Confidentiality in Care: What It Means, the Caldicott Principles and When Information Can Be Shared
A practical guide for registered managers and care staff: how to protect people’s information, when you are allowed or required to share it, and what inspectors check.
Confidentiality in care means protecting the personal information people share with you, and using or sharing it only in ways they would expect, with their consent, or where the law or their safety requires it. In England it rests on the common law duty of confidentiality, data protection law and the Caldicott principles, and CQC tests it under Regulation 10 (privacy and dignity) and Regulation 17 (secure records). Sharing information for a person’s care is as important as protecting it.
Care staff know a great deal about people: health conditions, family, money, habits. Confidentiality is not about secrecy. It is about people being able to trust that what they tell you is used properly. Most breaches in care are not malicious: a handover overheard, a message sent to the wrong group, a care note left on a table.
This guide uses the National Data Guardian’s Caldicott principles, NICE’s care homes medicines guideline (SC1, which points care homes to the five confidentiality rules) and CQC’s Regulation 10 guidance. For data protection law in detail, see GDPR and data protection in care homes.
Key takeaways
- Confidentiality means using personal information only for the purposes people expect, sharing it on a need-to-know basis, and being open about how you use it.
- The Caldicott principles set eight tests for using confidential information, including that the duty to share information for individual care is as important as the duty to protect it.
- You may share without consent where the law requires it or where it is needed to protect someone, including safeguarding. Record your reasoning.
- Everyday risks are practical: handovers, messaging apps, notes in people’s homes, screens and visitors.
- Staff need to know their responsibilities. Train them, check them and record the training.
In this guide
What Does Confidentiality Mean in Care?
Confidentiality is a duty to protect personal information that people share with you in confidence, including details of health, lifestyle, family and finances. It is part of the trust between a person and the people who support them. Three layers apply:
- The common law duty of confidentiality: information given in confidence should not be disclosed without the person’s consent unless there is another legal basis or a justified public interest.
- Data protection law (UK GDPR and the Data Protection Act 2018): rules on lawful use, security, access and breaches. See our GDPR guide.
- Regulatory expectations: Regulation 10 covers privacy, and Regulation 17 expects records to be accurate, complete and securely kept.
What Are the Five Confidentiality Rules?
NICE’s care homes guideline tells providers to have a process for managing information that covers the five rules in the Health and Social Care Information Centre’s A guide to confidentiality in health and social care (2013). In summary:
- Confidential information about service users should be treated confidentially and respectfully.
- Members of a care team should share confidential information when it is needed for the safe and effective care of an individual.
- Information shared for the benefit of the community should be anonymised.
- An individual’s right to object to the sharing of confidential information about them should be respected.
- Organisations should put policies, procedures and systems in place to ensure the confidentiality rules are followed.
What Are the Caldicott Principles?
The Caldicott principles, published by the National Data Guardian, apply to health and social care. There are eight:
| Principle | In practice |
|---|---|
| 1. Justify the purpose(s) | Define, document and review every use of confidential information |
| 2. Use confidential information only when it is necessary | Do not include it if it is not needed |
| 3. Use the minimum necessary | Share only what the purpose requires |
| 4. Access on a strict need-to-know basis | Control who can see records and what they can see |
| 5. Everyone with access should understand their responsibilities | Train and brief staff |
| 6. Comply with the law | Every use must be lawful under statute and common law |
| 7. The duty to share information for individual care is as important as the duty to protect confidentiality | Do not withhold information that someone needs for safe care |
| 8. Inform people about how their information is used | No surprises: tell people what you do with their information |
When Can You Share Confidential Information?
| Situation | Usual basis | What to do |
|---|---|---|
| Sharing with the care team for the person’s care | Implied consent for direct care, in line with principle 7 | Share what is needed for safe care; tell the person |
| Passing information to another service (for example the GP) | Consent, or another lawful basis | Share the minimum; record what and why |
| Safeguarding concerns about an adult | Protecting the person; legal duties and local procedures | Follow your safeguarding policy and record your reasoning (referral process) |
| Notifications to CQC | Legal requirement | Send what the notification requires (notifiable events) |
| Family asking for information | Consent, or a lawful authority such as a power of attorney | Check what the person wants and whether the family member has authority; do not assume |
If you are unsure, ask your manager or data protection lead before disclosing, and record the decision either way.
What Are the Everyday Confidentiality Risks in Care?
- Handovers and conversations held where visitors or other residents can overhear.
- Messaging apps and email used for care information on personal devices or in group chats.
- Paper records left in communal areas, or care notes left in a person’s home where visitors can read them (a particular home care issue).
- Screens left unlocked, and shared logins.
- Photographs and CCTV without a lawful basis or consent (see CCTV in care homes and digital care records).
- Telephone enquiries from people claiming to be family or professionals.
A confirmed personal data breach that risks people’s rights must be reported to the Information Commissioner’s Office within 72 hours of becoming aware of it, and recorded either way. See our GDPR guide for the process.
How Can CQC Logic Help?
CQC Logic helps you evidence the governance side: a policy register with review dates (add your confidentiality, data protection and information sharing policies), a training tracker so confidentiality and data protection training is recorded, an incident log for breaches and near misses, and an audit tracker where you can add a records and confidentiality audit. It is not a data protection compliance system and does not make disclosure decisions for you. See plans.
Sources: National Data Guardian: The Caldicott principles · NICE SC1: Managing medicines in care homes (recommendation 1.3.1) · CQC: Regulation 10, Dignity and respect
Record confidentiality training, policies and breaches
CQC Logic keeps your policy register, training records, incident log and audits together, so you can show how confidentiality is protected in practice. See a sample improvement plan, view pricing or get started free.
Frequently Asked Questions
What is confidentiality in care?
Protecting the personal information people share with you and using or sharing it only in ways they expect, with their consent, or where the law or their safety requires it.
What are the five rules of confidentiality in health and social care?
Treat confidential information respectfully; share it within the care team when needed for safe and effective care; anonymise information shared for the benefit of the community; respect an individual’s right to object to sharing; and have policies, procedures and systems to ensure the rules are followed.
What are the Caldicott principles?
Eight principles from the National Data Guardian: justify the purpose, use information only when necessary, use the minimum necessary, restrict access to need-to-know, make sure everyone understands their responsibilities, comply with the law, recognise the duty to share is as important as the duty to protect, and inform people how their information is used.
When can confidentiality be broken in care?
Where the person consents, where the law requires disclosure, or where sharing is needed to protect someone from harm, including adult safeguarding. Record what you shared, with whom and why.
Can I tell a family member about a resident’s health?
Not automatically. Check what the person wants and whether the family member has legal authority, such as a lasting power of attorney. If the person lacks capacity, follow the Mental Capacity Act and your policy, and record the decision.
What does CQC say about confidentiality?
Regulation 10 requires providers to ensure people’s privacy as part of treating them with dignity and respect, and Regulation 17 expects records to be accurate, complete and securely kept. Data protection law adds duties on security and breaches.