Professional standards, training and membership.
Professional standards, training and membership.
Ethics in IEMT Practice: Lesson 2.3
Confidentiality and Its Limits
Welcome
Clients can only speak openly if they trust that what they say will stay private. In this lesson we look at why confidentiality matters, the few situations in which it can be set aside, and the Association's step-by-step process for deciding whether to share information without consent. Lesson 2.5 deals with records and data protection.
Learning Objectives
By the end of this lesson, you will be able to:
- Explain why confidentiality matters and what the Association's policy says.
- Name the four grounds that may justify disclosure without consent.
- Recognise situations that do not, by themselves, justify disclosure.
- Follow the seven-step decision process and record your reasoning.
- Anonymise information properly when discussing cases.
Why confidentiality matters
Confidentiality supports autonomy (clients decide who knows about their lives), non-maleficence (a breach can cause emotional, social or financial harm) and integrity (being trustworthy with sensitive material). It is a duty in law as well as in ethics: information given in confidence is protected by the common law duty of confidence, and personal data is protected by data protection law.
I WILL RESPECT the secrets that are confided in me, even after the patient has died…
World Medical Association, Declaration of Geneva (2017)
The Association's starting point
The Breaking Confidentiality Without Consent Policy sets the default clearly: do not disclose confidential or identifying information to another professional, peer or organisation without the client's express written permission. There are exceptions, but they are narrow.
Confidentiality is strong, but it is not absolute.
The Association for IEMT Practitioners, Breaking Confidentiality Without Consent Policy, opening statement
Explain the limits at the start
Tell clients, in plain language and as part of agreeing to work together, how confidentiality works and where it stops. Revisit the explanation if things change. Clients are far better placed to trust you if they know the limits in advance, and any later disclosure will not come as a shock.
When disclosure without consent may be justified
The policy identifies four grounds. Each requires that the disclosure is necessary and lawful:
- Immediate or serious risk. You have credible information of a serious risk of death or significant harm, and disclosure is necessary to reduce it.
- Safeguarding. You need to protect a child or an adult at risk. Follow the Safeguarding Policy (Lessons 3.1 and 3.3).
- Legal compulsion. The law or a valid court order requires it. Confirm the authority and the scope first, where time allows.
- Vital emergency. The person cannot consent and limited information is essential to protect life or get urgent care.
Concern does not always mean disclosure
The policy is equally clear about what does not automatically justify a breach. Past abuse, distress, suicidal thoughts, unlawful behaviour, substance use or disagreement with a practitioner do not by themselves justify disclosure. Look at the present facts: how serious it is, how immediate, how vulnerable the person is, what protective factors exist, and what would be the effects of sharing and of not sharing. If you are unsure, seek advice.
If someone is in immediate danger, act: call 999. You do not need to go through the steps below first. Lesson 4.5 covers risk and crisis in more detail.
The seven-step decision process
When you are weighing up a disclosure, work through these steps. They come from section 4 of the policy.
- Address immediate danger. Call 999 if you need to.
- Clarify the facts. Separate what you saw or heard from assumption or hearsay.
- Consider consent. Ask the client, unless asking is unsafe, impracticable, legally prohibited or likely to frustrate protective action.
- Identify the authority and purpose. What legal basis allows this disclosure, and what is it for? Record the reason.
- Seek advice. Use the Association's safeguarding lead, your supervisor, your insurer, an employer or a legal adviser. Use anonymised information if you can.
- Share the minimum necessary. Give it to an appropriate recipient by a secure route.
- Record and review. Keep a factual, timely record of your decision, the advice you had, what you shared, who received it and what happened next.
Tell the client
Unless it would increase risk, prejudice an investigation, breach a legal restriction or expose someone else to harm, tell the client what you will disclose, to whom and why. If you do not tell them, record the reason.
A client's objection should be taken seriously, but it does not prevent a disclosure that is necessary and lawful.
The Association for IEMT Practitioners, Breaking Confidentiality Without Consent Policy, section 5
The HCPC's standards for regulated professionals take a similar approach: confidential information should be disclosed only with permission, where the law allows, in the service user's best interests, or in the public interest, for example to protect public safety or prevent harm to others. The government's information-sharing advice for safeguarding practitioners also stresses that fear of breaching confidentiality must never stand in the way of protecting a child or an adult at risk.
Worked examples
| Situation | Starting point |
|---|---|
| A client tells you she was abused as a child. The abuser is dead. | Not a ground for disclosure by itself. Listen, support, and think about whether anyone is at risk now. Suggest suitable specialist support. |
| A client says he has thought about ending his life but has no plan and wants to carry on living. | Not automatic disclosure. Assess present risk, stay within your competence, encourage contact with his GP or support lines, and agree a plan. If there is immediate danger, call 999. |
| A police officer phones asking whether someone is your client. | Do not confirm or share anything over the phone. Ask for the request in writing and take advice, unless it is an emergency. |
| A client's partner or parent phones asking how the sessions are going. | Do not confirm that the person is a client, unless the client has given written permission. Say that you cannot discuss anyone who may or may not be a client. |
| You receive a valid court order for client records. | Check its validity and scope, take advice, and disclose only what the order requires. |
| You hear a child is being harmed. | Follow the Safeguarding Policy: do not wait for certainty, and do not promise secrecy. See Lesson 3.3. |
Case discussion, supervision and training
You need to discuss cases in supervision and training. The policy says to use anonymised, altered or generalised material. Names are not the only identifiers: a place, an occupation, a rare event, a date or a combination of details can identify a person. Identifiable recordings, transcripts, messages or files must not be shared with peers, trainers or supervisors without express written permission or a documented lawful basis.
After a disclosure
- Continue only within your competence, and do not obstruct statutory or clinical action.
- Preserve your records and do not alter notes afterwards. If you must correct something, keep the original and add a dated note.
- If there was an error, follow the Duty of Candour Policy, and use the Adverse-Event Reporting Policy where appropriate (Lesson 4.4).
- Reflect on what you learned, without revealing unnecessary personal detail.
The duty of confidence and data protection law apply across the UK, and the UK GDPR applies in all four nations. Safeguarding and reporting law differs between England, Wales, Scotland and Northern Ireland, so check the rules for where your client lives. Outside the UK, different confidentiality and reporting laws apply. Check local law and your insurer.
The Official Facebook Group Policy says that identifiable client information, private correspondence and material from closed professional discussions must not be shared without clear authority, and that case material must be anonymised, altered, blended or generalised, with unnecessary identifying detail left out. It also says not to diagnose anyone or give personalised clinical instructions in the group, that promotional posts must follow the Advertising Standards Policy, and that questions about urgent risk, abuse, safeguarding or adverse events must go through the proper routes and not be argued in the group. Do not assume that a social-media group gives clinical confidentiality.
Self-Reflection Exercise
Review how you handle confidentiality now:
- Do you explain the limits of confidentiality at the start, in plain words?
- Could you work through the seven steps for a real or hypothetical case and explain each decision?
- How would you describe a case in supervision without identifying the client?
- Write down two improvements you will make.
Key Takeaways
- Confidentiality is strong but not absolute. The default is written permission before sharing.
- Disclosure without consent may be justified by serious risk, safeguarding, legal compulsion or vital emergency, and only if necessary and lawful.
- Past abuse, distress or suicidal thoughts do not automatically justify disclosure. Assess the present facts and take advice.
- Use the seven steps, share the minimum, tell the client where safe, and record your reasoning.
- Anonymise case material properly. Names are not the only identifiers.
Next Steps
In Lesson 2.4 we look at scope of practice, suitability and screening: how to decide whether IEMT is right for a particular person at a particular time.