Professional Boundaries, Confidentiality and Social Media

Confidentiality. Confidentiality is the obligation to keep information about a patient private, sharing it only as needed for their care. It flows from the fiduciary relationship: the patient trusts the surgeon with facts they would tell almost no one else (substance use, mental health, an injury that embarrasses them, a diagnosis they have not shared with family), precisely so the surgeon can treat them well.

Why a breach matters. Break that trust and two things break at once. The individual patient is harmed, and the wider public loses confidence in the profession and starts withholding information that medicine depends on.

Professional boundaries. These are the limits that keep the relationship clinical and therapeutic. A boundary is crossed whenever a surgeon uses the relationship for something other than the patient's benefit: a romantic interest, a financial arrangement, a favour, a social friendship that blurs judgement.

How boundaries erode. Most boundary violations do not begin with intent to harm. They begin with a small, well-intentioned exception ("I will just see my colleague's daughter quickly", "I will accept this gift, it would be rude not to") that erodes objectivity one step at a time.

Social media. It has not invented a new ethical domain; it has changed the scale, reach and permanence of disclosure. A joke overheard in a corridor reaches three people and is forgotten. The same content on a public account reaches thousands and remains retrievable indefinitely.

Whose information it is. The single most important idea on this page is that privacy belongs to the patient, not the doctor, and information about a patient is held in trust. Decisions to disclose, to treat a friend or to post online are therefore decisions about the patient's rights rather than about your own conduct, and they must be justifiable to the patient, the regulator and the court.

The four principles. Every answer on this topic should be anchored in the four-principles framework of Beauchamp and Childress:

• Respect for autonomy: the patient decides what is shared, and with whom
• Beneficence: use information for the patient's good
• Non-maleficence: do not allow disclosure to cause harm
• Justice: use information fairly and equitably

Confidentiality sits squarely on autonomy and non-maleficence; boundaries sit on non-maleficence and the integrity of the fiduciary relationship. Name the principle in conflict, then resolve it out loud. That is what the examiner is listening for.

The law in the United Kingdom. Three duties are layered on top of the ethics:

• The common-law duty of confidence: information shared in a therapeutic context is confidential in law, and unauthorised disclosure can found a claim.
• Data-protection law (UK GDPR and the Data Protection Act 2018): personal and special-category (health) data must be processed lawfully, fairly, securely and for a specified purpose, with the patient's rights of access and erasure.
• The professional duty in the GMC's Good Medical Practice and its dedicated Confidentiality guidance: the practical rulebook that sets out when disclosure is permitted, encouraged or required.

Bolam and Bolitho. Bolam (1957) held that a doctor is not negligent if they act in accordance with a practice accepted by a responsible body of medical opinion. Bolitho (1997) qualified this by holding that a court need not accept a body of opinion that cannot withstand logical analysis. The lesson for boundaries and confidentiality is direct: "everyone does it" is not a defence if the practice is not defensible.

Montgomery (2015). Montgomery reframed the relationship around patient autonomy. The same autonomy logic that drives informed consent also drives disclosure: what a reasonable patient would expect to be kept private or told governs the analysis.

Structured handover. ISBAR (Identify, Situation, Background, Assessment, Recommendation) is the structured handover tool that makes confidential information transfer safe. It forces you to confirm the identity of the recipient and the patient before any clinical detail is shared, which is exactly the discipline a corridor, a phone call or a WhatsApp message lacks.

The theatre checklist. The WHO Surgical Safety Checklist applies the same logic in theatre. Sign In, Time Out and Sign Out each force confirmation of the correct patient, site and team, catching the misidentification and communication errors that are a common root cause of harm.

Research and registries. Where orthopaedic practice meets research, audit or registries, the Declaration of Helsinki makes confidentiality of participant data an explicit international duty. Consent for any data use beyond the original purpose, and secure handling, are mandatory.

Three habits. In day-to-day practice, confidentiality is maintained by three habits: share only what is necessary (the minimum necessary principle), share it only with those who need it for the patient's care, and share it on a secure channel.

How breaches happen. Most breaches are accumulated small failures rather than dramatic leaks: a patient discussed in a lift, a name left on a whiteboard visible from the waiting area, a referral letter emailed to the wrong "J. Smith", a clinical photograph taken on a personal phone and auto-backed-up to a personal cloud. The NHS Caldicott Principles (eight in total) and the US HIPAA Safe Harbor list of identifiers exist to make the three habits concrete. The HIPAA list runs to 18HIPAA identifiers, including names, dates finer than year, geographic units smaller than state, and device serial numbers.

Within the team. The duty is to share appropriately, not to withhold. Members of the direct care team may access the record on a need-to-know basis, and you should not discuss a patient with colleagues who are not involved in their care. The legitimate recipients are wider than the operating surgeon (nurses, therapists, the ward clerk booking the scan, the laboratory processing the sample), but each access must be justifiable, and curiosity is not a clinical need.

The exceptions. The situations where confidentiality can or must yield are narrow. Memorise the structure: consent, legal requirement, overriding public interest.

The third-party request that feels reasonable. This is a recurring trap. A parent asks what is wrong with their competent adult daughter; a coach wants the MRI result of a star athlete; an employer asks whether an injured worker is fit; a police officer asks, informally, whether a patient was the driver. None of these is a basis to disclose without the patient's consent, and the response is constant: explain that you cannot share clinical information without the patient's agreement, and offer to facilitate a conversation with the patient present and consenting.

De-identification is harder than it looks. Removing the name is not enough. A case described in enough clinical detail (a rare fracture in a named sportsman, an unusual complication of a specific implant in a specific town, an unusual injury on a particular date) can re-identify the patient to family, colleagues or the patient themselves. Published cases have been recognised by friends, family and the patients themselves. The HIPAA Safe Harbor standard removes all eighteen identifiers, and anything short of that is potentially identifiable. If a real patient could plausibly recognise themselves, ask for consent before you publish or post it, or do not post it at all.

The duty survives death. Confidentiality continues after a patient dies, out of respect for the person they were and for the family they leave behind, though the basis for disclosure may shift toward the public interest.

The overriding public interest. This is the hard, and most examined, situation: when keeping confidence would itself cause serious harm. The duty of confidence is not a licence to stand by while someone is hurt. The test is whether disclosure is necessary to avoid a serious and proximate harm that outweighs the patient's privacy, and the bar is genuine and serious, not hypothetical or convenient.

Where the test arises. Examples include:

• A communicable disease that endangers contacts
• A violent patient who threatens a named victim
• Suspected abuse of a child or vulnerable adult
• A driver who is unsafe and will not stop driving
• A fitness-to-practise concern about a colleague

Work through the decision in order.

Dual relationships. A dual relationship is any situation in which a surgeon holds a second, non-clinical relationship with a patient: relative, friend, employer, business partner, romantic interest. Each one introduces a conflict that can distort the one relationship that matters, the therapeutic one.

Treating family, friends, staff or yourself. Objectivity is lost. The history becomes incomplete because the patient does not want to embarrass someone they know, the examination is abbreviated, the records are poor because "it is just for a friend", prescribing is unsafe, and the patient cannot freely refuse. The GMC, AAOS and most regulators treat treating family, friends or close colleagues as something to avoid except in genuine emergencies. Decline and arrange independent care; in an emergency provide only minimal, documented, stop-gap care, followed by proper handover.

Sexual or romantic relationships. This is the most serious boundary violation: a fundamental breach of trust and of the fiduciary relationship, serious professional misconduct, possibly criminal, and a career-ending event for good reason. The power imbalance makes genuine consent impossible within the relationship. Never initiate one while the clinical relationship exists. The duty does not necessarily end when the clinical relationship ends; a relationship with a former patient may still constitute misconduct, particularly where the patient was vulnerable or the care was recent. There is no safe version of this boundary to test.

Gifts, loans and hospitality. Gifts from patients are common and usually kindly meant, and the line is drawn at value and intent. A box of chocolates after a good outcome is different from an expensive watch: a significant gift, loan or hospitality creates an obligation that can distort clinical decisions, and risks exploitation of a vulnerable patient.

• Decline significant gifts politely
• A small token may be accepted
• Never accept money or loans
• Document any accepted gift and the reason

Conflicts of interest. These are pervasive in orthopaedics because of the industry relationships around implants and devices, and financial gain can bias clinical judgement and the advice given. The duty is to declare them (to the patient, the institution and in publications), to manage them (a second opinion, exclusion from a decision), to keep clinical and commercial roles separate, to follow AAOS or GMC conflict-of-interest guidance, and never to let financial interest determine which implant you use. A declared and managed conflict is usually defensible; an undeclared one rarely is.

The headline rule. Assume everything you post is public, permanent, and retrievable by a regulator, an employer, a patient and a lawyer. Treat it as in print forever, because it effectively is.

Private is an illusion. "Private" accounts, disappearing messages and closed groups give a false sense of safety, because content is screenshotted, forwarded and indexed by search engines. The standards expected offline apply in exactly the same way online (GMC, "Doctors' use of social media"; AAOS Code of Ethics and Professionalism).

What reaches regulators. The failures are consistent, and they map onto the offline duties:

• Patient-identifiable information, even in disguised form. A photograph of an interesting case in theatre, a description of a dramatic injury or a "great save today" post can each identify the patient. Never post clinical images without explicit, documented consent.
• Criticism of patients or colleagues. Venting about a "difficult" patient or an incompetent colleague is unprofessional, breaches confidence and damages trust in the profession, and the subject often finds out.
• Misinformation. Endorsing unproven treatments, spreading health misinformation or presenting opinion as fact harms patients and the profession.
• Testimonials and advertising. Many jurisdictions restrict the use of patient testimonials and prohibit misleading advertising; never encourage patients to post reviews in a way that breaches their privacy.
• Conflicts of interest. An undisclosed financial relationship with an implant manufacturer, promoted on social media, is a serious breach.

Two accounts. The separation that prevents most trouble is to keep a personal account and a professional account apart, and never accept a patient as a friend on a personal account. Friending a patient blurs the boundary, exposes both your private life and theirs, and undermines the therapeutic distance. Use a clearly labelled professional account for health information.

Before you post. Ask whether the post would genuinely help patients or the profession, and whether you are speaking for yourself or for your employer, and have said so. Then read it as if the patient it concerns were reading it over your shoulder.

Everything below condenses the topic for revision and viva practice — the high-yield points, the memory hooks, two worked vivas, and a one-screen cheat sheet.

Related pages: Core Bioethics Principles supplies the four-principles framework this page applies - confidentiality is autonomy operating on information, and the public-interest test is the point where it yields to non-maleficence toward third parties; Informed Consent and Shared Decision-Making for the other half of the same duty, since consent to treatment and consent to disclosure are governed by the same Montgomery-era reasoning about what this patient would want to know; Medicolegal Principles and Negligence for Bolam, Bolitho and Montgomery in their original setting, and for what happens when a breach of confidence becomes a claim rather than a complaint; Research Ethics and Integrity for the Declaration of Helsinki duties that take over the moment clinical data are used for a study, an audit publication or a registry; and Communication, Teamwork and Crew Resource Management for the structured-handover tools referenced above, where the surgical-checklist evidence properly belongs.