NHS sharing medical info with family without consent

Legal position:
In England and Wales, the sharing of your medical information by the NHS is governed primarily by the common law duty of confidentiality, the Data Protection Act 2018 (which incorporates the UK General Data Protection Regulation), and guidance from bodies such as the General Medical Council (GMC) and the NHS itself. As a general rule, the NHS must not share your personal medical information with anyone, including family members, without your explicit consent, unless there is a lawful basis for doing so without consent.

Exceptions where sharing without consent may be permitted include:
– Where it is in the public interest, such as to prevent serious harm to you or others (for example, in cases of suspected abuse or a notifiable disease).
– If you lack mental capacity under the Mental Capacity Act 2005, and sharing is deemed to be in your best interests (decisions would involve assessing your wishes, consulting relevant parties, and following a structured process).
– Legal requirements, such as a court order or statutory obligations (e.g., reporting certain infectious diseases to public health authorities).
– In emergencies, where immediate sharing is necessary to protect life or prevent serious harm.

Family members do not have an automatic right to access your records, even if they are next of kin, unless you have consented or one of the exceptions applies. For instance, if you are an adult with capacity, your spouse, parents, or children cannot demand information without your agreement. The NHS must balance confidentiality with any need to involve family in care, but consent remains key.

This position is subject to any recent updates; for example, NHS England's data sharing policies were reviewed in light of the Data Protection and Digital Information Bill (which is progressing through Parliament as of 2023), but the core principles of consent and lawfulness remain unchanged.

Practical considerations:
Whether sharing has occurred or could occur depends on specific facts, such as your age, whether you have capacity, the nature of the information, and the context (e.g., a GP practice versus a hospital setting). If the NHS has shared information without consent and no exception applies, this could amount to a breach of confidentiality or data protection law, potentially leading to a complaint or claim.

Options for addressing concerns:
1. Review your own records: You have the right to access your medical records via a subject access request under data protection law (usually free and within one month).
2. Contact the relevant NHS body: Speak to your GP practice manager or the hospital's Patient Advice and Liaison Service (PALS) to clarify what has been shared and why.
3. Formal complaint: If dissatisfied, make a written complaint to the NHS organisation involved, escalating to the Parliamentary and Health Service Ombudsman if needed.
4. Data protection route: Report suspected breaches to the Information Commissioner's Office (ICO), which can investigate and enforce.
5. Legal action: In serious cases, you could consider a claim for breach of confidence or data protection, but this involves weighing costs, evidence, and prospects of success—court proceedings are rarely the first step.

If your query relates to a jurisdiction outside England and Wales, please note that this assistant focuses on that area; for worldwide advice, I suggest consulting Atlas, our international legal specialist. If you provide more details about your situation (without sharing sensitive information), I can refine this advice accordingly.