Hospital breach of patient confidentiality

Confidential medical information disclosure by a hospital is a serious matter. You have several potential avenues depending on the circumstances, the nature of the information disclosed, who it was disclosed to, and what harm (if any) it has caused you.

Legal framework:

Your medical information is protected by several overlapping legal regimes in England and Wales.

1. The UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Health data is "special category data" attracting the highest level of protection. A hospital disclosing it without a lawful basis is likely a breach of data protection law.

2. The common law duty of confidentiality. There is a long-established legal duty on healthcare providers not to disclose patient information without consent or other lawful justification.

3. The Human Rights Act 1998, Article 8 (right to respect for private and family life). In some cases a disclosure may engage this right, particularly where a public authority is responsible.

4. NHS-specific obligations, including the NHS Confidentiality Code of Practice and professional duties on individual clinicians under GMC or NMC guidance.

Practical steps in a sensible order:

1. Record what happened. Write down exactly what was disclosed, to whom, when, and how you found out. Keep any letters, emails, or other evidence. Note dates carefully.

2. Raise a formal complaint with the hospital. Use the NHS Complaints Procedure (or the hospital's internal complaints process if it is a private hospital). The hospital must acknowledge your complaint within three working days and respond within a reasonable time, usually up to six months. Ask specifically what went wrong, what they are doing to prevent a recurrence, and what remedy they propose.

3. Report to the Information Commissioner's Office (ICO). You can lodge a complaint with the ICO about the data protection breach. The ICO can investigate, issue enforcement notices, and in serious cases impose fines on the organisation. You do not need to have suffered financial loss to complain to the ICO. It is usually sensible to complain to the hospital first, but you can go to the ICO at the same time if you prefer.

4. Consider the Parliamentary and Health Service Ombudsman (PHSO). If the hospital's complaint response is unsatisfactory, you can escalate to the PHSO. They can recommend remedies including apologies, action plans, and financial redress for injustice.

5. Consider a compensation claim. You may be entitled to compensation under Article 82 of the UK GDPR for material damage (financial loss) or non-material damage (distress). The courts have awarded damages for distress caused by data breaches, though the amounts for a single accidental disclosure without wider harm tend to be modest unless the consequences were significant. You can bring a claim in the County Court. You do not need to go to the ICO first, but an ICO finding can support your case.

6. Consider a claim for breach of confidence or misuse of private information. These are separate causes of action that can also give rise to damages, and may be relevant depending on the facts.

Important factors that affect your options:

The seriousness of the breach matters. A letter sent to a wrong address that was returned unopened is treated very differently from sensitive mental health or sexual health records being disclosed to your employer or family members.

Whether the hospital self-reported the breach to the ICO within 72 hours (as required for significant breaches under Article 33 UK GDPR) may indicate whether they are taking it seriously.

Whether you have suffered identifiable harm, distress, or consequences as a result will affect the value of any compensation claim and how vigorously it is worth pursuing.

Time limits:

For an ICO complaint, there is no strict statutory time limit but the ICO generally expects complaints within three months of the last meaningful contact with the organisation.

For a court claim for compensation under the UK GDPR or for breach of confidence, the limitation period is six years from the date of the breach (Limitation Act 1980).

For the PHSO, you normally need to refer within 12 months of becoming aware of the matter, though extensions are possible.

If you can share more detail about what was disclosed, to whom, and what impact it has had, I can give you more targeted guidance on which route is likely to be most effective in your situation.