CP
CareerPro UK
CPD Courses / Online course

Confidentiality, Information Governance and AI in Clinical Practice

Introduction

Person spec essential Information governance appears on most NHS person specifications

Information governance is on NHS person specifications, and confidentiality dilemmas are classic interview questions. Know exactly when to share, when not to — and how to use AI tools safely.

  • Clear answers for real dilemmas: the DVLA, police requests, relatives on the phone, knife wounds
  • Up to date with 2026: new data law, the NHS AI scribe registry and the MHRA's ruling on AI scribes
  • A disclosure decision record you can download and use on your next shift
Format
6 short modules · about 10 min each · stop and come back any time
Slides
23
Quiz
15 questions
Pass mark
12/15
Studying
Free
Certificate
£7 after you pass
or save up to 60% with a bundle
Last reviewed
October 2026 · how we check our courses

Free sign-up with your email unlocks this course and every other course, and your progress is saved on this device. When you pass, get your certificate for £7 — evidence for your CV, appraisal and interviews.

A doctor working on a laptop with a stethoscope on the desk
Sample CareerPro UK certificate of completion with QR verification code

Finish with evidence you can show

Complete the course and pass the short quiz to earn a certificate of completion you can show to shortlisters, appraisers and interview panels.

  • A verifiable certificate with a QR code — for your CV, portfolio and appraisal
  • An appraisal-ready reflective note, pre-filled with the learning outcomes
  • A ready-made CV line and a supporting-statement paragraph for NHS Jobs and Trac
  • Add it to your LinkedIn profile in one click
  • Pay £7 only at the end, and only if you pass — or save with a bundle
On your CV — Courses and CPD
Confidentiality, Information Governance and AI in Clinical Practice — online CPD course, CareerPro UK (CPD time shown on your certificate). Certificate of completion, November 2026; verifiable online, ID CP-XXXXXXXX.
Prepares you for questions like
“A patient with epilepsy tells you he will keep driving. What do you do?”

Person specifications ask for 'an understanding of information governance', and confidentiality dilemmas — the police at the front desk, a patient who shouldn't be driving, a relative on the phone — are classic interview and real-life scenarios. This practical course explains the GMC's rules and the eight Caldicott Principles, when you can and must share information (consent, the law, the public interest), the DVLA, police and safeguarding, patients' rights to their records, record keeping, data security and breaches, and how to use AI tools — including the AI scribes now arriving in NHS clinics — safely and lawfully. You decide 'share or not share?' in real-style cases and build a disclosure decision record you can download.

What you'll learn

  • Explain the duty of confidentiality and the legal framework (common law, UK GDPR, Data Protection Act 2018, Human Rights Act)
  • Apply the eight Caldicott Principles, including the duty to share for individual care
  • Decide when to share with consent, when the law requires disclosure, and when it is justified in the public interest
  • Handle common dilemmas: DVLA, police requests, gunshot and knife wounds, relatives, young people and safeguarding
  • Respond to subject access requests and understand patients' rights to their records
  • Keep good records and prevent and report data breaches
  • Use AI tools, including ambient scribes, safely, lawfully and honestly
  • Record and explain disclosure decisions, and answer confidentiality questions at interview

Course outline

1Foundations: why confidentiality matters
  • Welcome — trust depends on confidentiality — Patients tell doctors things they tell no one else. If they can't trust us to keep their information safe, they may not seek care or may hold back what matters.
  • What confidentiality means in everyday NHS work — The duty of confidentiality means that information you learn about a patient in your professional role must not be shared without a proper reason.
  • The legal and professional framework — Several sources of law and guidance apply at the same time. You do not need to be a lawyer, but it helps to know what each one adds, because they answer slightly different questions.
  • The eight Caldicott Principles — The Caldicott Principles are the NHS's practical rules for using patient information. They were first written in 1997 after a review of how patient information was used in the NHS, and were last updated in 2020.
2Sharing information: consent, law and public interest
  • When can you share? Three routes — This is the most important slide in the course. Under GMC guidance, there are three main routes by which you may share confidential information. If none of them applies, you should not share.
  • Disclosing in the public interest — Disclosing without consent in the public interest is a serious step, and it is a judgement, not a rule.
  • Information the law requires you to share — Some disclosures are not a matter of judgement: the law requires them. In these cases you do not need the patient's consent, although it is usually good practice to tell the patient what you are sharing and why.
  • Share or not share? Test yourself — Try these short cases. For each one, ask yourself which of the three routes applies — consent, law or public interest — before choosing your answer.
3Common dilemmas: DVLA, police, relatives and more
  • Fitness to drive and the DVLA — Drivers are legally responsible for telling the DVLA (or DVA in Northern Ireland) about conditions that may affect safe driving. The GMC's explanatory guidance sets out what doctors should do.
  • Practise — the patient who keeps driving — Patients often react to driving advice with fear, because driving can mean their job, their independence or caring for their family.
  • Police, knife and gunshot wounds — The police have no general right to see medical records or to be told whether a patient is in hospital. They need the patient's consent, a legal requirement, or a public interest justification.
  • Relatives, carers and the telephone — Relatives are usually trying to help, and most patients are happy for their family to be kept informed. Problems arise when we assume this without asking, or when we cannot be sure who we are speaking to.
  • Young people, safeguarding, death and the media — These situations come up less often, but they are where doctors are most likely to be unsure. The general rules still apply — consent, law, public interest — with some extra points for each group.
4Records, rights and data security
  • Patients' rights to their records — Patients have a right of access to their own records (a subject access request) under data protection law.
  • Good record keeping — Good records are part of confidentiality as well as safe care.
  • Everyday data security — Most data breaches in the NHS are not caused by hackers. They are caused by ordinary people in a hurry: an email to the wrong address, a list left behind, a screen left unlocked, a photo taken on a personal phone.
  • Data breaches — A personal data breach is any security incident that leads to personal data being lost, destroyed, changed, or disclosed to or accessed by someone who should not have it. Breaches happen to careful people too.
5AI and digital tools
  • AI scribes in NHS practice — Ambient voice technology (AVT, or 'AI scribes') listens to a consultation and drafts notes, letters or codes. NHS organisations are being encouraged to adopt it.
  • Chatbots and other AI tools — General-purpose AI chatbots are easy to use and can be helpful for learning, drafting non-clinical text or summarising published guidance.
6Your evidence: CV and interviews
  • Record a disclosure decision — Whenever you share — or decide not to share — information without consent, record your reasoning. Practise with a real or realistic case. Your answers are saved on this device and you can download them.
  • Confidentiality questions at interview — Confidentiality scenarios are popular at NHS interviews because they test judgement, knowledge of GMC guidance and communication in one question. Interviewers are not looking for a perfect legal answer.
  • Using this course in your NHS application — Shortlisting for NHS posts is usually done by scoring your application against each criterion in the person specification, which are listed as essential or desirable.
  • Summary — When in doubt, slow down and ask: Why is this being shared? Which route applies? What is the minimum? Who can advise me? And have I written it down? Those five questions will get you through almost any confidentiality dilemma.

Frequently asked questions

Is the Confidentiality, IG & AI course free?

Yes. The Confidentiality, IG & AI course is free to study online after a quick free sign-up with your name and email. Studying is free. If you want a certificate of completion, it costs £7, and you pay only after you pass the quiz.

Who is this course for?

Foundation to intermediate — for doctors at every grade, including international medical graduates. It is written for NHS doctors and international medical graduates (IMGs).

What will I learn?

You will be able to: explain the duty of confidentiality and the legal framework (common law, UK GDPR, Data Protection Act 2018, Human Rights Act); apply the eight Caldicott Principles, including the duty to share for individual care; decide when to share with consent, when the law requires disclosure, and when it is justified in the public interest; handle common dilemmas: DVLA, police requests, gunshot and knife wounds, relatives, young people and safeguarding; respond to subject access requests and understand patients' rights to their records; keep good records and prevent and report data breaches; use AI tools, including ambient scribes, safely, lawfully and honestly; record and explain disclosure decisions, and answer confidentiality questions at interview.

How long does it take?

The course has 6 short modules of about 10 minutes each, and your progress is saved so you can stop and come back. Your certificate records your learning time for your appraisal portfolio.

Is the course accredited?

Online course — does not replace mandatory data security awareness training. The certificate confirms completion of self-directed learning, which you can record in your appraisal portfolio with your own reflection.

Can I use it in my NHS job application?

Yes. List it under 'Courses and CPD' on your CV and in the education or training section of your NHS Jobs or Trac application, and use what you learned as evidence in your supporting statement. The certificate has a QR code so shortlisters can verify it.

✍️ Writing your NHS supporting statement? See an example paragraph for this criterion and examples for every other common person specification point.

Independent study guide by CareerPro UK, reviewed October 2026. About this course

This is an independent study guide to confidentiality and information governance for doctors in the UK, written in our own words from publicly available GMC guidance and UK law. It is not legal advice and does not replace your organisation's mandatory data security training or its policies. Data protection law is being updated by the Data (Use and Access) Act 2025, and NHS guidance on AI tools is developing — follow your organisation's current policies and ask your information governance team or Caldicott Guardian.

CareerPro UK is an independent education provider. Our courses are not produced, endorsed, approved or accredited by the General Medical Council (GMC), the NHS, NICE, any Royal College or any other official body, and we are not affiliated with them. Courses are study guides written in our own words from publicly available guidance. They do not replace the official guidance, which can change — always check the current version (e.g. at gmc-uk.org and nice.org.uk). They are not legal or professional advice: for a specific situation, follow your employer's policies and speak to your seniors or your medical defence organisation.