Confidentiality and its limits

Keeping a patient’s information private is the default — with a small set of defined doors that let, or require, you to open it.

The idea

Confidentiality isn’t a nicety; it’s the foundation of trust that lets people tell a clinician the truth. So the starting rule is simple: share nothing without a basis. A family relationship, a phone call, or good intentions do not, by themselves, count as a basis.

But the default has exits. Some are permissions — the patient consents. Some are duties that override consent — a mandatory public-health report, or a serious and imminent risk of harm. Knowing confidentiality well means knowing exactly where each door is, and where discretion ends and duty begins.

How it works

Hold one picture in mind: a closed door that only opens for named reasons. Two of the reasons are permissions you seek; two are duties that can override the patient’s wishes.

default: confidentiality -- share nothing without a basis.

defined exits (the only doors out):
  1  the patient consents            -> disclose what they authorise
  2  mandatory reporting             -> certain public-health / safety
     (e.g. some communicable            conditions must be reported,
      diseases)                         consent or not
  3  serious & imminent risk of      -> duty to protect life outranks
     harm to self or others            confidentiality; disclose only
                                        what is needed to prevent harm
  4  minor-specific rules            -> adolescents may consent to some
                                        care confidentially; limits vary

not an exit: the medical record.
  a patient may not have clinically relevant facts left out
  of their chart -- the record must stay accurate and complete
  for safe care. (who may access it can sometimes be limited;
  the truth of it cannot.)

The exact reportable conditions, the age at which a minor can consent, and whether the law frames the safety rule as a duty to warn or to protect all vary by jurisdiction. The structure — a default of privacy with defined exits — is what stays constant.

When to use it

The situation	The move — and its limit
Anyone other than the patient asks for their information.	Default to protecting it; look for a specific, lawful basis first. Incapacity or an emergency shifts you to a best-interest judgment.
A safety concern about the patient or others surfaces.	Weigh seriousness and imminence; the duty rises with the risk. Over-disclosing on vague risk damages the trust that keeps someone safe.
A minor seeks care on a sensitive matter.	Offer confidentiality within your jurisdiction’s rules. Those rules — and the safety exceptions — vary widely; know your local law.

Watch out for

• Treating family as automatically entitled. A spouse, parent, or adult child has no default right to the information — the relationship is not consent.
• Confirming by denying. Even acknowledging that someone is a patient can be a disclosure. “I’m not able to share anything about who is or isn’t here” protects everyone.
• Waiting for certainty on safety — or over-reacting to vague risk. The duty turns on serious, imminent risk, not proof; but breaking confidence over a fleeting, low-acuity worry can drive a patient away.
• Falsifying or omitting the chart on request. You cannot leave clinically relevant facts out of the record; it endangers care. Address the privacy worry through access controls, not by editing the truth.
• Assuming one country’s rule everywhere. Reportable-condition lists, minor-consent ages, and duty-to-warn vs duty-to-protect differ by place — verify locally rather than generalising.

Worked example

An interviewer asks: “A patient’s wife stops you in the hall and asks how his surgery went. What do you do?” You don’t disclose in the hallway. You warmly explain that you can’t share his information without his say-so, and offer to ask him whether he’d like you to update her — or to join a conversation with his consent. The relationship is real; the authorisation still has to come from him. Now change the facts: the patient has told you, with a plan and the means, that he intends to seriously harm his neighbour. That opens a different door — the duty to protect can require disclosure to prevent imminent harm, and you share only what is necessary. Same principle, two doors: one waits for consent, the other is a safety duty.