<!-- Derived Markdown alternate of confidentiality.md; canonical repository sources and registered evidence retain authority. -->


# Confidentiality, disclosure and opt-outs

**Data protection and confidentiality are cumulative tests.** Satisfying one does not automatically satisfy the other. Classify each purpose, disclosure and access arrangement before deciding what permits it. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030)

When a provider sends records or a report, the requester must assess confidentiality authority for its receipt, intended use and onward disclosure. That assessment is separate from the recipient controller's UK GDPR grounds. Prepare the relevant [requester assurance](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) before asking the provider to disclose. [SRC-102](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-102), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098)

## What is protected?

The common-law duty of confidentiality concerns information received in circumstances importing confidence. It is broader than the statutory definition of confidential patient information (CPI). Section 251 defines CPI for its statutory scheme; it does not create the whole common-law duty. Its definition considers health information, contextual identifiability and the circumstances in which it was obtained. CPI can concern deceased as well as living people. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-029](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-029)

The recipient may owe confidentiality duties even without an express clause or confidentiality label. Medical information and the circumstances of its receipt can imply confidence. The requester must not treat contractual silence as permission for unrestricted use. [SRC-102](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-102)

Removing a name does not necessarily remove confidence or identifiability. A pseudonym, rare diagnosis or combination of fields may still identify someone. Consider the information available to each recipient and the lawful route for the earlier access needed to anonymise it. See [classification and anonymisation](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md). [SRC-029](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-029)

## What permits use beyond individual care?

| Route | What must be established | What it does not establish |
|---|---|---|
| Informed, explicit confidentiality consent | A real permission covering the information, recipient and purpose | The recipient’s UK GDPR basis or permission for unrelated reuse |
| Statutory requirement or authority | The precise provision, people, purpose and safeguards it covers | General authority for every subsequent processing operation |
| Supported section 251/COPI route | Applicable approval, covered flows and conditions | A right to force the source controller to release data |
| Exceptional overriding public interest | A recorded, defensible balance and minimum necessary disclosure | A routine shortcut for convenient analytics or commercial development |
| Effective anonymisation before release | A defensible disclosure-risk assessment | Automatic authority for identifiable access during anonymisation |

The routes above are a synthesis of the statutory scheme and professional confidentiality guidance. Implied direct-care consent must not be carried into unrelated secondary purposes. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027) [SRC-033](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-033)

For employment or similar reports, the requester should give the provider a defined purpose, recipient and necessary information scope. The provider then assesses disclosure under the relevant report rights and professional duties. Authority for that disclosure does not authorise unrelated onward use by the requester. [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083), [SRC-066](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-066), [SRC-102](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-102)

## Section 251 is a defined route

Section 251 of the NHS Act 2006 enables regulations. The Health Service (Control of Patient Information) Regulations 2002—often shortened to **COPI**—provide particular powers and safeguards. The familiar application route concerns regulation 5. It addresses specified medical purposes where anonymised information cannot achieve the purpose and obtaining consent is impracticable. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027) [SRC-029](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-029)

The Confidentiality Advisory Group (CAG) advises. The Health Research Authority decides research applications; the Secretary of State decides relevant non-research cases. Support is permissive and bounded. It neither compels disclosure nor removes data protection duties. Do not assume historic pandemic COPI notices are a continuing general permission. [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030)

Regulation 7 controls permitted purpose, necessary identifiers, access, security and review. Recipients must have the required professional or equivalent confidentiality duty. Reviews must occur at intervals no greater than 12 months. Current CAG applicant guidance also addresses patient notification, public involvement, opt-outs and relevant DSPT assurance. Actual approval conditions must be read. [SRC-028](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-028) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030)

## National data opt-out

England’s national data opt-out is a scoped policy for particular uses of CPI beyond individual care. It can affect disclosure and internal repurposing for research or planning. It does not supply a lawful basis, and the absence of an opt-out is not consent. [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031) [SRC-032](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-032)

Check the policy’s covered care, processing route and exceptions. The national data opt-out does not apply to the specific use or disclosure to which a fully informed patient explicitly consents. That exception does not extend to unrelated reuse or remove the recipient's data-protection and assurance duties. Direct care and sufficiently anonymised information also fall outside this policy's scope. [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031)

Statutory requirements, certain public-health uses and approved exceptions need separate analysis. A project-specific opt-out or a UK GDPR objection can have a different scope. Record who applies the national choice, when and to which release. [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031), [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030)

For consented GP reports used for recruitment, follow the [worked example](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md). Establish disclosure authority and the permitted access route as well as [DSPT assurance](https://healthcare-data-management-wiki.pages.dev/dspt/index.md).

## Caldicott governance

The eight Caldicott Principles support justified purposes, necessity, minimisation, need-to-know access, staff responsibilities, lawful use, appropriate care sharing and transparency. They guide governance; they do not replace a disclosure gateway. [SRC-034](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-034)

A Caldicott Guardian is distinct from a Data Protection Officer or a Senior Information Risk Owner. The statutory duty to have regard to Guardian guidance has defined scope, including relevant public bodies and publicly funded services. A generic software supplier does not fall within that duty merely because it handles health data. A contract or assurance scheme may impose additional expectations. [SRC-035](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-035) [SRC-036](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-036)

## Research approval and three meanings of consent

Distinguish consent to **participate**, consent to **disclose confidential information**, and consent as a **UK GDPR lawful basis or condition**. A research organisation can obtain participation consent while relying on another appropriate data protection basis. An ethics opinion is not a general exemption from either confidentiality or data protection. [SRC-041](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-041)

First classify research, service evaluation, audit, product development and care. Then assess HRA Approval, Research Ethics Committee review, CAG support and source-controller permission separately. The required combination depends on the activity. See the current [research safeguards](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) before relying on older summaries. [SRC-038](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-038) [SRC-039](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-039) [SRC-040](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-040)

For related operational controls, use [the data lifecycle](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md), [NHS assurance](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) and the [operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md).