NHS sharing medical information with family

Legal position:
Under the law of England and Wales, the National Health Service (NHS) is bound by strict rules on patient confidentiality. This is governed primarily by the common law duty of confidentiality, the Data Protection Act 2018, and the UK General Data Protection Regulation (UK GDPR). In general, your medical information cannot be shared with family members or anyone else without your explicit consent, unless specific exceptions apply. The NHS Constitution also emphasises your right to privacy and confidentiality in relation to your health information.

Exceptions where sharing may occur without consent:
There are limited circumstances where the NHS may disclose your medical information without your consent. These include:
1. If there is a legal requirement, such as a court order or statutory obligation (for example, reporting certain infectious diseases under public health laws).
2. In the public interest, such as to prevent serious harm to you or others (e.g., if there is a risk of serious crime or harm, and disclosure is proportionate).
3. If you lack mental capacity under the Mental Capacity Act 2005, and sharing is in your best interests (in which case, decisions might involve family or a lasting power of attorney for health and welfare).
4. For children under 16 (or 18 in some contexts), where parents or guardians may have access if it is deemed in the child's best interests, subject to the child's Gillick competence if they are mature enough to understand.
However, these exceptions are applied narrowly, and the NHS must justify any disclosure. Routine sharing with family, such as discussing your diagnosis or treatment without your permission, is not permitted.

Practical next steps:
If you are concerned that your information has been shared without consent, first review any consent forms or discussions you have had with your healthcare provider. You may wish to contact the NHS trust or GP practice involved to request details of any disclosures and seek an explanation.
If you believe there has been a breach, you can make a formal complaint through the NHS complaints procedure. Additionally, you have the right to complain to the Information Commissioner's Office (ICO) as the data protection regulator.
To prevent future sharing, clearly communicate your wishes to your healthcare team and consider documenting them in writing. If the situation involves specific vulnerabilities (e.g., incapacity), exploring options like a lasting power of attorney may be relevant.

Note that the exact position can depend on factors such as your age, capacity, the nature of the information, and any relevant documents, so outcomes may vary based on the full circumstances.