39.6 Confidentiality, Data Protection and Lawful Disclosure

7. Confidentiality, Data Protection & Lawful Disclosure

Patient records contain special category healthcare data subject to strict statutory protections under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The Caldicott Principles in Healthcare Information

1. Justify the purpose(s) of using confidential information.
2. Do not use personal confidential data unless it is absolutely necessary.
3. Use the minimum necessary personal confidential data.
4. Access to personal confidential data should be on a strict need-to-know basis.
5. Everyone with access to personal confidential data should be aware of their responsibilities.
6. Comply with the law.
7. The duty to share information can be as important as the duty to protect patient confidentiality.
8. Inform patients and service users about how their confidential information is used.

The Three Lawful Exceptions to Confidentiality

A dental professional may lawfully disclose confidential patient information without breaching GDC standards or UK law only under the following three circumstances:

Lawful Exceptions Permitting Disclosure of Patient Information
  │
  ├── 1. Explicit, Informed Consent
  │     └── Written consent provided by the patient (or legal guardian) authorizing disclosure to third parties
  │         (solicitors, insurance companies, mortgage providers)
  │
  ├── 2. Statutory Duty or Formal Court Order
  │     ├── Statutory notification of Notifiable Infectious Diseases (Public Health [Control of Disease] Act 1984)
  │     ├── Court witness summons or High Court/Crown Court order signed by a judge
  │     └── Mandatory disclosure under counter-terrorism or road traffic legislation
  │     *(Note: Informal police requests without a warrant DO NOT compel disclosure)*
  │
  └── 3. Overriding Public Interest
        ├── Prevention, detection, or prosecution of serious crime (murder, rape, terrorism)
        ├── Protection of human life from imminent risk of death or grievous bodily harm
        └── Safeguarding children or vulnerable adults at risk of significant harm or abuse

---

8. Clinical Traps, Pitfalls & Worked Scenarios

[!CAUTION] Clinical Trap: Unmarried Father Requesting Children's Records: An unmarried father attends a dental practice requesting a copy of his 7-year-old child's complete clinical and financial records. He states that he is the biological father. The receptionist hands over the records. This is a severe breach of data protection. Unmarried fathers do not automatically have Parental Responsibility unless registered on the birth certificate (on/after 1 December 2003 in England/Wales) or holding a PR agreement/court order. If the father lacks PR, releasing records without the mother's consent violates the Data Protection Act 2018 and GDC Principle 4.

[!WARNING] Clinical Trap: Assuming Signed Treatment Forms Equal Montgomery Compliance: A dentist prepares an upper anterior central incisor for a porcelain veneer. Post-operatively, the pulp undergoes necrosis requiring root canal therapy. The patient complains they were never warned about pulpal death. The dentist defends themselves by producing a signed generic consent form stating "all risks discussed". Under Montgomery, generic forms are legally worthless. The dental notes must explicitly record the discussion of specific material risks (such as 5%–10% risk of loss of vitality during preparation), alternatives (such as composite bonding or orthodontic alignment), and the patient's personalized reasoning.

Worked Clinical SBA Scenario

Scenario: An 84-year-old resident of a nursing home with moderate vascular dementia is brought to the dental surgery accompanied by a care home assistant. Clinical examination reveals tooth 36 has gross crown breakdown, mobility, and an acute fluctuant buccal alveolar abscess discharging pus. The patient is distressed, in significant pain, and continually repeats, "No doctors, take me home, no needles." The care home assistant presents a document signed two years ago appointing her as "Lasting Power of Attorney for Property and Financial Affairs". How must the dentist proceed under the Mental Capacity Act 2005?

Clinical Reasoning Formulation:

1. Assessment of Capacity (Two-Stage Test):
   • Stage 1: The patient has vascular dementia (impairment of the mind/brain).
   • Stage 2: Due to severe distress and cognitive decline, the patient cannot understand the nature of the extraction, retain the explanation, weigh the risks of untreated sepsis versus extraction, or communicate a considered choice. The patient currently lacks capacity for this specific surgical decision.
2. Review of Legal Authority:
   • The care assistant holds an LPA for Property and Financial Affairs. Under UK law, this instrument conveys zero authority to make healthcare decisions. The assistant cannot consent to or refuse dental treatment.
3. Best Interests Decision:
   • The patient is suffering from acute, painful odontogenic sepsis that poses a serious risk to systemic health.
   • The treating dentist must act as the decision-maker under the Section 4 Best Interests framework of the MCA 2005.
   • Postponing treatment is unsafe due to spreading infection. The dentist consults with the next of kin and nursing staff regarding the patient's general health, reviews past dental attitudes, and provides emergency care (drainage/extraction under local anesthesia, potentially with mild oral sedation if required) as the least restrictive option to eliminate pain and systemic infection, documenting the entire best interests rationale in the clinical notes.

A practical consequence is that any disclosure made without consent must be limited to the minimum information necessary, made to the appropriate person or body, recorded with the reason for the decision, and, wherever possible, discussed with the patient beforehand.