HIV and Sexually Transmitted Infections (STIs) guidance for patients and service users

You can choose to access sexual health care in different ways, for example via a dedicated sexual health service or via your GP practice. You have a right to privacy and confidentiality, and for your personal information to be kept safe and secure no matter how you access care.

If you are living with HIV and have been a victim of a data breach in relation to your HIV status or personal information, the Information Commissioners Office (ICO) has published advice on how to make a complaint.

When you visit a dedicated sexual health service, the information recorded about the services you receive from the sexual health clinic will not be shared with others caring for you outside the dedicated sexual health service unless you give your explicit consent. For example, the information would not be shared with your GP or hospital consultant. Explicit consent is a very clear and specific statement or indication of your wishes. It can be given in writing, for example by signing a declaration, or verbally.

You can choose to register at sexual health clinics under an alias. However this is not encouraged - you can be assured that your sexual health record will not be connected to your other NHS records. We encourage you to use your real name, because you are more likely to remember it as the name you registered with us if you seek care at later date, this helps us keep track of your medical history for safest care.

Other health services providing STI and HIV services, such as infectious disease clinics in hospitals that regularly treat people living with HIV, or your GP practice, are not dedicated sexual health services. The information you provide will be linked to your NHS number, including personal details such as your real name, address and how to contact you as well as information about your care such as symptoms and previous treatments.

If you provide information relating to your HIV or STI care with your GP or other care providers, for example a hospital, those caring for you must inform you of how it will be shared. It is your right to be informed about how your information is shared so you should feel confident about asking for further information if you are not sure.

Only relevant information will be shared with those caring for you. For example, if your GP referred you to a specialist for treatment for genital warts, relevant information about your condition would be shared with the specialist. If you have an STI test outside a dedicated sexual health for example at a hospital appointment, or an opt out HIV test in an emergency department, the test request and its results may be visible to others providing care for you

Some information from your GP practice record is included in the Summary Care Record. An HIV or STI diagnosis would not be included in your Summary Care Record unless you request that your GP practice adds this. However, any medication you are taking would be included. It may therefore be possible for those accessing your Summary Care Record to work out your diagnosis from the medication you are taking. The Summary Care Record can be requested by other health care providers, for example a hospital, if they require your medical history in order to provide safe care to you. You can opt out of having a Summary Care Record by completing a patient consent preference form and returning it to your GP practice.

You may also have a shared care record. Your care team should ask your explicit consent before any information relating to HIV or STI is accessible via your shared care record. If you choose not to share a diagnosis in your record, your medication may still reveal it, so you may also choose not to share your medication as well. However, this may have an impact on the care you receive.

Information in your GP record may be available for you to read via the NHS App. Use of the NHS App is optional. You can also ask your GP practice if you do not want a specific piece of information to be visible via the NHS App. If you can see your records via another patient portal, for example one provided by your hospital, then you should speak to those caring for you if there is information that you do not want to be visible. They will be able to advise you on how to ensure information is not visible to you via the portal.

If you do not want your information to be shared with other health and care professionals involved in your care, you should speak to those caring for you. To help you decide whether to share, any possible consequences of not sharing your information will be explained, for example, the impact this could have on your care. There may be good reasons to share the information with others. For example, your GP may need to know about your diagnosis to ensure the different medications you are taking are safe to be taken together. However, your choice not to share with others caring for you will be respected unless it would put someone else at risk of serious harm, or if your health and care professional considers that you do not have sufficient mental capacity to make this decision (further information is in the section for healthcare professionals).

If you do not have capacity to make a decision, your care team will need to consider the urgency of the information sharing request. If they can wait until you regain capacity so that you can make the decision yourself, they will do so. However, where your care team has assessed that you lack capacity to make this decision, they will make a decision in your best interests. Your care team will consider any wishes or indications relating to information sharing you may have made when you have had capacity in the past before deciding whether it is in your best interests to share information.

If you are diagnosed with HIV or another STI, you may be asked to inform other people who are at risk. For example, people who you have recently had sex with, so they can get tested and treated as needed. If you do not wish to inform other people yourself, those caring for you may offer to do this on your behalf with your consent. For example those caring for you may be able to notify a person that they have recently been in contact with someone who has tested positive for an STI and that they should get tested. This may help to preserve your anonymity. However, if you do not consent to any affected people being informed, the care team, where they hold contact details for those affected, may need to inform them without your consent. Any decision to inform a person without your consent is not taken lightly. The care team looking after you must be convinced that other people, for example a partner or someone you have recently had sex with, are at risk of serious harm before informing them. It is best practice for the care team to notify you of any information they have shared, unless there is a valid reason not to for example if it would impact a criminal investigation.

Research and planning

Information relating to HIV and STIs is important for research and planning, for example to research new treatments. Whenever possible, data used for research and planning is anonymised so that you cannot be identified. You cannot opt out of anonymous information being used for research.

If identifiable information is required, then you will usually be asked for your explicit consent. If it is not possible to seek your consent, special approvals are required, and these are managed by the Health Research Authority. You can read more about special approvals and the safeguards in place on the Understanding Patient Data website by scrolling down to the ‘What organisations are involved?’ section and looking under the ‘Health Research Authority’ tab. Even if a research programme has received special approval, you can still opt out of your identifiable data being used: either by opting out of an individual piece of research when you are informed about it or by opting out of your information being used for research and planning via the NHS website.

UK Health Security Agency

HIV and STI data, which does not include information that could be used to identify you, is shared securely with the UK Health Security Agency (UKHSA). This helps experts understand trends, for example numbers of people being tested for HIV and other STIs, and whether the number of new diagnoses is increasing or decreasing. The UKHSA also aims to detect possible outbreaks of disease and epidemics as rapidly as possible.

Infectious diseases

 It is the law that all medical staff in England, including those working in dedicated sexual health services, must inform the UKHSA if you have one of the infectious diseases listed here. The diagnoses that a dedicated sexual health service would report to the UKHSA include hepatitis A, hepatitis B, hepatitis C, dysentery and mpox. The report from medical staff to the UKHSA may include information which identifies you but only relevant clinical information for health protection purposes, for example your name, address, when you started to have symptoms and the date of diagnosis. Staff will normally inform you if they need to submit a report.

Information required by law

 There are times when a healthcare organisation must share information because they are required to do so by law, for example where there is a court order. Where information is required by law you cannot object to the information sharing.

The organisation providing you with care will give you further details about how they use and share your information. This may be provided in leaflets or on their website for example. You can also ask those caring for you if you need to know more about how they share your information.