01Core principlesThe concepts and mechanisms needed to understand the subject.
Confidentiality makes sexual-health care clinically effective because people are more likely to seek testing and disclose the information needed for diagnosis. It covers attendance, appointment details, history, examination, samples, results, treatment and partner information. Explain how information supports direct care and the limited situations in which disclosure may occur. Do not promise that information can never be shared.
A safe contact plan is part of clinical care. Ask whether a telephone, text, voicemail, portal, email or home address is private and which wording is safe. Shared devices, linked parental accounts, proxy access and itemised communications can reveal attendance even when the result itself is omitted. Record the agreed method and any forbidden channels, and confirm identity before discussing sensitive information.
Within direct care, relevant information can usually be shared among professionals who need it, subject to professional standards and the patient’s reasonable expectations. If the patient objects, clarify what they fear and explain possible consequences. Use the least information that achieves the purpose. A separate sexual-health record or restricted view may reduce casual access but does not remove obligations for safe direct care or lawful disclosure.
Partners have no automatic right to the index patient’s diagnosis. Partner notification should normally offer the exposed person confidential testing or treatment without naming the index patient. Family, employers, schools and insurers likewise need consent or another specific lawful basis. Even confirming attendance can disclose sensitive information. Identity checks and neutral communications prevent many breaches.
Disclosure without consent may be justified when necessary to prevent death or serious harm, protect a child or adult at risk, meet a statutory requirement or obey a court. The decision is purpose-specific and case-specific. Seek consent unless doing so is impractical, would defeat the purpose or increase risk. Tell the patient what will be shared unless that would cause harm. Obtain senior, safeguarding, Caldicott or legal advice when uncertainty is material and time permits.
Minimum necessary means selecting the recipient, facts and timing that achieve the protective or legal purpose. It does not mean releasing the whole record by default. Record the concern, alternatives considered, advice, balance of benefits and harms, information shared, recipient and follow-up. If the decision is not to disclose, document the reasons and review if risk changes.
Children and young people have the same underlying duty of confidentiality. A competent under-16 or a capable 16- or 17-year-old can often receive confidential care. Parents do not automatically receive sexual-health information. Safeguarding concerns, serious harm and legal requirements can change the decision. Under-13 sexual activity is a strong trigger for sharing and specialist discussion under GMC guidance, but disclosure still follows an appropriate safeguarding route rather than casual family notification.
Access routes vary across the UK. NHS services in England describe free confidential sexual-health care, including for under-16s. NHS Inform says anyone can attend a Scottish sexual-health service, including under-16s. Welsh health boards and Northern Ireland GUM services provide confidential routes, but booking, online-kit ages, records and local safeguarding contacts differ. Use the patient’s nation and local service, not an assumed UK-wide operational pathway.
Key points
- Explain at the start that sexual-health information is confidential, how it may be used for care and the limited circumstances in which relevant information may be shared.
- Agree a safe results channel and test it against shared phones, portals, addresses, voicemail, interpreters, bills and proxy access.
- For direct care, share relevant information with the healthcare team on the usual lawful basis, but respect an objection and reassess safety and consequences.
- Do not tell a partner, parent, employer or insurer that someone attended or disclose a result merely because they ask or may benefit.
- When consent is absent, identify a specific legal duty or public-interest justification, balance benefits and harms, use the minimum necessary and document reasoning.
- Children and young people retain confidentiality; age under 16 alone does not authorise parental disclosure, although safeguarding and legal exceptions remain.
- Correct misdirected messages and inappropriate access promptly through information-governance and safety processes, including checking whether disclosure increases risk.
02Mechanisms and patternsImportant relationships and how to distinguish them.
Relevant information is used by professionals involved in care within the patient’s reasonable expectations and with proportionate access.
Shared phones, portals, addresses or proxy access can reveal attendance or results and require an alternative contact plan.
A partner, parent, employer or insurer lacks access unless the patient authorises it or a separate lawful basis applies.
Disclosure without consent may be necessary when likely benefit in preventing death or serious harm outweighs confidentiality interests.
Relevant information may need prompt sharing with an appropriate agency to protect a child or adult at risk.
A specific statutory requirement or court order determines the scope; verify it rather than treating any official request as authority.
03Interpreting evidenceInformation, measurements and their limitations.
Consider the information, its meaning and its limitations before deciding what follows.
- 01
Disclosure-purpose check - Why
- Define exactly why information is proposed to be shared and what outcome it should achieve.
- Interpretation and limitations
- A vague benefit is insufficient; identify direct care, consent, legal requirement, safeguarding or a specific public-interest purpose.
- 02
Consent and capacity assessment - Why
- Determine whether the patient can authorise this disclosure and what they understand.
- Interpretation and limitations
- Capacity is decision- and time-specific. Record support given, preferences, consent or refusal and the applicable national framework.
- 03
Benefit-harm balance - Why
- Assess whether non-consensual sharing is necessary and proportionate.
- Interpretation and limitations
- Consider seriousness, likelihood, alternatives, effect on trust and risk created by disclosure; seek advice when consequences are material.
- 04
Minimum-information review - Why
- Limit content and recipients to what achieves the stated purpose.
- Interpretation and limitations
- Exclude unrelated sexual history and third-party details; a whole record is rarely the minimum necessary response.
- 05
Communication-channel audit - Why
- Prevent accidental disclosure through messages, portals, post or representatives.
- Interpretation and limitations
- Confirm recipient identity and channel safety before sending, and treat delivery failure or proxy access as unresolved risk.
04Applied reasoningWorked examples connecting principles to decisions.
01Worked case: monitored phoneDeliver results without exposing attendanceAn adult awaiting an STI result says their partner checks all texts and voicemail.+
- 1Ask which channels, words and times are safe, whether portal or postal access is shared, and whether the surveillance signals coercion or immediate danger.
- 2Record a neutral or no-message instruction and agree a verified call, in-person collection or another confidential route supported by the service.
- 3When the result returns, confirm identity before disclosure and use only the agreed channel; do not leave clinical detail on the monitored device.
- 4Check that the patient received the result and plan, address partner notification separately, and escalate coercion or safety concerns with consent where possible.
02Disclosure without consentUse a defined protective justificationA clinician believes withholding information could expose someone to death or serious harm.+
- 1Define the harm, likelihood, people affected and whether consent can safely be sought.
- 2Explore confidential clinical alternatives and obtain senior, safeguarding, information-governance or legal advice when delay is safe.
- 3Share the minimum necessary with an appropriate recipient, explain to the patient when safe, document and review the outcome.
03Third-party requestProtect the patient’s attendance and resultA partner or parent telephones asking whether the patient attended and what the tests showed.+
- 1Do not confirm attendance or results; verify whether valid patient authority or another lawful basis exists.
- 2Offer the caller general information or their own route to testing without revealing the index patient.
- 3Document concerning behaviour and check patient safety if the request suggests coercion, stalking or unauthorised record access.
05Checking understandingVerify the reasoning, revisit uncertainties and apply feedback.
- Audit whether result messages followed the recorded safe channel and whether the patient actually received and understood the plan.
- Review restricted access, proxy accounts and inaccurate contact details when circumstances or relationships change.
- Record every non-consensual disclosure decision, advice, recipient, information shared, purpose and follow-up outcome.
- Investigate misdirected communications or inappropriate access through information-governance processes and address any immediate patient risk.
- Reassess confidentiality choices for young people as competence, parental involvement and safeguarding information evolve.
06Special situationsVariants, exceptions and circumstances that change the usual approach.
Attendance is confidential
Confirming that someone used a sexual-health service can itself reveal sensitive information even without naming a diagnosis.
Minimum is purpose linked
Share only the facts and with only the people required to achieve the identified care or protection purpose.
Partner care can preserve identity
Provider notification can offer testing or treatment without disclosing which index patient prompted contact.
Records need context
A restricted record reduces casual visibility but cannot prevent justified sharing for direct care, safeguarding or law.
Silence can also harm
Confidentiality must be balanced carefully when withholding information creates a serious preventable risk to someone.
07Common pitfallsFrequent interpretation and management errors.
- 01
Promising absolute secrecy before explaining safeguarding, serious-harm, statutory and court-ordered exceptions.
- 02
Leaving a detailed result on voicemail or text without confirming that the chosen device and wording are safe.
- 03
Giving a partner or parent information merely because they know the patient attended or say they are worried.
- 04
Sharing an entire sexual-health record when a narrow fact would meet a justified protective purpose.
- 05
Assuming under-16 attendance automatically authorises parental access to results or records.
- 06
Failing to record the reasoning, advice and exact information shared when consent was absent.