Privacy and Confidentiality
Who may know? — the circle, the exceptions, the family, the record, and the law
The circle
What this lecture is about
Lecture 2 asked by what authority you practise, and Lecture 3 asked whose work it is. This one asks the question a patient is asking every time they answer you: who may know? The answer is short, and the rest of the lecture is what it costs to keep it. Inside the circle drawn around the consultation, the information belongs to the patient. Outside it, nobody may know without the patient's consent, except in a short list of situations that the Law, the Commission's Code and, since 2023, the Personal Data Protection Law each write down.
The lecture has six parts. The circle and where the duty comes from. What it demands on the ward, in the examination room, in the record and in conversation. The exceptions, which are narrow and serious. The family, and the digital record. The three legal instruments that now stand behind all of it. And two cases from Chapter 6.
Three of the four cases in Chapter 6
None of these is rare, and none of the people in them thinks they are doing anything wrong. The colleague's purpose is educational. The husband is family. The relatives are frightened. Each is asking, in effect, to be let inside the circle, and each is asking someone other than the patient. By the end of the lecture you should be able to say, for each one, who owns the information, who may receive it, under which rule, and what you say to the person asking.
The fourth case in the chapter, the bus driver with epilepsy who is still driving, is the hardest, because there the patient's own confidence has to be weighed against a stranger's safety. It is one of the two cases worked at the end.
The book's opening idea
Chapter 6 asks you to imagine a circle drawn around a physician and a patient at the moment of consultation. Inside it flows information the patient would share with almost no one: symptoms they are ashamed of, behaviour hidden from the family, fears they cannot name. They share it with someone they met minutes ago, and the book's explanation is the sentence on the slide: they are not trusting the individual, they are trusting the role, and the assurance that what enters the circle stays within it.
That is why the book refuses to call confidentiality a rule, a technicality or a courtesy. It is the condition that makes the doctor–patient relationship possible. Remove it and patients withhold exactly the information you most need, and medicine practised on incomplete information is both less effective and more dangerous.
Definitions worth getting exactly right
The three words are used interchangeably on wards and should not be. Privacy is the widest: a person's right to control access to information about themselves, or in the older phrase this course has used, the right to be left alone. In healthcare it has a physical dimension, the body during examination, and an informational one, who knows what about one's health. Earlier versions of this lecture added two more faces of privacy, decisional and associational, the right to decide without interference and to choose one's company; they matter in mental health and in the family discussions of Part 4.
Confidentiality is the application of the privacy principle to information disclosed within a relationship of trust. The book's definition has three parts: it is an obligation on the receiver, the physician; it restricts use to the purpose for which the information was disclosed; and it forbids sharing without consent. It is relational, arising because of the relationship, and it is a duty rather than a choice. Secrecy is merely keeping something hidden, and the book calls it broader and more passive. A doctor who is secretive has not necessarily been confidential, and a doctor who is confidential may be quite open with the patient about what is being kept from whom.
From the Oath to the WMA
Confidentiality is the oldest continuous rule in medicine. The Hippocratic Oath's clause is quoted on the slide, and its reach is worth noticing: not only what the physician sees or hears in the course of treatment, but even outside it, in regard to the life of men. The World Medical Association's modern pledge keeps the duty and extends it past death: the secrets confided in me, even after the patient has died. The WMA's International Code then gives the shape of the only exceptions the profession has ever accepted, consent, and a real and imminent threat of harm that can be removed by no other means. Every list of exceptions in Part 3, in the Law, the Code and the Data Protection Law, is a version of that sentence.
The book grounds the duty in three of the values from Lecture 1. Autonomy, because personal information belongs to the patient and sharing it without authorisation takes a decision that was theirs. Dignity, because confidentiality protects a person from having their medical history define them socially, which is the stigma of the psychiatric diagnosis or the infection. And trust, which returns us to the circle: without it, patients do not disclose, and undisclosed medicine is dangerous medicine.
Amanah and ghaybah
The book gives the Islamic foundation as a framework in its own right, not as a supplement, and the Commission's Code does the same: its section on maintaining the patient's secrets opens by saying that the Sharia has asserted the significance of keeping them. The Quranic prohibition on spying in al-Hujurat, and the hadith on concealing the faults of others, place the duty on the person who knows. The concept the book puts at the centre is amanah, trust: what a patient discloses is placed in the physician's hands as a trust, and betraying it is a moral failing before it is a professional one.
Ghaybah is the term for the other side of the same duty, the disclosure of another's private affairs without authority, and it is prohibited whether or not what is said is true. That distinction matters in a hospital, where the excuse for a corridor conversation is usually that it was accurate. Lecture 2 showed you that the Law's Article 5 requires a practitioner to respect the patient's rights in accordance with the Sharia's principles and the approved medical criteria. Confidentiality is where those two sources say the same thing in the same words.
The shape of the problem
This course has taught for several years, following the Canadian regulator's guidance, that most breaches of confidentiality are unintentional: unguarded conversations, misdirected documents, a screen left open, a curtain not drawn. That is reassuring only until you notice that an unintentional breach does the patient exactly the harm a deliberate one does. The deliberate breaches are fewer and simpler, and the commonest is the record opened out of curiosity, a colleague's, a relative's, a public figure's, which the book calls a serious breach even if the information goes no further.
The consequences run in three directions. For the patient: embarrassment, social stigma, a lost job, stress, and in some cases a worsening of mental illness. For the physician: a complaint to the hospital and to the Commission, and legal action, which Part 5 will price. For the student: a complaint to the College, and the same legal exposure, because the Data Protection Law does not have a student exemption. The two questions on the last line are the practical test this course has always taught, and they are now, in substance, Article 23 of the Data Protection Law: access is restricted to the minimum necessary to provide the service.
In practice
Part two
Confidentiality is easy to profess and hard to practise in a six-bed bay. This part takes the four places where it is most often lost, and for each one gives the rule from the book, the Code, and the Ministry's Patient Bill of Rights.
Six beds, one conversation
The book is candid that the traditional ward round compromises privacy by design: a patient's diagnosis, test results, social history and treatment plan are discussed a metre from five other patients and their visitors. The duty is to minimise the exposure, and the measures are ordinary. Draw the curtains, which stop eyes and not ears; lower the voice; and take anything sensitive, the HIV result, the psychiatric history, the prognosis, to a private room. Lecture 2's clinical-placement guidelines said the same for students clerking in shared rooms.
Teaching is the point students miss. The book's sentence is exact: a patient who consented to admission has not automatically consented to being a teaching case, and bedside teaching requires the patient's explicit consent. Chapter 8 of the Code puts the same duty on the institution and the teacher: the patient must be told they are in a teaching institution, must know that you are a trainee, and may refuse; and the teacher must consider which of the patient's private matters are suitable to discuss in front of trainees at all. The Ministry's Bill of Rights states the general right in its fourth section: privacy and confidentiality when the treatment programme is discussed, whether with the patient or with the legal guardian.
The rules for the body
Physical privacy has the most detailed rules of any part of this lecture, because three documents address it. The Code's Chapter 7 sets the principle: the exposure or examination of a person's awra is prohibited unless there is necessity, and where there is, only what the purpose needs is exposed, for as long as it needs, before as few people as it needs. It requires a practitioner of the same sex wherever one can be found, and it refuses, in item 6, any exception for the clinical training of students and interns: that is what models, simulation and consenting volunteers are for.
The Ministry's Bill of Rights turns the principle into facility rules in its fourth section: private parts covered except for what treatment requires; a separate room for examination if the patient's own room is unsuitable; a person of the same gender present during examination and interventions; and no longer in the examination room than the procedure needs. The remaining lines are the list this course has taught for several years, from the same source: no examinations in corridors or waiting areas, only the staff who are needed, no unrelated visitor present, dignified clothing on the ward and full covering during transfer. The last line is the one that costs nothing. Ask permission first, and let the patient expose the painful part in their own time.
Who may open the file
Four documents answer the same question and give the same answer. The book: the record is confidential and access is restricted to those involved in the patient's care, and opening a record out of curiosity, or a colleague's or a family member's without clinical justification, is a serious breach even if the information is never shared. The Code's Chapter 9: the record is kept in a safe place, handled only by the professionally related, and its contents belong to the institution, while the patient has the right to see it and to take a copy. The Ministry's Bill of Rights, in its fourth section, names the four categories who may access the file: the treating team, those authorised by the facility's management, the patient or their guardian, and the judicial authorities.
The fourth document is new, and it is the one with a prison sentence attached. Article 23 of the Personal Data Protection Law requires the regulations to restrict the right to access health data, including medical files, to the minimum number of employees and only to the extent necessary to provide the health service; the Implementing Regulation's Article 26 repeats the minimum-necessary rule and requires facilities to assign different levels of access to different staff. The student who scrolls through the admissions list looking for an interesting case, which Lecture 2's placement guidelines already forbade, is now doing something the Data Protection Law describes.
The breach that feels like conversation
The commonest breach in any hospital is a conversation in the wrong place. The book's rule is unqualified: discussing patient cases in lifts, canteens, corridors or social settings is a breach if enough identifying information is included, and the name is not needed. Lecture 3 gave you the combination that identifies a person online, diagnosis, age, hospital and date; it works in a lift as well. The test is not whether you said the name but whether a listener could work out who you meant, and in a small city with one referral hospital the answer is usually yes.
Two excuses are worth naming so that you recognise them. The first is that the story is true, which is exactly the case in which the Sharia's prohibition on ghaybah applies. The second is that the listener is also a doctor, which is irrelevant unless the listener is involved in the patient's care; the Code's Chapter 9 restricts the record to the professionally related, and a colleague at dinner is not. The book's summary is the sentence in the middle of the slide, and it should be the reflex: clinical discussion belongs in clinical spaces.
The exception that is not really an exception
Consent is the first of the book's exceptions and the one that governs almost every disclosure you will make. Two forms are worth separating, as this course has taught for years. Implied consent covers sharing within the treating team for the purpose the patient came for: the patient who tells the admitting doctor about their alcohol use has implicitly agreed that the team treating them knows it. Explicit consent is required for anything beyond the team or beyond that purpose, a relative, an employer, an insurer, a teaching session, a case report. The book adds three conditions: explicit where possible, documented, and limited to the specific information and the specific recipient authorised. Consent to tell a daughter the diagnosis is not consent to tell her the prognosis, or to tell her brother.
The Commission's Code puts the family on the same footing. Its third exception permits disclosure to the family or others where it is useful for the treatment, after seeking the patient's consent. Part 4 returns to the family at length. For now the last line is the working rule, and it was the closing line of this lecture in every previous year: when you are not sure whether you have consent, you do not have it. Ask.
The trainee's commonest disclosure
The disclosure a medical student makes most often is to other students: the case presented on Thursday, the image shown at the morning meeting, the report written up for a journal. The Code permits it, in its fourth exception, on two conditions: the disclosure is limited to the purpose of education, and nothing is included that could lead to the identification of the patient. The book's word for the second condition is anonymisation, the removal of identifying information, and the Data Protection Regulation sets the legal standard in its Article 9: data are anonymised, and cease to be personal data, only when re-identification is impossible.
In practice that means a case presentation carries no name, no hospital number, no date of birth and no photograph of the face, and the combination of details that would identify a person in a small city is thinned until it would not. It also means, as Lecture 2's placement guidelines said, that you asked the patient whether you could present them at all. For publication the bar is higher: journals require the patient's written consent to a case report, and the Code's photography rules, which Part 4 sets out, require written permission for any published image. The triple imperative on the last line has closed this lecture for years, and it is still the best summary.
The exceptions
Part three
The duty is strong and the exceptions are few. What makes them teachable is that in the Kingdom they are written down, in Article 21 of the Law of Practicing Healthcare Professions, in the Commission's Code, and now in Article 15 of the Data Protection Law, and the three lists agree. This part reads them, then applies them to the cases that test them: the dangerous patient, the notifiable disease, the driver, and the spouse.
Five tests before any list
The book gives the tests for the duty to protect third parties, and they generalise to every exception: the threat must be serious, credible and imminent; disclosure must be necessary, with no less privacy-invasive alternative able to prevent the harm; and it must be proportionate. Two more are implicit in every rule you will read. The disclosure is directed, to the identifiable person at risk or to the official authority the rule names, and never to whoever happens to ask; the Code says “confined to those who may become harmed” and “only to the official specialised authorities.” And it is documented: what was disclosed, to whom, on what grounds, and what the patient was told, because the Data Protection Regulation's Article 20 requires disclosure requests to be documented and limited to the minimum necessary.
These tests do the real work. A rule that says a communicable disease may be reported does not say that a patient's diagnosis may be discussed with a ward clerk; the disclosure is to the public health authority, of the information the notification form asks for. Learn the five tests first, and the lists on the next slides become short.
The statute's list
Article 21 is the confidentiality article of the Law of Practicing Healthcare Professions, and Lecture 2 promised you would meet it again. Its structure is a duty followed by a closed list. The duty covers all information obtained in the course of practice. The list has three groups. Disclosures for a purpose: reporting a death from a criminal act or preventing a crime, to the competent authorities only; reporting communicable or epidemic diseases; and rebutting an accusation about the practitioner's competence made by the patient or the family, which is the Law protecting the doctor's right to defend themselves. Disclosures with agreement: the patient's written consent, or disclosure to the family where it is useful for the treatment. And a judicial order.
Two features matter. The list is closed: anything not on it is a breach, whatever the motive. And the family appears on it, in paragraph (B), as a permitted recipient where disclosure is useful for treatment; Regulation 18-2 names the same three recipients for the details of a patient's condition, the patient, the family, and the person the patient designates. Part 4 explains how the Code and the book narrow that permission to what the patient has agreed. Article 11, which you also met in Lecture 2, is the reporting duty that pairs with paragraphs (A)1 and (A)2, and Regulation 11-3 lets the report go directly or through the facility.
The Commission's version, and what it adds
The Code's section on maintaining the patient's secrets has four exceptions, and three of them restate Article 21. The second, disclosure to achieve a dominant interest of society or to ward off an evil from it, lists the Law's cases, the criminal death, the crime to be prevented, the communicable disease, the judicial request and the practitioner's defence, and repeats the Law's restriction that they go only to the official specialised authorities. The third and fourth are the family with consent and education without identification, which Part 2 covered.
The first exception is the one the Law does not spell out, and it is the Kingdom's form of the duty to protect third parties. A practitioner may disclose to protect the patient's contacts from being infected or harmed, and the Code names three kinds of case: contagious disease, drug addiction and severe psychological illness. The disclosure is confined to those who may become harmed. That direction is the whole point. The exception does not license telling the employer, the ward, or the family generally; it licenses a warning to the person at risk, after the five tests, and preferably after the patient has been given the chance to make the disclosure themselves.
The case that drew the line
Chapter 6 opens with Tarasoff, and it is the case every student should know by name. A young man told his university psychologist in 1969 that he intended to kill a woman who had rejected him. The therapist, believing himself bound by confidentiality, made one brief and unsuccessful attempt to have him detained and warned no one else. Two months later the man killed her, and in 1976 the California Supreme Court ruled for her parents in a sentence that has defined the exception since: the protective privilege ends where the public peril begins.
The duty the case created is to breach confidentiality when a patient poses a clear, serious and imminent risk to an identifiable third party, and the book's tests are the ones on slide 16. The case this course has used for years to teach it, from the Canadian regulator, is the patient who describes in detail a bomb he intends to set off at his former workplace and then leaves the office. The Kingdom's law does not use the American name, but the duty is present twice: in the Code's first exception, protecting the patient's contacts from harm, and in Article 21(A)1 of the Law, disclosure to prevent a crime, to the competent authorities. The threatened person is warned; the police are called; and the disclosure goes no further.
Where the law compels
Two exceptions are not judgement calls at all. Notifiable diseases are reported to the public health authority whether or not the patient consents; the book names tuberculosis, meningococcal disease and cholera from the Ministry's list, and Article 11 of the Law leaves the list, the authority and the procedure to the Minister's decision. Regulation 11-3 lets the report go directly or through the facility employing you. Week 10's lecture on public health returns to the ethics of this; for today the point is that it is an obligation on you, and a failure to report is a breach of Article 11, which Article 28 makes an offence.
Criminal injury is the other. Article 11 requires a practitioner who examines a patient suspected of a crime-related injury to notify the competent security and health authorities immediately, and Regulation 11-1 specifies a detailed report of the injury and the expected recovery, signed by two physicians accredited by the facility. A court order completes the list: a judicial authority may require disclosure in legal proceedings, and the book calls this a legal compulsion that overrides the ethical obligation. What unites the three is direction. Each disclosure goes to a named authority with the information the purpose requires. None of them makes the patient's diagnosis a matter for the ward.
The list students remember, mapped to the rules
Earlier versions of this lecture ended with a list of conditions under which identifiable information may be disclosed: abuse of a child, an elder or a spouse; public safety and violence; mental impairment; driving; communicable disease; a court order. The list is still right, but it is more useful once mapped onto the rules you have now read. Each item is either a Code exception 1 case, protecting the patient's contacts from harm, or an exception 2 case, a dominant interest of society, and each goes to the person or the authority that can actually prevent the harm.
The child on the slide is the case this course has always used. Multiple fractures of different ages with a history that does not explain them is a pattern, and the duty is to report the suspicion to the child protection authority. The sentence to remember is the one this course has repeated every year: the purpose is protection, not accusation, and the authority investigates. The bus driver is Case 6.2 in the book and one of the two worked at the end. He is a competent adult exercising autonomy, and his passengers are the contacts the Code's first exception was written for. Work it with the five tests, and notice how much of the answer lies in what you say to him before you disclose anything to anyone.
Case 6.3, and the older HIV case
This is the case in which two duties genuinely meet, and the Kingdom's documents are unusually explicit about it. The first duty is the ordinary one. At the desk, the husband is a person outside the circle asking for information about someone inside it, and the answer is nothing: no diagnosis, no confirmation, no hint. The nurse's duty runs to the patient in the consulting room, who did not mention him and has not consented.
The second duty is the Code's first exception, and the Bill of Rights states its hardest application in plain words. In its section on AIDS patients, the Ministry requires privacy and confidentiality to a high degree, knowing that the husband or wife has the right to know if the other party is a carrier of the virus. The Code permits disclosure of a contagious disease to protect the patient's contacts, confined to those who may be harmed. The sequence on the slide reconciles the two, and it is the same sequence this course has taught with the older HIV case for years: treat and counsel the patient; ask her to tell her husband, and help her do it, which is the less privacy-invasive alternative that the necessity test requires; and only if she will not, and the risk to him is real, disclose to him what the risk requires and nothing more, and document it. In most cases the patient, properly supported, tells him herself.
The sentence to keep from Part 3
The court's sentence is the shape of every exception in one line: a privilege, which is the patient's and strong, and a peril, which must be real, serious and to someone identifiable, before the privilege yields. Everything else in this part was the machinery for deciding whether the peril has begun, and to whom the disclosure then goes.
The family, and the record
Part four
Two settings produce more confidentiality failures in this region than all the exceptions combined: the family that expects to be told, and the phone in your pocket. This part takes each in turn, and reads the Code's rules on photographing patients, which every clinical WhatsApp group breaks weekly.
Family, culture, and a rule that does not move
The book faces the cultural fact directly. In many Arab and Muslim contexts the family is central and active in healthcare, present at every consultation, and expecting to be told. The principle does not bend to accommodate that: the right to confidentiality belongs to the patient, not to the family, and the family's love and concern do not entitle them to information the patient has not authorised. What bends is the practice, which is designed to give the family their proper place while keeping the decision with the patient.
The Kingdom's instruments need reading together here, because they do not say quite the same thing. Article 21(B) of the Law and Regulation 18-2 name the family as a permitted recipient of the details of a patient's condition where disclosure is useful for the treatment. The Code's third exception permits the same disclosure after seeking the patient's consent, and the book's rule is the Code's. The practical synthesis is on the slide: ask the patient, early and in private, who may know what, and record the answer, so that the team is not guessing at the bedside with six relatives present. The last line is the point students find pedantic and patients do not: authority to tell one relative one thing is not authority to tell that relative everything, or to tell anyone else.
The commonest hard case in this region
The family's request that a serious diagnosis be withheld from the patient, usually cancer, is the most ethically charged scenario in Chapter 6 and appears as a case in Chapter 4 as well. The book gives four reasons for not simply granting it. It violates the patient's autonomy over information about their own body. It rests on a false premise, because research consistently shows that most patients want to know their diagnosis. It damages trust when the patient learns, as they almost always do, that they were deceived. And it impedes care, since a patient who does not know cannot consent to treatment, plan their affairs, or take leave of anyone.
The Law is more permissive than the book, and you should know exactly how. Article 18 allows a physician, in incurable or life-threatening disease, to decide as his conscience dictates whether it is appropriate to inform the patient or the family of the fact of the disease, unless the patient has prohibited it or has designated a person to be exclusively informed. That is a latitude for the physician, exercised on the patient's behalf and bounded by the patient's own instructions. It is not a veto for the family, and nothing in the Law or the Code gives the family one. The next slide is how to use the latitude well.
The culturally sensitive path, as the book gives it
The book's method is short and it works. Meet the family first, acknowledge their concern, and say plainly that you and they want the same thing for him; a family that feels heard rarely fights the next step. Then assess the patient's own preferences privately. The question on the slide is one form of it: some people want every detail, some prefer their family to handle things, what would he like? Most patients, asked that way, ask to be told. Then disclose at the patient's pace and in the patient's words, with the family present if he wishes, which usually he does.
Two outcomes are legitimate. A patient who says he would rather not know has exercised his autonomy, and the Law's Article 18 covers the physician who respects it; the record should say that it was the patient's choice. A patient who asks directly has ended the discussion, and Case 6.4 gives him the words: “Doctor, I need you to be straight with me. What did you find?” A doctor who answers that question with a lie has broken the duty of truthfulness in the Code's Chapter 1, the patient's right to information under the Bill of Rights, and the trust the whole lecture is about, and has done it to protect the family from a conversation rather than the patient from harm.
What the system remembers
The book's account of the electronic record is balanced: the accessibility that makes it valuable to care is what makes a single breach capable of exposing thousands of patients at once. Its obligations for the individual user are five, and they are on the slide: open only the records of patients under your care; use only the authorised, secure platforms; log out when you leave a screen; report unauthorised access or a security breach immediately; and never photograph or screenshot a record.
The reporting duty now has a clock. The Data Protection Law's Article 20 requires the controller, which is the facility, to notify the competent authority of any breach or illegal access, and to notify the patient where the breach would harm their data or their rights; the Implementing Regulation's Article 24 fixes the notification to the authority at not more than seventy-two hours from becoming aware. That deadline runs from your report, which is why “immediately” is not a figure of speech. The last line is the fact students most often do not know. Every record you open is logged against your credentials, permanently, and an investigation under Regulation 40 of the Law begins by reading the log.
The phone in your pocket
The book does not pretend that WhatsApp is not used for clinical communication; it says the use is widespread and ethically problematic, and gives the reasons. The platform lives on personal devices that are lost, stolen and looked at by family; group chats routinely forward patient information and clinical photographs, usually without the patient's consent; and nothing about the tool was designed with the record's obligations in mind. Its framework is the sentence in the middle of the slide: patient information travels only on approved, encrypted, institutionally governed platforms. Where clinical necessity genuinely forces an unofficial channel, the information is anonymised as far as it can be, and any identifying clinical image is sent only with the patient's explicit consent.
Case 6.1, the X-ray with the name in the corner posted to a department group of twelve, is worked at the end. The last line of the slide is how to think about it before then. A message to a group is not a conversation; it is a publication to every member, each of whom can keep and forward it indefinitely. The Data Protection Law's definition of publishing, transmitting or making available personal data by any written, audio or visual means, describes the act exactly.
Section (F) of the Code's Chapter 2
The Code has a full section on photographing patients and recording their voices, and it should be read against every clinical image you will ever take. The rule is that patients are not photographed in whole or in part except for a need arising from their care, from medical education or from health research. Where there is such a need, eight regulations follow. The patient is told the purpose and where the image will be used; consent is obtained from the patient or their proxy; no pressure is applied; the image is used only for the important purposes named; the patient may withdraw consent even after the image has been taken; a guardian consents for a minor or an unconscious patient, who may withdraw on regaining consciousness; and no image is published in the media, including new media, without written permission and without anything that could identify the patient, a face only with the eyes covered unless there is a scientific need.
The eighth regulation is the exception students should know precisely, because it is narrow: the images that may be taken and kept without consent are, exclusively, photographs of internal organs, histology slides, endoscopic images and diagnostic imaging. A chest X-ray is on that list. A chest X-ray with the patient's name, number and date of birth in the corner, posted to a group, is not, because the exception covers the image and not the identifiers, and because keeping is not publishing. Regulation 5-3 of the Law adds the statutory version for procedures: written consent, the facility's approval, an approved scientific purpose, and no offence to public morals, all four together.
The link to Lecture 3
Lecture 3 gave you the book's rules for social media and they are not repeated here. One point belongs in this lecture because the Data Protection Law gives it teeth. The book's warning was that a patient can be identified without a name, by the combination of diagnosis, age, hospital and date. The Law's definitions make that combination personal data, since personal data is anything that directly or indirectly makes it possible to identify an individual; make health data a category of sensitive data; and define publishing as making personal data available by any written, audio or visual means. A post is a publication, a story that identifies a patient is health data, and Article 35 is the penalty, which Part 5 sets out.
Case 2.2 from Lecture 3, the white-coat photograph at the nurses' station with a patient's name on the whiteboard, is therefore also a Chapter 6 case, and a Data Protection Law case. The coat identifies the student; the board identifies the patient; the post publishes both.
The sentence to keep from Part 4
This was the closing slide of this lecture for several years, and it survives every change in the law. Anonymise, because information that cannot identify a patient is not personal data and breaches nothing. Ask, because consent is the exception that covers almost everything, and a question costs nothing. The rest of the lecture is what happens when neither was done.
The law
Part five
Confidentiality in the Kingdom rests on three legal instruments, and the newest of them is the one your teachers were never taught. This part sets the three side by side, then reads the Personal Data Protection Law, because from September 2023 it is the statute that prices a breach.
How the three fit together
The Law of Practicing Healthcare Professions is the practitioner's statute, and Lecture 2 read it. For confidentiality its articles are 21, the duty and the closed list; 11, the reporting duties; 18 and its Regulation 18-2, who may be told the details of a condition; Regulation 5-3, photographing and publishing procedures; and 31, which makes a breach of any duty or of the Code a disciplinary offence. The Ministry's Patient Bill of Rights is the patient's document, and its fourth section is the operative statement of what a facility owes: private discussion, covered bodies, no disclosure or access without consent except to the courts, a closed list of who may open the file, and the physical arrangements for examination.
The Personal Data Protection Law is the general statute on personal data, and it reaches health data expressly. It was issued by Royal Decree M/19 in 1443H, amended by M/148 in 1444H, and came into force in September 2023 under the Saudi Data and Artificial Intelligence Authority. It does not replace the other two; it stands behind them, with definitions that make a patient's diagnosis sensitive data, a list of permitted disclosures that mirrors Article 21, a minimum-access rule for medical files, a breach clock, and penalties that neither of the older instruments had. The next four slides read it.
Article 1, Article 4, Article 5
The Law's definitions decide its reach. Personal data is any data that identifies an individual directly or indirectly, and the definition lists names, identification numbers, addresses, contact numbers and images; the phrase “directly or indirectly” is what captures the combination of details that identifies a patient without a name. Health data is any personal data related to an individual's physical, mental or psychological condition or to the health services they received, which is the whole of a medical record. And sensitive data, the category with the criminal penalty, expressly includes health data and genetic data, beside religious belief, ethnic origin, criminal record and biometrics.
Article 4 lists the data subject's rights, and every one of them is a right your patients now hold against the facility: to be informed of the purpose of collection; to access their data; to obtain a copy in a readable format; to have it corrected, completed or updated; and to have it destroyed when it is no longer needed by them. Article 5 is the consent rule: no processing and no change of purpose without the data subject's consent except where the Law itself provides, and consent may be withdrawn at any time. The Code's Chapter 9 already gave the patient the right to see and copy the record. The Law makes it enforceable.
The third list, and how it agrees with the first two
Article 15 is the Data Protection Law's version of Article 21, and the two agree almost line for line. Consent is first. Public sources second, which has no clinical application. A public entity's requirement for public interest, security, another law or judicial requirements is the Law's judicial order and reporting duties. Necessity to protect public health, public safety, or the lives or health of specific individuals is the notifiable disease, the Tarasoff warning and the spouse at risk. Anonymised processing is the Code's education exception. The sixth ground, the controller's legitimate interest, is the one students should notice because of its proviso: it is never available where sensitive data are involved, and health data are sensitive. A hospital cannot disclose a patient's diagnosis on the ground that it was in the hospital's interest.
Article 16 then closes several of the doors that Article 15 opened. Even with consent, a public source, anonymisation or a legitimate interest, disclosure is forbidden if it would compromise an individual's safety, violate the privacy of a person other than the data subject, conflict with the interests of someone who lacks capacity, or violate legally established professional obligations. That last clause is how the two statutes lock together: Article 21 of the Law of Practicing Healthcare Professions is a legally established professional obligation, so a disclosure the older Law forbids is one the newer Law forbids as well.
The articles with consequences
Article 23 is the article for the ward. It requires the regulations to restrict access to health data, including medical files, to the minimum number of employees and only to the extent necessary to provide the service, and to restrict processing likewise. The Implementing Regulation's Article 26 turns that into facility duties: adopt the Ministry of Health's and the Saudi Health Council's controls, build the Law into internal policy, assign graded levels of access so that responsibility cannot diffuse, document every stage of processing with a named person responsible, and limit processing to the minimum necessary. Article 20 is the breach article, and its clock, seventy-two hours from awareness, was on slide 28.
Articles 35 and 36 are the penalties, and they are the reason this Law has changed the conversation. Article 35 makes it an offence for any individual to disclose or publish sensitive data in violation of the Law with the intention of harming the data subject or achieving a personal benefit, punishable by imprisonment of up to two years, a fine of up to three million riyals, or both, prosecuted by the Public Prosecution, with the fine doubled for a repeat. Article 36 attaches a warning or a fine of up to five million riyals to every other violation. Nothing in the Law limits it to institutions, and nothing exempts students. The last line of the slide is the practical translation: the forwarded screenshot is a disclosure of sensitive data on its face, and the question of motive is decided by someone else.
The sentence to keep from Part 5
The Law of Practicing Healthcare Professions, the Patient Bill of Rights and the Personal Data Protection Law were written at different times by different bodies, and they say the same thing. That agreement is itself the lesson: the rule is not a preference of one regulator but the settled position of the Kingdom, and the exceptions are the ones written down, with the case, the recipient and the reason named. A disclosure you cannot fit to one of them is a breach under all three.
Cases, and next
Part six
Two of the four cases at the end of Chapter 6 follow. The spouse and the family veto were worked in the lecture; these two are the X-ray in the group and the driver who will not stop.
Case 6.1
Start with the doctor's defence, because it is half right. Education is a permitted purpose: the Code's fourth exception allows disclosure for the education of other team members, and its eighth photography rule allows diagnostic imaging to be kept without consent. Both permissions fail on the identifiers. The education exception is limited to what does not identify the patient; the imaging exception covers the image and not the name, number and date of birth in its corner; and neither exception covers publication to a group of twelve on a consumer platform, which the book's framework rejects and the Data Protection Law defines as publishing. “No harm was caused” is the argument the book answers directly: unauthorised disclosure is a breach whether or not the information goes further, and the patient's complaint is the harm.
What should happen next has three tracks. For the patient: an honest disclosure of what happened, an apology, and an incident report, which is Lecture 2's ethical response to error, and the facility's own Article 20 duties if the breach reaches the notification threshold. For the doctor: the facility's process, and the Commission's, under Article 31 of the Law; Article 35 of the Data Protection Law requires an intention to harm or to benefit, which is unlikely here, but the doctor should understand that a prosecutor decides that, not the doctor. For the group: deletion, which the Code's own logic requires, and a decision about what the group is for. The last part is the one that prevents the next case.
Case 6.2
Take the easy duty first. The employer's call is a person outside the circle asking for information about a person inside it, and the answer to the employer is nothing: no diagnosis, no reason for absence, and, without the patient's consent, not even confirmation that he is a patient. Nothing in Article 21 of the Law or Article 15 of the Data Protection Law permits disclosure to an employer on request.
The hard duty is to the passengers, and it is real. The Code's first exception permits disclosure to protect the patient's contacts from harm, and Article 15(4) of the Data Protection Law permits disclosure necessary to protect public safety or the lives of specific individuals. Now run the five tests. The harm is serious and, for a bus driver with untreated seizures, credible and imminent. Is disclosure necessary, or is there a less invasive alternative? There is, and it is the first thing you do: you talk to him. You explain the risk to him and to others in terms he did not hear the first time, you help with the problem he actually has, which is his income, through the hospital's social services, and you tell him plainly that if he continues to drive you will have to act. Most patients stop. If he does not, the disclosure is proportionate and directed: to the licensing or transport authority that can stop him driving, of the fact that he is medically unfit to hold the licence, and not of his diagnosis to his employer. Document every step, including what you told him and when. The book's phrase for the result is the one to keep: the protective privilege ends where the public peril begins, and not before.
A method for confidentiality questions
As in the earlier lectures, the order is the examiner's order. Ownership first, because it is always the patient's and saying so resets the discussion. Then the person asking and their right to ask, which is either the patient's consent or a rule that names them; most requests fail here. Then the rule, named precisely: consent in one of its two forms, one of the paragraphs of Article 21, one of the Code's four exceptions, or one of the six situations in Article 15. Then the five tests, which decide whether the rule actually applies to this disclosure, to this recipient, in this amount.
The last question is the one this lecture was built to ask. In every case in Chapter 6 there is something to say to the patient before anything is said to anyone else, and there is something to write down. The patient who is told what you must do, and why, and given the chance to do it first, rarely needs the exception at all.
Reading, and one practical instruction
Week 13 has two lectures. This was the first; the second is patients with special needs, Chapter 12, which takes the privacy questions of this lecture into the care of children, of people with mental illness and of people who cannot speak for themselves. Week 14 follows the autumn break and covers surgery, women and children, and the end of life, in Chapters 9, 8 and 10. Read the chapters before the lectures, as every week.
The reading for this lecture is short and worth doing: the fourth section of the Ministry's Patient Bill of Rights, which is the operative statement of what your patients are owed, and five articles of the Personal Data Protection Law, which take a quarter of an hour and which none of your seniors were taught. Both are on Blackboard under Lectures. The last line is the practical instruction. Before your next ward day, find out which platform your hospital has approved for clinical messaging. If nobody can tell you, that is the answer, and the book's framework tells you what follows from it.
The question, answered
The patient, always. The people the patient names, to the extent the patient names them. The team, for the treatment the patient came for. And, in a short list the law writes down, the person at risk or the authority that can prevent the harm, with only what the harm requires. Everyone else is outside the circle, and the circle is the whole of medicine's claim to be trusted.
Before next time
This lecture was Chapter 6 — Privacy and Confidentiality, with §4.3 of Chapter 4 for the Patient Bill of Rights. Work the four cases at the end of Chapter 6 and bring your answers. The second lecture of this week is patients with special needs, Chapter 12. Week 14, after the autumn break, is surgery, women and children, and the end of life: Chapters 9, 8 and 10.
Three documents quoted here are on Blackboard under Lectures: the Ministry's Patient Bill of Rights and Responsibilities, the Personal Data Protection Law in the Saudi Data and Artificial Intelligence Authority's English text, and its Implementing Regulation. The Law of Practicing Healthcare Professions and the Commission's Code of Ethics are in the week 3 reference set.
The question bank has 113 scenarios with the answers explained, and the Trainee Edition is the shorter version written for the wards.