16.1 Consent & Confidentiality

Key Takeaways

  • Valid consent requires three elements: the patient has capacity, receives adequate information (including material risks), and gives consent voluntarily without coercion.
  • Adult capacity is presumed (Mental Capacity Act 2005); a person lacks capacity if, at the material time, they cannot understand, retain, use/weigh the information, or communicate their decision — and decisions are made in their best interests.
  • Consent for a child under 16 is assessed by Gillick competence (understanding the treatment); parental responsibility otherwise; 16–17-year-olds are presumed competent to consent, and refusal can be overridden in their best interests.
  • Confidentiality is a legal and ethical duty (GDC, GDPR/Data Protection Act 2018, common law); disclosure requires patient consent, a legal duty, or a public-interest justification (e.g. serious crime, risk to others).
  • Material risks must be disclosed — Montgomery (2015) shifted UK law to what a reasonable patient would want to know, not the Bolam professional-standard test, for the disclosure of risks.
Last updated: August 2026

Elements of Valid Consent

Valid consent requires:

  1. Capacity — the patient can understand and decide.
  2. Information — adequate explanation of the proposed treatment, alternatives, benefits, and material risks.
  3. Voluntariness — the decision is made freely, without coercion or undue influence.

Consent may be written, verbal, or implied, but the form is not the consent — the process is. For significant interventions, written consent is best practice and provides evidence of the discussion.

The Consent Process

The discussion should cover:

  • The diagnosis and proposed treatment.
  • Alternative options, including no treatment.
  • Material risks (see Montgomery below).
  • The benefits and likely outcome.
  • Costs and what happens after treatment.

Consent should be taken by a clinician competent to perform the procedure, in advance, with time for the patient to reflect.

Capacity — the Mental Capacity Act 2005

A person aged 16 or over is presumed to have capacity unless shown otherwise. The Mental Capacity Act 2005 (MCA) (covering England and Wales) provides the framework.

Test for Lack of Capacity (Two-stage)

  1. Diagnostic — an impairment of, or disturbance in, the functioning of the mind or brain.
  2. Functional — because of that impairment, the person cannot, at the material time, do one or more of:
    • Understand the information.
    • Retain the information long enough to decide.
    • Use or weigh the information as part of deciding.
    • Communicate the decision (by any means).

If capacity is lacking, decisions are made in the patient's best interests — consulting those close to them, considering past wishes, and the least restrictive option. Capacity is decision-specific and time-specific: a person may have capacity for one decision but not another.

Principles of the MCA

  • Presume capacity unless shown otherwise.
  • Support a person to make their own decisions where possible.
  • A person can make an unwise decision and still have capacity.
  • Act in the best interests of those who lack capacity.
  • Use the least restrictive intervention.

Children and Consent

AgeRule
Under 16Consent if Gillick competent — understands the treatment and its implications; otherwise consent from someone with parental responsibility
16–17Presumed competent to consent (Family Law Reform Act 1969); a competent refusal can be overridden in their best interests
18 and overFull adult capacity (MCA)

Gillick Competence

A child under 16 can consent to treatment if they demonstrate sufficient understanding and intelligence to appreciate the nature, purpose, and risks of the treatment — the Gillick test from Gillick v West Norfolk AHA (1985). If competent, they can consent independently of their parents; the Fraser guidelines apply specifically to contraceptive advice.

Parental Responsibility

Held by the mother automatically; the father if married to the mother, named on the birth certificate (post-2003), or by parental responsibility agreement/order. A person with parental responsibility can consent on behalf of a child who is not Gillick competent.

The Montgomery Standard of Risk Disclosure

UK law on risk disclosure changed with Montgomery v Lanarkshire Health Board (2015).

  • Bolam (1957) — the test was what a responsible body of medical opinion would do (a professional standard).
  • Montgomery (2015) — the test is now what a reasonable patient in the patient's position would attach significance to: a doctor must take reasonable steps to ensure the patient is aware of material risks, and of reasonable alternatives.

A risk is material if a reasonable person in the patient's position would be likely to attach significance to it, or the clinician is/should be aware the particular patient would. This is a patient-centred, not professional-standard, test.

Applying Montgomery in Dentistry

  • Disclose common risks (pain, sensitivity, the need for further treatment) and serious risks (nerve injury in lower third molar surgery, sinus communication, the possibility of extraction needing surgical removal).
  • Individualise: a professional singer may attach greater significance to nerve injury.
  • Document the discussion and the risks explained.

Confidentiality

Confidentiality is owed at common law and under the GDPR / Data Protection Act 2018, and is a GDC Standards duty. Patient information is shared on a need-to-know basis, only for the purpose for which it was given.

Maintaining Confidentiality

  • Discuss patient information only with those involved in care, and only what they need to know.
  • Store records securely; control access; avoid identifiable discussions in public areas.
  • Take care on the telephone and in correspondence.

Disclosing Without Consent

Disclosure without consent is justified only where:

  1. The patient has consented (or it is in their best interests if lacking capacity), or
  2. There is a legal requirement (court order, statute, notification of certain diseases), or
  3. There is a public interest that outweighs the duty of confidence.

The Public-Interest Test

A disclosure in the public interest (e.g. a serious risk to others, a serious crime, a notifiable disease) is weighed against:

  • The seriousness of the harm risked by non-disclosure.
  • The likelihood of that harm.
  • The harm to the patient (and the trust relationship) from disclosure.

Where possible, seek the patient's consent first; disclose the minimum necessary to the right person; document the reasoning.

Caldicott Guardians and Information Governance

Every NHS organisation has a Caldicott Guardian responsible for protecting confidentiality of patient information and governing its use. Information governance training is mandatory for NHS staff and is examined at a knowledge level.

Test Your Knowledge

A 14-year-old patient fully understands the nature, purpose, and risks of a proposed restoration and wishes to proceed without her parents. Under which legal principle can she consent independently?

A
B
C
D
Test Your Knowledge

Following the Supreme Court decision in Montgomery v Lanarkshire Health Board (2015), what standard now governs the disclosure of risks to obtain valid consent?

A
B
C
D
Test Your Knowledge

Under the Mental Capacity Act 2005, a patient is found to lack capacity to consent to extraction when, due to a disturbance of mind, they cannot do which of the following at the material time?

A
B
C
D
Test Your Knowledge

A dentist wishes to disclose a patient's HIV status to the patient's new GP without consent. On what basis might this be justified?

A
B
C
D
Test Your Knowledge

Which statement about consent in a 17-year-old patient is correct under English law?

A
B
C
D