitled to trust that Dr Dimitris Vichas will treat their personal and sensitive information with care, discretion, and respect.

Information will only be shared:

• With the individual’s informed consent, or
• Where there is a legal duty or justification to disclose it without consent, e.g. safeguarding, court order, or crime prevention.

Dr Dimitris Vichas acknowledges its legal and ethical responsibility to safeguard the confidentiality, integrity, and security of personal and sensitive information throughout all information-handling processes.

Dr Dimitris Vichas is committed to compliance with UK statutory obligations and national policy regarding the management, sharing, and protection of confidential information. This includes, but is not limited to:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Common Law Duty of Confidentiality
• Human Rights Act 1998, Article 8 (Right to respect for private and family life)
• Freedom of Information Act 2000
• Access to Medical Reports Act 1988
• Access to Health Records Act 1990 (limited application – deceased individuals)
• Caldicott Principles
• NHS Confidentiality Code of Practice (where applicable)

Where staff are required to disclose confidential information without consent, for example to prevent serious harm, for safeguarding, or by court order, they must understand and follow the justified and proportionate principles outlined in data protection law and the Caldicott guidelines.

All employees are expected to:

• Understand the legal basis for handling and sharing personal data.
• Recognise exceptions where disclosure without consent may be lawful.
• Follow internal procedures and seek guidance from the Caldicott Guardian or Data Protection Lead if in doubt.

Maintaining confidentiality is critical to trust, professional standards, and compliance. Breaches may lead to disciplinary action and/or legal consequences.

Definitions

Confidential Information

Information shared in confidence, where there is an expectation it will not be disclosed without permission.

Personal Information

The legal definition of personal information, defined in the Data Protection Act 1998. For the purpose of this policy, the broader concept outlined in the Caldicott report is a more useful definition.

There are many items of information which could be used to identify individual patients. Although items may not in themselves uniquely identify an individual patient, taken together they may permit identity to be inferred.

Different combinations of items may require different degrees of effort. All items of information which relate to an attribute of an individual should be treated as potentially capable of identifying patients to a greater or lesser extent.

Sensitive Information

Sensitive information can be summarised as personal information including any aspect of:

• Health (physical or mental)
• Ethnic or racial origin
• Religious or philosophical beliefs
• Sexual orientation
• Genetic and biometric data

Information in this context may be written, spoken, or otherwise recorded. It also includes clinical samples where they may be used to extract personal or sensitive information.

Patient Information

All patient information, in whatever form, provided to, created, used by, or for the service’s purpose of healthcare or healthcare administration.

This will include both personal and sensitive information.

Staff Information

All staff information in whatever form, provided to, created, or used by the service for the purpose of staff employment.

This will include both personal and sensitive information.

Legislation

We have a legal obligation to comply with the appropriate legislation in respect of data, information, information security, and confidentiality.

We comply with the following legislation and guidance:

• Data Protection Act 2018 (DPA 2018)
• UK General Data Protection Regulation (UK GDPR)
• Human Rights Act 1998
• Freedom of Information Act 2000
• Common Law Duty of Confidentiality
• Access to Health Records Act 1990
• Computer Misuse Act 1990
• NHS Codes of Practice on Confidentiality and Information Governance
• Caldicott Principles

General Data Protection Regulations (GDPR) – May 2018

This EU legislation controls the handling and processing of personally identifiable information for everyone.

Listed below are the principles of accountability and it is the responsibility of the provider to demonstrate compliance with the following:

1. Managed lawfully, fairly and in a transparent way (Lawfulness, Fairness and Transparency).
2. Collected only for particular, explicit and lawful purposes (Purpose Limitation).
3. Sufficient, applicable and limited to what is necessary in relation to the reason for which it is processed (Data Minimisation).
4. Correct and, where necessary, kept up to date (Accuracy).
5. Not kept in a form which allows identification of individuals for longer than is necessary for the purposes for which the data is processed (Storage Limitation).
6. Managed in a way that ensures its security and always protects it against unauthorised or unlawful processing and against accidental loss, destruction or damage (Security, Integrity and Confidentiality).
7. Not transferred to another country without suitable safeguards being in place (Transfer Limitation).
8. Made accessible to the individual whom the data belongs to, so that they can exercise certain rights in relation to their personal data (Data Subject’s Rights and Requests).
9. Eudai Clinic is accountable for and must be able to show compliance with the data protection principles listed above (Accountability).

Data Protection Act (DPA) 2018

This UK Act supports GDPR and applies to certain types of processing to which the GDPR does not apply.

Common Law Duty of Confidentiality

This case law prohibits the use and disclosure of information given in confidence unless there is an absolute statutory requirement or court order to do so.

Information may be disclosed only for purposes that the information has been taken for.

Computer Misuse Act 1990

This Act ensures users who are not entitled to access do not, making it a criminal offence to access any part of a computer system.

Responsibilities

Manager

The manager, Dr Dimitris Vichas, is responsible for the development and review of this policy in line with national requirements and legislation.

They retain overall responsibility for overseeing an appropriate infrastructure to ensure the provision of a confidential and safe service.

The manager must adhere to the principles of the Data Protection Act 1998, common law on confidentiality, and other relevant legislation.

Where disclosure is not covered by local procedure, they are responsible for seeking advice from the information commissioning office.

Staff

All staff are responsible for ensuring they work within the guidelines of this policy and do not discuss any patient information without the patient’s consent.

Information Sharing and Exceptions

Information may be disclosed without consent under the following conditions.

Legal Requirements

• Terrorism Act 2000
• Police requests under DPA 2018 (Schedule 2, Part 1) – must be accompanied by a valid request, e.g. Section 29(3) form, signed by a senior officer.

Public Interest

• Where there is a serious risk to the health and safety of others.
• Must be assessed on a case-by-case basis.

Court Order or Statutory Requirement

All disclosures must be documented, justified, and authorised in line with our protocols.

Governance Meeting

During the governance meeting, the development, review, and implementation of this and supporting policies will be reviewed and monitored.

Any advice on issues which may prevent implementation or compliance, and incidents which breach this policy, will be discussed at this meeting.

Training Requirements

The manager, Dr Dimitris Vichas, will ensure provision of training is relevant and up to date.

The manager will be asked to ensure they have an awareness of all aspects of confidentiality, including the principles of the Data Protection Act.

Monitoring and Compliance

This policy will be reviewed biennially or in response to legislative changes.

Non-compliance will be addressed through the service’s disciplinary procedures.

Confidentiality Declaration by Members of Staff

All staff will be asked to complete a Confidentiality Declaration by Members of Staff.

The following declaration or equivalent should be signed by all relevant members of staff at Eudai Clinic as part of their contract of employment, Contract for Service, or otherwise as appropriate:

I understand that all information about users held by the practice is strictly confidential, including the fact of a particular user having visited the organisation.

I will abide by the confidentiality guidelines set out below.

I have read the Staff Confidentiality Policy above and fully understand my obligations and the consequences of any breach of confidentiality. I understand that a breach of these obligations may result in dismissal.

I understand that all information about patients, staff, and others held by Eudai Clinic is strictly confidential. I agree to uphold the confidentiality obligations outlined in the Confidentiality Policy.

I understand that any breach may result in disciplinary action, including dismissal, and possible legal action.