Lawful sharing, consent and confidentiality

A digital sharing duty must be implemented with both a data-protection basis and a justification for using or disclosing confidential information. The UK General Data Protection Regulation (UK GDPR) supplies the personal-data framework discussed here. The two checks determine what information can move and who may use it. They apply when a care team reads a shared record as well as when a provider sends a message. ^{001, 002, 006}

For a hospital discharge, identify the authority requiring the handover, then establish why the named receiving team may obtain this person's information. The requirements table identifies the digital obligation; this chapter explains the information-law conditions on it. Individual care is the main worked setting, with planning, research and public health explained in the purpose-specific account.

Consent has more than one legal role

Consent to treatment, consent to disclose confidential information and consent as a UK GDPR lawful basis concern different decisions. A service may rely on public task for data protection while relying on the patient's explicit or implied consent for confidentiality. Calling a form a consent form does not settle every legal issue. ^{006, 029}

GMC direct-care guidance permits implied consent where the person is providing or supporting the patient's care, information about sharing is readily available, no objection is known, and recipients respect confidence. Unexpected access or sharing can require explicit consent. These are conditions on professional practice, with national guidance and applicable law also relevant. ¹⁷⁴

Health and social care staff can form part of an individual's care team. That does not make every interagency disclosure expected or every staff member an appropriate recipient. Northern Ireland's code has specific guidance about discussing planned involvement of other agencies and seeking explicit consent. The NI account preserves that distinction. ⁰⁸³

The data-protection basis for care

Article 6 requires a lawful basis. A public healthcare organisation can rely on necessary performance of its legally founded public task where the conditions are met. A specific legal obligation may support another basis. The organisation must connect the chosen basis to its own purpose and responsibilities. Public funding does not automatically give another controller the same public task. ^{001, 025}

Health information also needs an Article 9 condition. Article 9(2)(h) addresses necessary processing for specified health and social care purposes, subject to law or the qualifying professional-contract route and secrecy safeguards. DPA 2018 Schedule 1 paragraph 2 supplies the domestic health/social-care condition; section 11 and Article 9(3) address confidentiality safeguards. This framework can support individual care without using UK GDPR consent as the lawful basis. ^{002, 003, 024}

The current amended Article 6 excludes both ordinary and recognised legitimate interests for public authorities performing their tasks. The 2025 Act's amendments therefore do not create a general shortcut for public healthcare sharing. Private providers need a basis appropriate to their own processing. ^{001, 028}

Duties and powers do not all override confidentiality

England's section 251B is a sharing duty with conditions and exceptions. Its wording expressly preserves data protection and common-law confidentiality. Scotland's section 49 integration power contains a defined confidentiality override, within its statutory recipients and purposes. Their different effects show why the exact provision matters. ^{010, 062}

An information-sharing agreement can describe purposes and responsibilities. It cannot create missing legal authority or remove a statutory restriction. A shared digital record similarly provides a means of access; its users still need a justified care relationship and lawful use. ⁰⁰⁵

Objections, capacity and urgent care

A patient's concern about sharing requires an informed discussion and a legally justified response. Implied consent cannot simply be assumed after an objection. Urgent care, incapacity and a serious public-interest justification have their own conditions. The applicable national law and professional guidance determine the response. ^{006, 174}

Capacity is decision-specific. A relative's involvement does not itself establish authority to decide or obtain a full record. The four-nation discharge map now identifies the principal age, capacity and representative-authority rules. It preserves remaining case-specific limits in the validation queue.

A continuing purpose boundary

Using information for the person's care does not settle later use for research, planning or product development. Article 5 maintains purpose and minimisation requirements, alongside confidentiality. The planning, research and public-health account explains those purpose boundaries. ¹⁷¹

Continue to patients' rights and organisational accountability, digital exchange or the national comparison.

The protection account applies these tests to child/adult concerns and cross-agency sharing. Its examples separate necessary protection disclosure from online representative access.