HIV and Sexually Transmitted Infections (STIs) guidance for health and care professionals

Health and care professionals usually share information for individual care on the basis of implied consent. However, if you work in a dedicated sexual health service you must obtain the explicit consent of the patient before sharing relevant information with other health and care professionals outside your organisation such as their GP, even for individual care purposes. Further information about why this is the case is in the IG professionals section of this guidance.

It is important that patients understand how their information is used and shared. If you share HIV or STI information on the basis of implied consent, you must be confident that a patient has a reasonable expectation that this will happen. For example, if you refer a patient for treatment relating to their STI it is likely that they will expect that this information will be shared. However, patients may expect that information relating to HIV and STIs is particularly confidential, because it is treated differently in dedicated sexual health services. Therefore if you are not certain that the patient would expect their information to be shared, you must seek their explicit consent before sharing this information.

The Summary Care Record is created from GP records. HIV and STI diagnoses are excluded from the Summary Care Record unless a patient asks for this information to be included in which case it can be manually added by the GP practice. Whilst HIV and STI diagnoses are excluded from the Summary Care Record by default, prescriptions are included. It may be possible to infer a diagnosis from the prescriptions which have been issued to the patient. Patients can opt out of having a Summary Care record.

You should seek a patient’s explicit consent before allowing HIV or STI information to be visible in their shared care record.

Information relating to STIs or HIV which is recorded in the GP practice record may be visible to patients via the NHS App. GPs can redact this information if a patient requests for the information not to be visible. If you are uncertain whether the patient would want STI or HIV related information to be visible you should check this with them. If you work in another care setting and provide a patient portal for patients to view their records, you should engage with patients to ensure that they are happy for information relating to HIV or STIs to be visible on the portal. Patients increasingly have access to their records online and new diagnoses may be visible to them before there has been a discussion of the results with their clinician. Local procedures should be followed to mitigate this risk.

Patients may have specific personal circumstances for not wanting information to be shared. If a patient does not wish to share their information you can discuss this with them, including any impact this might have on their care.

If they still do not wish to share you should generally respect their decision and note this on their record. Exceptions include:

• where there is a legal requirement to share information
• where you decide there is an overriding public interest (as described in the next section)
• where, in your professional judgement, you have concluded that the patient lacks mental capacity to make this decision and, following the principles of the Mental Capacity act 2005, it is considered to be in the patient’s best interests to share the information.

Where a patient lacks capacity you must consider the urgency of the information sharing request. If it is possible to wait until the patient regains capacity, you should do so. You must take into account any wishes or indications that the patient expressed when they had capacity before deciding to share information in the patient’s best interests.

Where a person is diagnosed with HIV or an STI, you should ask or encourage them to inform other people such as a partner or recent sexual contact who may be at risk of serious harm or death from an undiagnosed infection. You could also offer to inform those at risk on behalf of the patient, without disclosing their name, if they would prefer you to do so.

If they refuse, you may nevertheless need to inform those people if they are at risk of serious harm or death. This should generally be done without disclosing the name of your patient or client to the individual who is at risk. This disclosure must not be taken lightly, and a robust justification is required. You must be convinced that the public interest to protect others from serious harm outweighs the person’s right to confidentiality and the public interest in maintaining a confidential health service. Where you have made a disclosure in the public interest you should generally inform the patient unless there is a valid reason such as it would put people at risk or prejudice a criminal investigation.

Similarly, if you receive a request from the police then relevant and necessary information should only be disclosed without explicit patient consent if it is in the public interest and there is a risk of serious harm or death to an individual. For example, a police investigation into a case where a patient may intentionally or recklessly have passed on an infection during sexual activity with others.

You should consult your IG team and Caldicott Guardian before making a public interest disclosure decision.

You are legally required to report suspected cases of certain infectious diseases. Some can be transmitted sexually (for example hepatitis B and hepatitis C) and others are commonly spread within sexual networks (mpox). A full list together with information about how to report a notifiable disease is on gov.uk

If you are concerned or unsure about how to deal with a request to share patient information, check with your IG team, Caldicott Guardian or senior team for advice.