skip to main content

Confidentiality — DFSRH MCQ

Instant feedback + full explanation. One question, done properly.

HardConfidentialityDFSRH

A 31-year-old woman reports rape by a recent partner. She attended a dedicated NHS sexual health service in England the following day and subsequently reported the offence to the police. The police send the service a written request for her complete sexual health record from the preceding 6 years, including contraception, pregnancy and STI consultations predating the alleged offence. The stated purpose is “to assess consistency and credibility”. The request does not identify a specific evidential issue, explain why less intrusive sources are inadequate, or state how the records will be handled. The investigating officer confirms that no operational concern prevents further specification. There is no court order, warrant or statutory duty to disclose. A general authority signed by the patient is attached. She tells the consultant that she signed after being told that otherwise the prosecution might not proceed; she had not understood that information could reach the defence. She now objects to release of any records. There is no current safeguarding concern or immediate risk of serious harm. Which is the most appropriate response by the sexual health service?

Educational content. Not a substitute for clinical judgement or local policy.

Reveal the answer and explanation

Correct answer: A — Preserve the records, disclose nothing currently, involve information governance, and request a focused compliant police request before independently reassessing lawful, minimum-necessary disclosure.

Explanation lettering: E = shown as A · D = shown as B · B = shown as C · A = shown as D · C = shown as E

The request is for highly sensitive third-party material about a victim and is neither focused nor demonstrably necessary and proportionate. The January 2026 statutory Code requires victim information requests to pursue a reasonable line of enquiry, minimise collateral information and, ordinarily, specify the information sought, the reason and how it will be handled. A third-party holder is not compelled to disclose merely because police have requested records and must determine its own lawful basis and data-protection compliance. The broad authority does not cure these defects. The Code recognises that the power imbalance between police and victims makes reliance on consent problematic; here the patient was inadequately informed and now expressly objects. With no compulsory process, statutory duty or serious-harm justification, disclosure should not occur while the request is reconsidered with information-governance or Caldicott input. A is wrong because a general signed authority does not justify an excessive disclosure. B remains disclosure under the defective request and overrides the patient’s current objection. C changes custody arrangements but not the lawfulness or proportionality of access. D reduces the volume disclosed, but the clinic should not itself construct an evidential case where no adequate lawful justification has been established. E preserves potential evidence while allowing a focused request and any subsequent minimum-necessary disclosure to be assessed independently.

Reference: Victim information requests: code of practice (12 January 2026) — https://www.gov.uk/government/publications/victim-information-requests-code-of-practice--2/victim-information-requests-code-of-practice-accessible Victim information requests: code of practice — third-party response and consent (12 January 2026) — https://www.gov.uk/government/publications/victim-information-requests-code-of-practice--2/victim-information-requests-code-of-practice-accessible HIV and Sexually Transmitted Infections guidance for health and care professionals (14 May 2026) — https://digital.nhs.uk/data-and-information/information-governance/guidance/hiv-and-sexually-transmitted-infections-stis/guidance-for-health-and-care-professionals