An Occupational Health consultation can only be useful when the worker can speak candidly. This medical confidentiality guide explains how to protect that trust while still giving employers the clear, functional advice they need to manage risk, absence and work participation.
For OH professionals, confidentiality is not a barrier to workplace decision-making. It is the framework that makes good decisions defensible. The practical challenge is separating information that an employer genuinely needs from clinical detail that belongs in the medical record.
Medical confidentiality is the duty to keep information obtained in a professional clinical relationship private, unless there is a valid reason to share it. In UK practice, this duty arises through common law, professional standards and data protection law. It applies to spoken information, consultation notes, test results, referral letters, emails, reports and information held in occupational health systems.
The employer may fund the service, but that does not make it the owner of an employee’s health information. Occupational Health is most effective when it maintains clinical independence. Your role is to assess health in relation to work, explain relevant risk and provide proportionate recommendations – not to pass on a diagnosis because it might be of interest to a manager.
In most cases, an employer needs to know whether someone is fit for work, fit with adjustments, temporarily unfit, or requires further assessment. They may need to understand restrictions, likely duration, safety implications and practical adjustments. They rarely need a detailed account of symptoms, treatment history or a diagnosis.
These concepts overlap but are not interchangeable. Confusing them is a common source of weak OH practice.
Confidentiality concerns whether it is appropriate to disclose information from the clinical relationship. A report to an employer will usually require the worker’s informed agreement to its content and release. Consent must be meaningful: the worker should understand the purpose of the assessment, who will receive the report, the likely content and the consequences of declining disclosure.
Data protection concerns how personal data is collected, stored, used and shared. Health information is special category data under UK GDPR. An OH provider and employer must identify an appropriate lawful basis and special category condition for processing. This will not always be consent in the data protection sense. For example, processing may be necessary to meet employment-law obligations, manage health and safety, or provide occupational medicine services, subject to appropriate safeguards.
That distinction matters. A signed management referral form does not give unrestricted permission to disclose everything learned in a consultation. Equally, a worker may agree to an OH assessment while declining to release a specific diagnosis. The clinician still needs to consider what functional advice can be provided safely and fairly.
Before the assessment begins, explain your role and the intended information flow. Use plain language. A worker should know that clinical notes remain confidential, while an agreed management report may cover functional capacity, restrictions, adjustments, prognosis where appropriate, and whether work is likely to aggravate a condition.
Check understanding rather than assuming it. This is particularly important where there are language barriers, anxiety, neurodiversity, low health literacy or an apparent power imbalance. A worker who believes they must disclose their diagnosis to keep their job may not feel able to make a free choice.
Where possible, discuss the proposed report before it is issued. This does not mean allowing the employee to dictate your professional opinion. It means ensuring they understand the wording, can correct factual errors and can make an informed decision about disclosure. Document the discussion and the outcome.
A high-quality OH report answers the management question without becoming a clinical narrative. It should be relevant, proportionate and written on the assumption that the worker may read it.
For a worker with depression, for example, the employer may need to know that concentration is currently reduced, night work may worsen symptoms, a phased return is advisable and review is needed in four weeks. The report does not usually need to identify medication, past episodes, therapeutic discussions or personal circumstances.
This approach also improves the quality of advice. Functional language prompts managers to focus on what can be changed at work: workload, shift pattern, exposure, travel, break arrangements, supervision, equipment or a phased return. It supports reasonable-adjustment discussions without positioning diagnosis as the whole answer.
There are exceptions. In safety-critical work, a more specific risk explanation may occasionally be necessary. Even then, disclose the minimum information required to explain the restriction. Ask yourself: could the employer implement this recommendation without knowing the diagnosis? If yes, the diagnosis usually stays in the clinical record.
The usual position is clear: do not disclose confidential medical information without the worker’s agreement. However, confidentiality is not absolute. Disclosure may be justified or required where there is a legal obligation, a court order, statutory notification requirement, or an overriding public-interest concern, such as a risk of serious harm to others.
These situations are uncommon and demand careful judgement. A manager’s concern, organisational inconvenience or a desire for reassurance is not enough. If a worker in a safety-critical role presents a credible and immediate risk, first consider whether the risk can be managed through discussion, temporary restriction or voluntary disclosure. If disclosure without consent may be necessary, seek senior clinical, medico-legal or professional advice wherever practicable, disclose only what is necessary, and record your reasoning in detail.
Health surveillance adds another layer. Employers may need confirmation that surveillance has been completed and whether an employee is fit to continue exposure-related work. They do not automatically need the underlying clinical findings. Keep clinical records separate from management outcomes, and ensure escalation pathways are clear where work-related disease is suspected.
Good confidentiality begins long before a report is sent. OH records should be factual, contemporaneous and limited to information needed for clinical care, surveillance or professional decision-making. Avoid speculative language, unnecessary third-party details and copied correspondence that adds no clinical value.
Access must be role-based. Managers should not have access to clinical consultation notes simply because they commissioned the referral. Occupational Health administration teams need clear boundaries, training and systems that prevent inappropriate viewing or forwarding of medical information.
Email is a frequent weak point. Verify addresses, use approved secure systems and send only the information required. A report containing sensitive information should not be copied casually to multiple managers, HR colleagues or personal email accounts. Once sent, you cannot retrieve it.
Retention periods depend on the purpose and record type. Some health surveillance records have specific statutory retention requirements, while general OH clinical records should be retained in line with organisational policy, legal requirements and professional guidance. Retaining information indefinitely “just in case” is not good data protection practice.
When a referral feels ethically uncomfortable, pause before drafting the report. A structured approach helps you move from uncertainty to a defensible decision.
First, clarify the genuine work question. Is the employer asking about fitness, risk, adjustments, attendance, capability or safety? Then identify the minimum clinical information needed to answer it. Consider the worker’s views, capacity to understand the process, the severity and immediacy of any risk, and whether advice can be framed functionally.
Next, decide what belongs in three separate places: the confidential clinical record, the worker discussion, and the employer report. This simple separation prevents over-disclosure. Finally, document your reasoning, especially if consent is withheld, a report cannot be issued, or you are considering an exceptional disclosure.
For doctors preparing for MFOM assessments and practitioners building day-to-day confidence, this is where case-based practice matters. Confidentiality questions are rarely testing whether you can quote a principle. They test whether you can apply it to competing duties: the worker’s privacy, the employer’s legitimate need for advice, public safety and your own professional accountability.
The most damaging errors are often routine rather than dramatic. Sending a report before agreement has been confirmed, copying clinical details from a GP letter, or writing “the employee has consented” without recording what they consented to can all create avoidable risk.
Another common mistake is treating refusal of consent as non-co-operation. A worker is entitled to maintain privacy. Explain the possible limits on your ability to advise the employer, explore whether a functional report is acceptable, and avoid pressure. The employer may still make an employment decision on the information available, but that decision is not a reason for the OH clinician to disclose more than is justified.
Confidentiality is not an administrative hurdle at the end of an assessment. It is a clinical skill expressed in the questions you ask, the notes you keep, the report you write and the boundaries you hold. When those boundaries are clear, workers are more likely to disclose what matters – and your workplace advice becomes safer, more credible and more useful.
