When Confidentiality Silences the Patient: The Hidden Risk of Recording Family Disclosures in GP Systems

In the course of primary care, it is not uncommon for family members to speak to GP practices on behalf of a patient, perhaps to express concern about a loved one’s mental health, disclose worries about domestic abuse, or share information they believe could be clinically relevant.

These conversations are often prefaced by a promise of confidentiality, intended to reassure the relative that what they say will not be disclosed to the patient. Yet when these disclosures are then recorded in the clinical record, a significant and underexplored risk emerges.

Before anything is added to the patient record, it is worth first asking: does this information need to be recorded at all? In many cases, it may be more appropriate to signpost the caller to external support services, or encourage them to attend with the patient to explore their concerns together. Where recording is justified, GPs should take care with promising that the content will be hidden from the patient.

Once information is embedded in the patient’s record, it becomes part of the data landscape that shapes their care. More problematically, it may be used in clinical reasoning or decision-making without the patient ever being aware of its presence, or its accuracy. If a concerned family member makes an allegation, misrepresents a situation, or simply misremembers, the patient may live with the consequences of this data point without the opportunity to see, challenge, or correct it.

This presents a conflict at the heart of data protection and clinical ethics. Under UK GDPR, individuals have the right to access and rectify personal data held about them. But when third-party data is included in their record under the label of “confidential information,” these rights may be effectively nullified. The patient cannot access what has been said about them, nor can they contest its relevance, accuracy, or fairness.

From an information governance perspective, this practice risks creating unaccountable shadow narratives in clinical systems—statements that affect patient care but are insulated from challenge. While clinicians are rightly cautious about breaching the trust of those who come forward with sensitive information, this cannot come at the cost of undermining the data subject’s fundamental rights or autonomy.

The solution lies in clear boundaries and robust protocols. If information is to be kept confidential from the patient, it should be recorded in a way that does not conflate it with verified clinical fact. Above all, GP practices must be transparent about the limits of confidentiality and avoid giving blanket reassurances that cannot be ethically or legally upheld once data enters the formal record.

In trying to protect families, we must take care not to disempower patients, especially in matters that affect their care, rights, and dignity.