When can I share information without consent?

The course covers sharing in the patient’s best interests and where there is a risk of serious harm to the patient or to others, limited to the minimum necessary and recorded with the reasons. Whether a particular disclosure was lawful under data protection law depends on the facts; ask your adviser.

Medical Council · NMBI · Dental Council · PSI · CORU · Complaint or fitness to practise inquiry

Confidentiality in Healthcare Practice for healthcare professionals facing a complaint, an employer investigation or a fitness to practise inquiry about confidentiality

Information was overheard, opened, sent or shared when it should not have been.

Overheard — a patient discussed in a corridor, a lift, a waiting room or a shared office
Record access — a record opened without a clinical reason, out of interest or concern
Misdirected — an email, a letter or an attachment sent to the wrong person
Third parties — information given to a relative, an employer or an unverified caller
Disclosure — information shared without consent, or held back when a serious risk called for sharing
Team sharing — more shared in a team or an MDT than the role needed
Boundaries — a boundaries breach with a patient or a colleague: the record of someone you know looked up
Any other concern — an allegation of a confidentiality breach not listed here

Facing a complaint, an employer investigation or a fitness to practise inquiry about confidentiality — before the Medical Council, NMBI, the Dental Council, the Pharmaceutical Society of Ireland or CORU?

This course is for a healthcare professional facing a complaint, an employer investigation or a fitness to practise inquiry about a confidentiality breach. This course helps you remediate — and show the remediation, with a dated certificate for your written response, your reflection, an undertaking or an inquiry.

Buy this course — €100 (€70 with Bulk Buy 10) Bulk Buy — from €70 a course

Price by number of courses
Courses	Price per course	You save
1	€100	No saving
2	€88	€25
3	€83	€50
5	€80	€100
10	€70	€300

Add courses. The saving is applied in the basket.

Immediate access · certificate on completion · twelve months' access

2 CPD hours
Self-paced
Written for Ireland
CPD certificate
From €70 a course (Bulk Buy of 10)

Our team

Dr Shehzad IqbalFounder, course author and facilitatorMBBS, MRCS, MRCGP
Dr Mo MirzaCourse facilitatorMedically trained, UCL London
Ludmila UpenieceBusiness development and supportPsychology, UEL London

At a glance

Who it is for: Any healthcare professional in Ireland facing a complaint, an employer investigation, a preliminary decision or a fitness to practise inquiry about a confidentiality breach — overheard, accessed, misdirected, over-shared or posted online
Regulator covered: Applies to practitioners registered with the Medical Council, the Nursing and Midwifery Board of Ireland (NMBI), the Dental Council, the Pharmaceutical Society of Ireland (PSI) or CORU
Length: 10 sections, 88 lessons, 2 CPD hours
Format: Self-paced, online, immediate access, twelve months from purchase
Certificate: Certificate issued by Healthcare Ethics Courses on completion, dated, with the course title and 2 CPD hours
Price: €100 · from €70 a course (Bulk Buy of 10)

Certificate issued by Healthcare Ethics CoursesRemediation courses for regulatory processes.

2CPD hours, issued by Healthcare Ethics Courses

10Sections, nine closing with a reflective quiz

88Lessons, plus a post-course assessment

€100 (€70 with Bulk Buy 10)One off. Twelve months' access

The certificate you will receive

Sample certificate of continuing professional development for Confidentiality in Healthcare Practice, issued by Healthcare Ethics Courses, showing the name John Smith, 2 CPD hours and a date of completion, marked SAMPLE — Sample. Your certificate carries your name, the course title and the date you complete the course.

How healthcare professionals use it

With a written response to your regulator or its preliminary committee, alongside a reflection
When an undertaking or a consent is discussed, or in your evidence to an inquiry committee
As a dated record of remediation for the regulator when sanction is considered

Buy this course — €100 (€70 with Bulk Buy 10)

Who this course is for

Told of a breach you caused

An email to the wrong address, a conversation overheard, a clinic list left where the public found it. Section 7 covers how breaches occur, what to do the moment one is identified, and how the response is read afterwards.

Facing an employer investigation

An access audit has flagged records you opened, or an incident report names you. Section 7 covers employer investigations that run beside a regulatory process, why accounts must be consistent across both, and the access logs, emails and records investigators examine.

Facing a complaint to your regulator

The Medical Council, NMBI, the Dental Council, the PSI or CORU has written to tell you of a complaint. Your first written reply is where your understanding of confidentiality is first read, and the course gives it a structure you can follow under pressure.

Asked for a statement about the breach

Section 7 covers writing a statement: what happened, how the breach occurred, the effect on the patient and on trust, the standard engaged and the corrective action — and the phrases that undermine it, such as no harm was intended.

Facing a fitness to practise inquiry

The complaint has gone to a Fitness to Practise Committee, a Professional Conduct Committee or a Health Committee. Remediation completed before the hearing, dated and documented, is evidence you can put before the committee and the regulator.

Under an undertaking, conditions or a sanction

An undertaking you have given, conditions on your registration or a sanction may ask you to show what you have done to address the concern. The certificate is dated and records 2 CPD hours, and the course shows the other evidence that sits beside it.

The concerns this course speaks to

Conversations overheard

A case discussed in a corridor, a lift, a waiting room or on the phone in a shared space. Section 3 covers informal conversations and verbal disclosure, and Section 9 the habits that prevent them: check who is present, move to a private room, leave out names and identifying details.

Records opened without a reason

A record viewed out of interest or concern, without involvement in the patient’s care. Sections 3 and 6 cover inappropriate access, audit trails and shared logins, and why access alone can be a breach even when nothing is shared.

Emails, letters and messages

Autocomplete chose the wrong recipient, the wrong attachment went out, reply all was pressed. Sections 3 and 6 cover communication errors and electronic communication, and Section 8 remediation aimed at the specific failure, such as a recipient check for external emails.

Sharing with and without consent

Information shared without consent, or held back when there was a risk of serious harm. Section 4 covers consent to sharing, best interests, safeguarding, sharing against a patient’s wishes, disclosure to family members and carers, and recording each decision.

Teams, MDTs and other services

More shared at an MDT or in a referral than each role needed. Section 5 applies the need-to-know principle within teams: MDT meetings and minutes, information sent to other services, administrative staff, students and observers, and disagreement about what to share.

Professional boundaries with a patient or a colleague

The record of a colleague, a friend or a neighbour looked up out of personal interest; a patient discussed with a colleague who is not involved in their care. The duty is the same whether the record belongs to a patient or a colleague: Sections 3 and 6 list the records of friends, family, colleagues and public figures among the high-risk accesses, and Section 3 covers discussing patients with colleagues who are not involved.

Online and remote working

A post about a shift in which a patient saw themselves described, a video consultation overheard at home. Section 3 covers social media and informal digital communication, and Sections 6 and 9 remote working: private rooms, headphones, secure networks and locked screens.

The response after a breach

It was only an accident. I didn’t name the patient. No one complained. Section 8 covers why these responses read as a lack of insight, and the reflection, remediation and evidence that answer a breach instead.

Facing a complaint to your regulator or a fitness to practise inquiry? This course helps you remediate — and show it.

Buy this course — €100 (€70 with Bulk Buy 10)

What the course covers

Ten sections and 88 lessons, with a reflective quiz closing each of the first nine and a post-course assessment at the end.

Section 01

Introduction — Why Confidentiality Matters in Irish Healthcare

Nine lessons

Section 02

What Confidentiality Means in Healthcare Practice

Nine lessons

Section 03

Everyday Confidentiality Risks and Common Breaches

Ten lessons

Section 04

Information Sharing, Consent, and Best Interests

Ten lessons

Section 05

Confidentiality in Team-Based and Multidisciplinary Care

Ten lessons

Section 06

Confidentiality, Documentation, and Digital Records

Ten lessons

Section 07

Confidentiality Breaches, Complaints, and Investigations

Ten lessons

Section 08

Reflection, Insight, and Remediation After Confidentiality Lapses

Nine lessons

Section 09

Applying Confidentiality Safely to Daily Practice

Nine lessons

Section 10

Conclusion and Key Takeaways

Two lessons, Conclusion and Key Takeaways, and the post-course assessment

Show every lesson title

Section 01 · Introduction — Why Confidentiality Matters in Irish Healthcare: What Is Confidentiality in Healthcare Practice?; Why Confidentiality Is Essential to Patient Trust; Confidentiality as a Core Professional Requirement in Ireland; Confidentiality in Modern Healthcare Environments; Common Misunderstandings About Confidentiality; Confidentiality and Appropriate Information Sharing; Consequences of Confidentiality Breaches; Confidentiality as Part of Professional Identity; Why This Course Is Important.
Section 02 · What Confidentiality Means in Healthcare Practice: The Scope of Confidential Information; Who Owes a Duty of Confidentiality; The “Need-to-Know” Principle; Confidentiality in Verbal Communication; Confidentiality in Written and Paper Records; Confidentiality in Digital and Electronic Records; Confidentiality in Teaching and Learning; Confidentiality and Family, Friends, and Third Parties; Regulatory Expectations in Ireland.
Section 03 · Everyday Confidentiality Risks and Common Breaches: Informal Conversations and Verbal Disclosure; Discussing Patients With Colleagues Who Are Not Involved; Paper Records and Physical Documents; Electronic Records and Inappropriate Access; Emails, Letters, and Communication Errors; Telephone Conversations and Identity Verification; Teaching and Case Discussion; Social Media and Informal Digital Communication; Accidental Breaches and Human Factors; Regulatory Expectations in Ireland.
Section 04 · Information Sharing, Consent, and Best Interests: Confidentiality and Lawful, Ethical Information Sharing; Sharing Information With Patient Consent; When Consent Is Absent or Cannot Be Obtained; Information Sharing in the Patient’s Best Interests; Safeguarding and Risk of Serious Harm; Sharing Information Against a Patient’s Wishes; Information Sharing Within Multidisciplinary Teams; Disclosure to Family Members and Carers; Recording Decisions About Information Sharing; Regulatory Expectations in Ireland.
Section 05 · Confidentiality in Team-Based and Multidisciplinary Care: Why Team-Based Care Increases Confidentiality Risk; Applying the “Need-to-Know” Principle Within Teams; Verbal Confidentiality in MDT Meetings and Handover; Written MDT Documentation and Meeting Minutes; Information Sharing Across Organisations and Services; Confidentiality and Administrative Staff; Students, Trainees, and Observers; Managing Disagreement Within Teams About Sharing; Documentation of Team-Based Sharing Decisions; Regulatory Expectations in Ireland.
Section 06 · Confidentiality, Documentation, and Digital Records: Why Documentation Is Central to Confidentiality; Recording Only What Is Necessary and Relevant; Professional Language and Neutral Tone; Accessing Records: Legitimate Use Only; Passwords, Logins, and Shared Systems; Email, Messaging, and Electronic Communication; Remote Working and Home-Based Practice; Copy-and-Paste and Template Risks; Responding to Documentation-Related Breaches; Regulatory Expectations in Ireland.
Section 07 · Confidentiality Breaches, Complaints, and Investigations: How Confidentiality Breaches Occur; How Confidentiality Complaints Are Raised; What Regulators Examine in Confidentiality Investigations; Employer Investigations and Parallel Regulatory Processes; Responding Immediately When a Breach Is Identified; Handling Investigations and Requests for Information; Writing Statements About Confidentiality Breaches; Demonstrating Insight in Confidentiality Cases; Remediation Following Confidentiality Breaches; Regulatory Expectations in Ireland.
Section 08 · Reflection, Insight, and Remediation After Confidentiality Lapses: Why Reflection, Insight, and Remediation Matter; Reflection: Analysing the Lapse Honestly and Specifically; Insight: Recognising Seriousness and Accepting Responsibility; Common Confidentiality Lapses Requiring Remediation; Remediation: Turning Learning Into Practical Change; Evidence: Demonstrating Improvement Credibly; Weak vs Strong Responses in Confidentiality Investigations; Embedding Learning Into Ongoing Practice; Regulatory Expectations in Ireland.
Section 09 · Applying Confidentiality Safely to Daily Practice: Adopting a “Confidentiality-First” Mindset; Safe Verbal Communication in Everyday Settings; Applying Confidentiality to Documentation and Records; Safe Information Sharing Within Teams; Managing Requests From Family, Friends, and Third Parties; Digital and Remote Working Safeguards; Handling Mistakes and Near-Misses Safely; Personal Accountability in Busy or Pressured Environments; Aligning Daily Practice With Regulatory Expectations.
Section 10 · Conclusion and Key Takeaways: Conclusion; Key Takeaways.

How to respond to a complaint about a confidentiality breach

Whether it is read by your employer, at the preliminary stage or by an inquiry committee, a response to a confidentiality complaint is read for insight into the effect as well as the facts. These are the four parts to set out, and what the course gives you for each.

A breach is judged by its effect on the patient’s trust and dignity, not only by what you intended.

What happenedWhat information, how it was shared or accessed, and who saw it.Section 7 covers writing a statement about a breach: factual, specific and consistent with the logs and records.
Why it was a breachThe need-to-know principle, proportionality and the standard in your code.Sections 2 and 4 cover the scope of confidential information and when sharing is justified.
The effectOn the patient’s dignity and trust, even where no harm followed and no name was used.Section 8 covers insight: accidental breaches still matter, and a patient can be identified without a name.
The safeguardA change aimed at the specific failure, with evidence that it has held.Section 8 covers targeted remediation and the evidence that shows it — and this course is a dated item for it.

I did not name the patient answers the wrong question.

Take advice from your indemnifier, your union or professional body, or a solicitor before you respond to anyone.

Facing a complaint to your regulator or a fitness to practise inquiry? This course helps you remediate — and show it.

Buy this course — €100 (€70 with Bulk Buy 10)

How this course helps with a complaint or fitness to practise inquiry

Confidentiality in fitness to practise cases

Confidentiality was a theme in 10% of the 151 fitness to practise cases CORU concluded in 2022 to 2024 (trends report). An employer’s investigation can run beside the regulator’s, and the course treats consistency between them as part of the response (Section 7), together with what investigators examine: the information, its sensitivity, how it was disclosed, whether access was justified, the response afterwards and any pattern.

Insight is weighed

The Medical Council’s Guidance on Sanctions says a practitioner may demonstrate insight by providing evidence of their understanding of the problem, and NMBI’s Guidance on Sanctions lists acknowledgement and early admission, and remedial action, among mitigating factors. Section 8 shows what that looks like after a breach: specific reflection, targeted remediation such as a recipient check or workspace changes, and audit evidence that it has held. For the stages from the first letter to the High Court, see the fitness to practise process in Ireland, explained.

Read the primary sources

Buy this course — €100 (€70 with Bulk Buy 10)

Who wrote it

Dr Shehzad Iqbal

Course author and facilitator, Healthcare Ethics Ireland

Dr Iqbal wrote this course. He combines clinical practice with a formal postgraduate qualification in healthcare law and ethics, and has worked with registrants across the regulated health professions, online and face to face, since 2020.

He founded Probity & Ethics in the United Kingdom in 2020 and Healthcare Ethics Courses, which issues the certificates, in 2025. More about us.

MBBS · MRCS · MRCGP · Postgraduate Certificate in Healthcare Law and Ethics, University of Dundee

Written and reviewed by Dr Shehzad Iqbal. Last reviewed 22 October 2026.

In short

Confidentiality in Healthcare Practice is a two-hour, self-paced remediation course for healthcare professionals in Ireland — registered with the Medical Council, NMBI, the Dental Council, the Pharmaceutical Society of Ireland or CORU — who face a complaint, an employer investigation, a preliminary decision or a fitness to practise inquiry about a confidentiality breach. It explains why confidentiality matters and what it covers — clinical, personal, administrative and inferred information, in every format; the need-to-know principle; everyday risks, from conversations overheard to records opened without a reason and emails misdirected; information sharing with and without consent, best interests and safeguarding; confidentiality in team-based and multidisciplinary care; documentation and digital records; how breaches are complained of and investigated, and how to respond; reflection, insight and remediation after a lapse; and confidentiality-safe habits in daily practice. Ten sections, the first nine closing with a reflective quiz, a post-course assessment, and a dated certificate from Healthcare Ethics Courses. It is remediation and dated evidence of it; it decides no complaint, and it is not a substitute for advice from your indemnifier, your union or professional body, or a solicitor.

What confidentiality covers

Confidentiality covers everything learned because of the professional relationship, not only diagnoses. It includes appointment details, attendance, correspondence, referral information, social circumstances and conclusions drawn but not yet confirmed — spoken, written, electronic or visual. A patient can be identified without a name, from age, location, timing or a rare condition.

It is not absolute secrecy. Information may be shared for care, safeguarding or a legal or ethical obligation, but only with those who need it and only as much as they need. The course judges each decision by necessity, proportionality, consent and justification, and treats a record of the reasoning as part of the decision.

In a written response, say what was shared, with whom, why it did not meet the need-to-know test, and what now prevents it.

What these words mean

The three terms that decide where a complaint goes, and the words the course is built on.

Preliminary Proceedings Committee: The committee of the Medical Council, NMBI, the PSI and CORU that looks at a complaint before any inquiry: it may take no further action, suggest mediation, conclude the matter with an undertaking or a consent where its Act allows, or refer the complaint to an inquiry. Under the Dentists Act the Fitness to Practise Committee considers whether there is a prima facie case.
Fitness to practise inquiry: The hearing stage: before the Fitness to Practise Committee at the Medical Council, NMBI and the Dental Council, and before the Professional Conduct Committee or the Health Committee at the PSI and CORU. Any sanction heavier than an advice, admonishment or censure takes effect only when the High Court confirms it.
Professional misconduct: A ground under all five Acts — of a complaint under four of them, and of an application for an inquiry under the Dentists Act. The Dental Council describes it as a serious falling short in the standards expected of a dentist; the PSI as behaviour that goes against its Code of Conduct for registered pharmacists; CORU as any act, omission or pattern of conduct that breaches the Code.

Need-to-know and the other terms the course uses

Confidentiality: The obligation to protect all personal, sensitive and clinical information obtained through the professional relationship, and not to disclose it without proper justification.
Need-to-know principle: Information is shared only with someone involved in the patient’s care or a justified process, only where it is relevant to their task, and only to the minimum necessary.
Indirect identifiers: Details such as age, location, timing, family circumstances or a rare condition that can identify a patient without a name.
Explicit and implied consent: Consent to sharing stated verbally or in writing, or inferred from the patient’s actions, such as agreeing to care by a multidisciplinary team. Implied consent covers sharing directly related to care.
Best interests: Sharing without consent where it is necessary to protect the patient’s welfare, weighing the severity and immediacy of the risk, limited to what is required and recorded with the reasons.
Proportionality: Sharing no more than the purpose needs. The course treats over-sharing as a breach as much as under-sharing can be a risk.
Audit trail: The log of who opened an electronic record and when. Access logs are examined in confidentiality investigations.
Remediation: Targeted, proportionate, sustained and verifiable changes aimed at the specific failure, such as a recipient check, a privacy screen or a revised MDT protocol.

The Acts a complaint is made and decided under

Ireland’s five health regulators each work under their own Act, all five amended by the Regulated Professions (Health and Social Care) (Amendment) Act 2020. These are the sections that say who may complain, on what grounds, and who looks at the complaint first.

Medical Council — Medical Practitioners Act 2007, section 57

A person, including the Council, may complain to the chief executive officer. The grounds include professional misconduct, poor professional performance, a relevant medical disability, and a failure to comply with a condition, an undertaking or a consent. The chief executive officer looks at the complaint first, an Authorised Officer may gather the facts, and the Preliminary Proceedings Committee decides whether there is enough cause to take further action. Read it.

For this course: Section 7 covers employer and regulatory processes running side by side, and Section 8 insight after a breach.

NMBI — Nurses and Midwives Act 2011, section 55

A person, including the Board, may complain to the chief executive officer. The grounds include professional misconduct, poor professional performance, non-compliance with a code of professional conduct, a relevant medical disability, and an irregularity in relation to the custody, prescription or supply of a controlled drug. A Preliminary Proceedings Committee, assisted by a case officer, may refer a complaint to the Fitness to Practise Committee for a sworn oral inquiry. Read it.

For this course: NMBI’s Guidance on Sanctions counts remedial action among mitigating factors; Section 8 covers targeted remediation after a breach.

Dental Council — Dentists Act 1985, section 38

The Council or any person may apply to the Fitness to Practise Committee for an inquiry, on grounds that include alleged professional misconduct and alleged unfitness to practise by reason of physical or mental disability. The Fitness to Practise Committee considers whether there is a prima facie case, and if there is, it holds the inquiry. Read it.

For this course: Section 6 covers digital records, access and electronic communication, and Section 9 the safeguards of daily practice.

Pharmaceutical Society of Ireland — Pharmacy Act 2007, section 35

A complaint may be made in writing by or on behalf of any person, or by the registrar. The grounds include professional misconduct, poor professional performance, the effect on practice of a physical or mental ailment, emotional disturbance, or alcohol or drug addiction, and a failure to comply with a condition or an undertaking. The PSI separates a concern from a statutory complaint, which is for issues of a serious nature; its Preliminary Proceedings Committee may refer a complaint to a committee of inquiry or to mediation. Read it.

For this course: Section 7 covers what investigators examine in a confidentiality case, and how to respond when a breach is identified.

CORU — Health and Social Care Professionals Act 2005, section 52

A complaint may be made to the Council by or on behalf of any person, or by a registration board. The grounds include professional misconduct, which CORU describes as any act, omission or pattern of conduct that breaches the Code, and poor professional performance. The Preliminary Proceedings Committee screens out complaints that are trivial, vexatious, without substance or made in bad faith; the Professional Conduct Committee deals with conduct or competence, and the Health Committee with whether a registrant’s health is affecting their ability to practise. Read it.

For this course: Confidentiality was a theme in 10% of the cases CORU concluded in 2022 to 2024; Section 4 covers information sharing and consent.

Also engaged: Sanctions — advice, admonishment or censure, conditions, suspension and cancellation (erasure under the Dentists Act): Medical Practitioners Act s.71, Nurses and Midwives Act s.69, Dentists Act ss.39 to 41, Pharmacy Act s.48, Health and Social Care Professionals Act s.66 · High Court confirmation — the heavier sanctions take effect only when the High Court confirms them; an advice, admonishment or censure on confirmation or once the appeal window of 21 or 30 days passes without an appeal · The 2020 Act — the Regulated Professions (Health and Social Care) (Amendment) Act 2020, which amended all five Acts in stages from 2021 to 2025.

What happens after a complaint reaches an Irish regulator

Each regulator has its own Act and its own names for the stages, and your letter tells you which stage you are at. At each of them the same three things are worth showing in writing: that you see what went wrong, that you understand it against your regulator’s code, and what you have changed, with dated evidence.

The complaint and the grounds
Anyone may complain, including the regulator itself. Under the Medical Practitioners Act and the Nurses and Midwives Act the complaint goes to the chief executive officer; under the Pharmacy Act it may be made by or on behalf of any person or by the registrar; under the Health and Social Care Professionals Act by or on behalf of any person or by a registration board. Under the Dentists Act the Council or any person applies to the Fitness to Practise Committee for an inquiry. Professional misconduct is a ground of complaint under the other four Acts, and a ground for an application for an inquiry under the Dentists Act.
The preliminary stage
The Medical Council, NMBI, the PSI and CORU each have a Preliminary Proceedings Committee. At the Medical Council the chief executive officer looks at a complaint first and may assign an Authorised Officer, and the committee decides whether there is enough cause to take further action. At NMBI the committee may refer a complaint to the Fitness to Practise Committee for a sworn oral inquiry, or suggest mediation or informal resolution; at the PSI it may refer a complaint to a committee of inquiry or to mediation; at CORU it screens out complaints that are trivial, vexatious, without substance or made in bad faith. Under the Dentists Act the Fitness to Practise Committee considers whether there is a prima facie case.
Undertakings, consents and mediation
A complaint can be concluded by agreement in some cases. At the Medical Council’s preliminary stage a doctor may be asked to undertake not to repeat the conduct, or to consent to censure (2025 procedures). At NMBI in 2024, 12 undertakings or consents concluded matters at the preliminary stage and the Fitness to Practise Committee recommended 32 (State of Complaints 2024). Undertakings were the largest single Committee of Inquiry outcome in the cases CORU concluded in 2022 to 2024: 13, against 7 censures (trends report). In 2024 the Dental Council accepted undertakings from a dentist instead of making a High Court application (Annual Report 2024). Mediation at NMBI and CORU needs the consent of both sides.
The inquiry
The inquiry committee is the Fitness to Practise Committee at the Medical Council, NMBI and the Dental Council, and the Professional Conduct Committee or the Health Committee at the PSI and CORU. At NMBI allegations against a nurse or midwife must be proven beyond reasonable doubt. Medical Council inquiries are held in public unless the Council decides on a hearing in private or part private (Medical Council); CORU says its Professional Conduct Committee hearings are normally held in public and its Health Committee hearings normally in private.
The sanction and the High Court
Sanctions run from advice, admonishment or censure (admonishment or censure at the PSI and CORU) through conditions and suspension to cancellation, called erasure under the Dentists Act (MPA s.71, NMA s.69, Dentists Act s.39, Pharmacy Act s.48, HSCP Act s.66). The heavier sanctions take effect only when the High Court confirms them; an advice, admonishment or censure takes effect on confirmation or once the appeal window passes without an appeal: 21 days for doctors, nurses, midwives and dentists, 30 days for pharmacists and CORU registrants (MPA s.74, NMA s.72, Dentists Act s.41, Pharmacy Act s.50, HSCP Act s.68).
Interim measures and your first reply
Separately, the Medical Council says interim suspension is possible under section 60 of the Medical Practitioners Act 2007; where there is a serious and immediate risk, the PSI’s Council can seek suspension from the High Court; and the Dental Council may apply to the High Court for suspension under section 44 of the Dentists Act. None of the five regulators publishes a fixed deadline for a first reply: the Medical Council gives not less than two weeks to respond to an Investigation Report, and NMBI says you may request an extension of time. Take advice before you reply.

Facing a complaint to your regulator or a fitness to practise inquiry? This course helps you remediate — and show it.

Buy this course — €100 (€70 with Bulk Buy 10)

Courses with the Ethics and Professionalism pair written to your own regulator’s code — for doctors, nurses and midwives, dentists, pharmacists and all other healthcare professionals, or every course →

Frequently asked questions

I did not name the patient. Is it still a breach?

It can be. The course treats a patient as identifiable from context — age, location, timing, family circumstances or a rare condition — and lists I didn’t name the patient among the responses that show poor insight. Section 1 covers indirect identifiers, and Section 8 how to write about a breach without minimising it.

I only looked at the record and shared nothing. Is that a breach?

The course treats access without a legitimate professional reason as a breach in itself, even when nothing is shared, and notes that electronic access is logged and can be reviewed in an investigation. Sections 3 and 6 cover inappropriate access, and Section 7 the response when it is identified.

It was accidental. Does that matter?

Intent is one of the things an investigation looks at, alongside the sensitivity of the information, how it was disclosed and what you did afterwards. The course says accidental breaches still require accountability and remediation, and that prompt reporting, honesty and mitigation reduce escalation.

What should I do as soon as I realise there has been a breach?

Stop any further disclosure, secure the information and systems, and tell the appropriate manager or data protection lead. Be honest about what happened, do not conceal or minimise it, and consider whether the patient should be told. Then take advice. Section 7 covers the immediate response.

Should I take advice before I respond?

Yes — before anything is written to the regulator, a committee or your employer. Whatever your profession, ask your indemnifier, your union or professional body, or a solicitor. Nothing on this page is legal advice.

How long does it take, and how long do I have access?

The course is 2 CPD hours, self-paced, with access for twelve months from purchase. The certificate is issued on completion, dated, with the course title and the CPD hours. Whether the hours count towards your own CPD requirement is for your regulator or scheme to say: doctors must undertake a minimum of 50 hours in each scheme year, and CORU registrants must achieve 30 CPD credits in every 12-month period.

Can I get a certificate with a later date?

No. The certificate records the date you completed the course, and that date does not change. If your regulator, an inquiry committee or an employer asks for recent evidence, you buy the course again: half price within twelve months of your original purchase, the full €100 after that.

Will anyone be told that I am taking the course?

No. Nobody is told you are enrolled. We do not share participant details with any regulator, an employer, a union or an indemnifier; the certificate reaches them only if you attach it to your own response.

A confidentiality complaint can raise questions about records, consent and communication. These are the courses that pair with this one.

Privacy, Consent and Chaperone in Healthcare Practice

Patient privacy, valid consent, intimate examinations, chaperones and how each is documented, and complaints about an examination.