In short
People have a right to expect that nurses will hold their information in confidence. The NMBA Code allows disclosure only where it is required by law, legally justifiable in the public interest, or needed to facilitate emergency care. Breaches are often unintentional: accessing a record without a care reason, discussing patients where they can be identified, or posting on social media. Even accessing a record out of curiosity is a breach, and audit trails record it. If a confidentiality notification is made, take advice, reflect honestly, and evidence a concrete change.
What is a confidentiality or privacy breach?
It is accessing, using or disclosing a person's information without a lawful reason connected to their care.
The NMBA Code of conduct for nurses is clear that people have a right to expect that nurses will hold information about them in confidence. Health information is also protected by privacy law, which allows it to be accessed, used and disclosed only for permitted purposes. A breach is any time you step outside those permitted purposes, whether by looking, telling or posting. For the wider process, see our guide to what happens after a notification to the NMBA.
What counts as a confidentiality breach?
More than you might expect, and most breaches are careless rather than malicious.
- Accessing a record you have no care reason to view
- Discussing a patient where they can be identified, including in lifts, corridors or at home
- Posting on social media in a way that identifies a person, even on a private account
- Sharing information with people outside the care team without authority
- Mishandling records, such as leaving notes visible or losing a device
Why is looking up a record a breach, even if I tell no one?
Because accessing information you have no care reason to see is itself a breach, regardless of whether you share it.
This is the point nurses most often underestimate. Looking up the record of a family member, a neighbour, an ex-partner, a colleague or a well-known person out of curiosity or concern, without being involved in their care, breaches confidentiality on its own. You do not have to tell anyone or act on the information. Health record systems keep audit trails that show who accessed which record and when, so unauthorised access is both detectable and traceable.
When are you allowed to disclose information?
The code allows disclosure in three defined situations, and only these.
Disclosure is permitted where it is
- Required by law, for example a court order or mandatory reporting obligation.
- Legally justifiable in the public interest, where the risk of not disclosing outweighs the person's privacy.
- Needed to facilitate emergency care, where sharing is necessary to treat the person safely.
Outside these situations, information should stay in confidence. If you are unsure whether a disclosure is justified, seek advice before you act, rather than after.
How does confidentiality apply to social media?
The same duty applies online, and posting identifiable patient information is a breach even on a private account.
The NMBA Social media guidance is explicit that posting unauthorised photographs of patients in any medium breaches privacy and confidentiality, including on a personal account even with the highest privacy settings. A person can be identifiable from details as well as images, such as a rare condition, a location or a date. The safest rule online is simple: if a post could let anyone identify a person in your care, do not publish it. This overlaps with professional boundaries and conduct, so treat your online presence as an extension of your professional one.
Can I talk about my shift, or debrief with colleagues?
Yes, but only in a way that keeps the person unidentifiable, and only with those who have a legitimate reason to know.
Nursing is emotionally demanding, and talking through a difficult shift is healthy and important. The line is identifiability. You can debrief with a colleague involved in the care, or with a supervisor or a support service, and you can discuss a case in general, de-identified terms for learning. What you cannot do is share details that let someone work out who the person is, whether at home with family, in a cafe, in a lift, or online. A useful test is to ask whether the person, or anyone who knows them, would recognise themselves in what you are saying. If they might, strip out the identifying detail or take the conversation somewhere confidential. Looking after your own wellbeing and protecting a person's privacy are not in conflict, and services such as Nurse and Midwife Support exist precisely so you can talk safely.
How should you respond to a confidentiality notification?
Take advice, be honest about what happened, reflect on the impact, and evidence a concrete change.
Contact your indemnity insurer, especially where access or disclosure is in question. Prepare a reflective account that shows you understand why the person's privacy mattered, and back it with remediation such as confidentiality CPD and a clear personal rule about access and disclosure. Honesty is important here, because unauthorised access is traceable and attempts to explain it away rarely help.
Illustrative example
The concern: A nurse looked up the record of a family member who was a patient elsewhere in the hospital, out of genuine worry, without being involved in their care.
Acknowledge: The nurse accepts that concern for a loved one did not authorise access, and that the person's privacy was breached.
Reflection: They reflect honestly on why the rule exists and how easily good intentions can cross the line.
Remediation: They complete CPD on confidentiality, and adopt a firm rule never to access a record without a care reason, seeking updates through proper channels instead.
How can CPD help with a confidentiality concern?
Targeted CPD on confidentiality gives dated evidence that you understand the rule and have changed how you handle information.
Confidentiality concerns are addressed by showing you understand exactly where the line sits and have embedded that in your practice. Structured CPD on confidentiality in healthcare, aligned with your CPD registration standard, evidences that understanding. Paired with a reflective account and a clear personal rule about access and disclosure, it directly answers whether the risk has been addressed. Browse the full range of CPD for nurses and midwives.
Matched to confidentiality concerns
Courses for a confidentiality notification
Structured CPD chosen for privacy and confidentiality concerns, to help you evidence remediation. Independent CPD you can use as evidence of remediation.
Ensuring Confidentiality in Healthcare Practice
- Directly targets the confidentiality concern
- Understand access, use and disclosure rules
- Evidence a clear personal standard
Professionalism and Boundaries in the Use of Social Media
- Address privacy risks online
- Understand what makes a person identifiable
- Evidence safer social media conduct
How to Ensure a Mistake or Misconduct Is Not Repeated
- Show the Board the breach will not recur
- Turn reflection into a lasting change
- Evidence a sustained safeguard
How to Deal With a Notification or Investigation
- Understand each stage of the NMBA process
- Know what to do, and what to avoid, early
- Respond calmly and well prepared
Official sources
Frequently asked questions
Is looking up a record a breach if I did not share it?
Yes. Accessing a record you have no care reason to view is a breach on its own, whether or not you share the information. Health systems keep audit trails, so unauthorised access is detectable and traceable.
Can I look up a family member's record if I am worried?
No. Concern for a loved one does not authorise access if you are not providing their care. Ask a treating colleague for an update, or go through proper channels, rather than opening the record yourself.
When can a nurse disclose patient information?
Only where disclosure is required by law, legally justifiable in the public interest, or needed to facilitate emergency care. Outside these three situations, information should be held in confidence, and advice sought if you are unsure.
Can a social media post breach confidentiality?
Yes. Posting information or photographs that identify a person in your care breaches confidentiality, even on a private account with the highest privacy settings. A person can be identifiable from details, not only images.
What if the breach was an accident?
Many breaches are careless rather than deliberate, and that context matters. The best response is still honesty: acknowledge what happened, reflect on why the duty exists, and evidence a concrete change so it will not recur.
Can I keep working during a confidentiality notification?
Usually yes. Most nurses keep working while a confidentiality matter is assessed. Your registration is only restricted if the Board takes immediate action, used in a small number of higher risk matters after a show cause process.
How serious is a confidentiality breach?
It varies with the facts. A careless, isolated breach that is honestly handled is often resolved with education, while deliberate access or disclosure, or a serious breach, can lead to conditions or referral to a tribunal.
Does CPD help with a confidentiality notification?
Yes. CPD on confidentiality, aligned with your CPD registration standard, gives dated evidence that you understand where the line sits and have changed your practice. It never guarantees an outcome, but it directly addresses the concern.
Dr Richard
Course Facilitator
A practising clinician with over 21 years of experience and postgraduate training in healthcare law and ethics, so every course reflects both clinical reality and Australian regulatory standards.
Written and reviewed by Dr Richard. Last reviewed . Read full profile
AHPRA Courses is an independent training provider. Our courses are structured CPD that practitioners can use as evidence of remediation. We are not affiliated with, endorsed by, or acting on behalf of Ahpra, the Nursing and Midwifery Board of Australia, or any other regulator. Courses provide evidence of remediation and do not determine the outcome of any matter. This article is general information, not legal advice. If you have received a notification, seek advice from your professional indemnity insurer or a health law solicitor.