GP breaching confidentiality in notes

I understand this must be distressing for you, and I appreciate you sharing the details. As a senior legal advisor specialising in the law of England and Wales, I will outline the relevant legal position and practical steps you might consider. Please note that my response is based on general principles, and the specifics could depend on factors such as the nature of the information disclosed, the reasons the GP gave (if any) for recording it, and any discussions about why it was added to your notes despite your request. If those details are available, they could refine the options.

### Legal Position
In England and Wales, GPs and other healthcare professionals owe patients a duty of confidentiality under common law, as reinforced by guidance from the General Medical Council (GMC). This means that personal information shared in confidence should not be disclosed without your consent, unless there is a legal requirement or overriding public interest (such as preventing serious harm to yourself or others). Additionally, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, your medical records are considered personal data, and processing them (including recording and sharing within the practice) must be lawful, fair, and transparent. Sharing within the surgery team might be justified if it is necessary for your care, but if the information was irrelevant or you explicitly asked for it not to be recorded, this could amount to a breach.

That said, GPs are required to keep accurate and complete records of consultations under NHS standards and GMC rules. If the information was clinically relevant, the GP might argue it was necessary to include it, even against your wishes. However, if it was purely personal and not pertinent to your health, recording and internal sharing could constitute a misuse of private information or a data protection infringement. You would need to assess whether the GP's actions were proportionate.

Potential claims could include:
– A complaint for breach of confidentiality or professional standards.
– A data protection complaint, if the processing was unlawful.
– In extreme cases, a civil claim for damages (e.g., for distress) under data protection law or for misuse of private information, though success would depend on evidence of harm and the GP's justification.

### Practical Options
It is often sensible to start with less formal steps to resolve this, as escalating to regulators or legal action can be time-consuming and stressful. I suggest proceeding in this order, focusing on evidence gathering first:

1. **Gather Evidence**: Before taking action, document everything you can recall. Note the date of the consultation, what you said to the GP (including your request not to record it), any response from them, and how you became aware that the information was added to your notes and viewed by others. Request a copy of your medical records from the practice (you have a right to this under data protection law, usually free of charge, though they can take up to one month to provide it). This will help confirm what was recorded and who accessed it.

2. **Informal Resolution with the Practice**: Contact the practice manager or the GP directly to express your concerns. Explain the impact on you and ask for an explanation, removal of the information from your records (if appropriate), and assurances it will not be shared further. Many issues like this are resolved at this stage, especially if the practice acknowledges an error. NHS practices have a duty to handle complaints promptly.

3. **Formal Written Complaint**: If informal discussions do not resolve it, submit a formal complaint in writing to the practice. Under NHS complaints procedures, they must acknowledge it within three working days and provide a full response, often within 25 working days (though this can vary). You can use the NHS complaints process, which is free and aims for resolution without escalation. Include details of how the breach has affected you emotionally.

4. **Escalation to Regulators or Ombudsman**:
– **Information Commissioner's Office (ICO)**: If you believe this involves a data protection breach, report it to the ICO. They can investigate and, if upheld, may require the practice to take corrective action. However, the ICO does not award compensation; it focuses on compliance.
– **General Medical Council (GMC)**: If you feel the GP's conduct fell below professional standards (e.g., disregarding your explicit request without good reason), you can complain to the GMC. They regulate doctors and can investigate fitness to practise, though they typically handle serious matters and may not act on isolated incidents.
– **Parliamentary and Health Service Ombudsman (PHSO)**: If unhappy with the practice's response to your complaint, you can escalate to the PHSO for an independent review. This is free and can recommend remedies, such as apologies or changes to procedures.

5. **Formal Legal Action**: As a last resort, you could consider a civil claim, for example, through the County Court for breach of confidence or under data protection law for non-pecuniary damages (e.g., for distress). However, this involves costs (potentially recoverable if you win), time (cases can take months or years), and the need for strong evidence. Litigation risk is a factor—courts might side with the GP if the recording was deemed necessary for your care. Mediation through services like the Civil Mediation Council could be a lower-cost alternative before court. Given the personal nature, you might also explore whether this qualifies for legal aid or no-win-no-fee arrangements, though eligibility is limited.

In terms of enforceability, regulators like the ICO or GMC can impose sanctions on the practice or doctor, but they do not directly compensate you. A court claim could, but proving quantifiable harm (beyond mortification) would be key.

If the information has caused you significant distress, you might also wish to seek support from organisations like Mind or Victim Support, though that is outside the legal realm. If you provide more details about the incident or what was disclosed, I can offer more tailored guidance. How would you like to proceed?