Patients must be able to trust that what they discuss with their doctor is not simply shared with others.
That trust is at the heart of medical care. Every doctor is therefore legally bound by the duty of medical confidentiality.
Even so, medical data is sometimes shared wrongly — with family members, employers, insurers or other bodies. This article explains what medical confidentiality means, when a doctor may share information, and what you can do if your privacy has been breached.
What does medical confidentiality involve?
Medical confidentiality means that a doctor may not share any information about a patient with third parties, unless consent has been given or a statutory exception applies.
That duty is laid down in:
-
the Medical Treatment Contracts Act (WGBO), and
-
the Individual Healthcare Professions Act (Wet BIG).
Confidentiality binds not only doctors but also:
-
nurses, physiotherapists and psychologists;
-
dentists, specialists and other care providers;
-
and anyone with professional access to medical data, such as medical assistants and administrative staff.
In short: everything a patient says, everything that is examined and everything in the file falls under medical confidentiality.
Why does medical confidentiality exist?
Medical confidentiality is intended to protect the trust between doctor and patient .
Without that trust, many people would be reluctant to speak openly about their complaints, fears or history.
It therefore has a dual function:
-
protecting the patient’s privacy, and
-
promoting good care.
A doctor can only provide good care if the patient dares to be completely honest — and that is only possible where medical information remains confidential.
When may a doctor share information?
In principle a doctor may share nothing without consent.
But there are exceptions in which sharing information is justified or even required .
The main exceptions are:
-
The patient’s consent
Where the patient expressly consents to certain data being shared (with a partner or treating specialist, for instance), that is permitted.
That consent must be voluntary, specific and informed . -
A statutory duty
In some cases a doctor is legally required to provide information, for instance:-
to the public health service for notifiable infectious diseases;
-
to the police or prosecution authorities under a court order;
-
to insurers in certain medico-legal investigations, provided the patient has consented.
-
-
An overriding interest
In rare situations a doctor may breach confidentiality where there is an overriding public interest, such as preventing serious danger to others.
That is only permitted where there is no other way to avert the danger.
In such a case a doctor must always be able to explain why the duty of confidentiality was breached — and record that decision carefully.
When is medical confidentiality breached?
There is a breach where a doctor shares information without a legal basis or consent from the patient.
That can involve, for example:
-
passing medical data to the employer;
-
discussing your situation with family members without consent;
-
sharing information with an insurer or municipality without your knowledge;
-
sending medical information by unsecured e-mail;
-
or unauthorised staff viewing your file.
Such a breach is not only an invasion of your privacy, it can also lead to disciplinary, civil and criminal consequences for the doctor.
Consequences for the doctor
A doctor who breaches confidentiality can face:
-
a disciplinary measure (a warning, reprimand or even removal from the professional register);
-
liability for damages, if you suffered loss through the breach;
-
and in exceptional cases even criminal prosecution.
A patient can also complain to the hospital, the complaints committee or the Dutch data protection authority.
What can you do if your confidentiality has been breached?
If you suspect your medical data has been shared wrongly, you can take the following steps:
-
Ask the doctor or institution for an explanation
First ask your doctor or the institution what exactly happened and why your data was shared.
Sometimes it turns out consent was given, or that a statutory duty applied. -
Request access to your file
You have a right of access to your medical file. It can show who had access and which data was provided.
Read more about this in our article The medical file: access, copies and correction. -
Lodge a complaint with the care provider
Every care institution must have a complaints procedure. You can set out in writing what you believe went wrong. -
Lodge a complaint with the data protection authority
Where your medical data was shared without a lawful basis, you can complain to the authority for breach of the GDPR. -
Engage a lawyer
Where loss has arisen – emotional harm or reputational damage, for instance – you can consider holding the doctor or institution liable.
Evidence in a confidentiality breach
In many cases it is hard to prove that your data was actually shared.
A lawyer can help by:
-
relying on the GDPR or the Medical Treatment Contracts Act to demand access to log files (who viewed your file?);
-
hearing witnesses;
-
and analysing the correspondence with care providers in legal terms.
At Arslan Advocaten we support patients in gathering that evidence and in drawing up a formal notice of liability.
The link with medical liability
A breach of confidentiality can in itself be a ground for damages, but it also often plays a part in wider medical liability cases.
For example:
-
where confidential information was shared with an insurer during an ongoing personal injury case;
-
or where medical data was used without consent in legal proceedings.
In such situations there can be both a breach of privacy rights and a medical error.
Read more about this in our article Medical liability: when is a doctor or hospital liable?.
Why legal help matters
A breach of medical confidentiality is legally complex and touches both health law and privacy law.
At Arslan Advocaten we assess whether there was an unlawful act, help you obtain evidence, and recover any loss from the responsible party.
Our help is free of charge for victims, because the costs are recovered from the liable party.
Why choose Arslan Advocaten?
-
Specialised in medical liability and health law
-
Expert in privacy and confidentiality cases
-
Help with complaints, damages claims and gathering evidence
-
Free legal assistance for victims
We make sure your medical privacy is protected – and that breaches do not go unanswered.
Related legal services
Read also
- How does the personal injury procedure work?
- What does a personal injury procedure look like?
- Medical error by a dentist or oral surgeon: when is your dentist liable?
Frequently asked questions
When may a doctor share medical data without the patient’s consent?
A doctor may share medical data where there is a statutory duty — for notifiable infectious diseases or under a court order, for instance — or where there is an overriding public interest.
What are the main conditions for consent by the patient?
Consent must be voluntary, specific and informed, so that the patient knowingly agrees to particular medical data being shared.
Which care providers are bound by medical confidentiality?
Not only doctors, but also nurses, physiotherapists, psychologists, dentists and other care providers with access to medical data must respect confidentiality.
What can I do if I find my medical data has been shared wrongly?
You can complain to the care body concerned or to the data protection authority, and take legal steps if necessary to protect your privacy.
