Disclosure of student health information

Legal position:

Information about your health is classed as “special category data” under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This is the most protected category of personal data. It also usually attracts a separate duty of confidence at common law when it has been shared in circumstances suggesting it should be kept private, for example a disclosure to a disability adviser, counsellor or wellbeing team.

The practical effect is that a university cannot lawfully share your health condition with anyone it likes. It needs a specific legal basis under Article 6 UK GDPR and, because it is special category data, an additional condition under Article 9. In most non-emergency situations the university will rely on your consent, so as a general rule it should not disclose your health information to others without asking you first.

When the university will normally seek your consent:

For most day to day purposes, the university should ask before sharing. Typical examples where consent is normally sought include:

Telling academic staff or tutors about a condition so that adjustments, extensions or exam arrangements can be made.

Sharing information with the disability or wellbeing service in order to set up reasonable adjustments.

Informing a placement provider, professional body or accommodation service.

Contacting your GP or another external healthcare provider.

You can usually limit consent. For example, you might agree that your disability adviser knows the full diagnosis, but that individual lecturers are told only what adjustments you need, without the underlying medical detail. It is reasonable to ask the university to share the minimum necessary and to specify exactly who will see it.

When the university can share without your consent:

There are recognised situations where a university may lawfully disclose health information even if you have not agreed, or have refused. These are limited and the university should still share only what is necessary.

Emergencies and serious risk. If there is a genuine risk to your life or safety, or to the safety of others, the university can share relevant information without consent. The ICO has specific guidance encouraging universities and colleges to share personal data in an emergency, for example alerting emergency services, or contacting a trusted person, where someone is at serious risk of harm or suicide. In this situation the relevant UK GDPR condition is protecting someone’s vital interests, and the confidentiality duty gives way to the public interest in preventing serious harm.

Legal obligation. Where a law requires disclosure, or a court orders it, the university must comply.

Safeguarding. Where safeguarding duties are engaged, particularly if you are under 18 or an adult at risk, information may be shared with appropriate bodies.

Formal university procedures. Health information may be shared internally where it is genuinely relevant to a formal process, such as fitness to study, fitness to practise (common on nursing, medicine, teaching and similar courses), academic misconduct with a medical mitigation element, or student conduct proceedings. Even here, disclosure should be limited to those who need it for that process.

Public health and regulatory duties. There are narrow legal bases for sharing with public health authorities or regulators in specific circumstances.

The point about “trusted contacts” or emergency contacts:

Many universities operate a “trusted contact” or emergency contact scheme, where you nominate someone (often a parent) who can be contacted if the university has serious concerns about your welfare. Giving an emergency contact does not give blanket permission to tell that person about your health. The university should generally only contact them in a genuine welfare emergency, and share only what is necessary. It is worth checking what you agreed to when you enrolled.

Your rights over this information:

You have significant rights you can use if you are concerned:

1. Right of access. You can make a subject access request to see what health information the university holds about you and, in broad terms, who it has been shared with.

2. Right to object and to restrict. You can object to certain processing and ask the university to restrict use of your data while a dispute is resolved.

3. Right to withdraw consent. Where the university is relying on your consent, you can withdraw it at any time, and it should stop sharing on that basis going forward, unless another lawful basis applies.

4. Transparency. The university’s privacy notice should tell you who it may share your data with and why. You are entitled to ask for a clear explanation.

Missing facts that affect the answer:

The precise position depends on several things you have not stated:

Which university it is, because each institution’s own privacy notice, confidentiality policy and student health and welfare guidance will set out its specific practice. University policies are authoritative for the institution’s own rules.

The context in which you disclosed the condition, for example to a counsellor, a disability adviser, an academic tutor, or on a medical form.

Whether you are on a course with fitness to practise requirements, which can broaden the situations where disclosure to the regulator or placement provider is justified.

Whether there is a live welfare or safety concern, which changes the analysis significantly.

Whether anything has already been shared that you did not expect, because that raises a possible complaint rather than a general policy question.

Practical next steps:

1. Read the university’s privacy notice and its student confidentiality or health and welfare policy. These will name the departments and third parties your information may be shared with. Ask the data protection officer for these if you cannot find them.

2. Put your wishes in writing to the relevant service, for example the disability or wellbeing team. State clearly who you are content to be told, what level of detail they may share, and that you do not consent to wider disclosure. Ask them to record this on your file.

3. If you use a disability adviser, agree a “student support plan” or similar that tells staff only the adjustments you need, not the diagnosis, if you prefer to keep the detail private.

4. Clarify your emergency contact arrangements and what would trigger the university contacting that person.

5. If you believe your health information has already been shared inappropriately, raise it first through the university’s internal complaint or data protection channel, asking what was shared, with whom, and on what lawful basis. Keep this in writing.

6. If the university’s response is unsatisfactory, you can complain to the Information Commissioner’s Office, which regulates data protection, about how your special category data was handled. For academic or service complaints you would use the university’s complaints process and then the Office of the Independent Adjudicator.

Summary:

As a general rule, the university should ask your consent before telling anyone about your health condition, and should share only the minimum necessary with people who genuinely need to know. The main exceptions are genuine emergencies and serious safety risks, legal or safeguarding obligations, and relevant formal university procedures such as fitness to study or fitness to practise. You can control most routine sharing by setting out clearly in writing who may be told and how much, and you have data protection rights to find out what has been shared and to challenge any sharing you think was unjustified.