ISO 15189:2022 · Section 4 · General requirements
Clause 4.2: Confidentiality
Check the exact requirement in your licensed copy of the standard.
Last reviewed
What this clause is about
Confidentiality protects information that patients and service users entrust to the laboratory. It applies to more than a final report: requests, worksheets, telephone conversations, images, stored samples and information received from another source can all reveal sensitive details. Controls must follow information from receipt through use, transfer, storage and eventual disposal.
Map who needs access for each task and how identity is checked before information is shared. A reception worker, visiting engineer and reporting specialist have different needs. Define permissions accordingly, review them when responsibilities change and remove access promptly when a person leaves. Shared accounts and unattended screens make accountability difficult even when everyone has signed an undertaking.
Explain the circumstances in which disclosure is authorised or legally required. Staff should not improvise a response to requests from relatives, employers, insurers or law enforcement. A designated person should check the authority, the information requested and any applicable notification requirements before release. Information supplied by a third party also needs careful handling so that its source is not exposed without an appropriate basis.
Include everyday physical safeguards: private conversations, protected print areas, secure transport containers and approved disposal routes. Check communication channels before sending reports and investigate misdirected messages promptly. An incident response should contain exposure, assess consequences, involve appropriate privacy expertise and record decisions. Local law and contractual obligations determine important details, so the laboratory's procedures should identify the relevant advice and escalation routes rather than promise absolute secrecy in every circumstance.
What assessors typically ask to see
- How is a caller authorised before staff disclose a result or confirm that a patient attended?
- How are access rights approved, reviewed and removed across reporting systems and shared storage?
- Who decides whether an unusual disclosure request has a lawful basis and requires patient notification?
- How are confidential papers, samples and removable storage protected during transport and disposal?
- What do staff do immediately after discovering a report sent to the wrong recipient?
Documents and records that usually provide evidence
- Confidentiality and information disclosure SOP
- Staff confidentiality undertakings and induction records
- System access authorisation and removal forms
- Authorised disclosure request and release log
- Secure records disposal certificates and collection logs
- Privacy incident reports and corrective action records
Ready-made forms mapped to clause 4.2: Code of Ethics, Impartiality & Confidentiality Declaration.
Common findings to avoid
- Former staff retain active access because employment changes are not communicated to system administrators.
- Telephone results are released after checking a name but not the identity and authority of the caller.
- Paper reports remain visible in public areas or are discarded through an unsecured waste route.
- Disclosure decisions lack a recorded basis, recipient identity or description of information released.
How LabToolkit Pro maps documents to this clause
Each SOP, form and record in LabToolkit Pro can carry clause tags. When a document tagged 4.2 becomes effective, it counts as direct evidence on the readiness dashboard for ISO 15189:2022; links from other standards through the crosswalk are shown separately as indicative coverage. Gaps appear clause by clause, so you can see which parts of 4.2 still need a controlled document or a current record. Readiness is a planning aid — only an accreditation body confirms conformity.
Frequently asked questions
Can results be sent by ordinary email?
Evaluate the channel, recipient verification, access protections and applicable privacy requirements before use. A familiar address is not sufficient assurance, especially when addresses can be mistyped or forwarded. Define approved methods and exceptions, and provide staff with a workable alternative when the preferred secure route is unavailable.
Do confidentiality duties end when employment ends?
Confidential information remains protected after a worker leaves. Explain this during induction and departure, remove access and recover records or devices according to local procedures. Contracts and undertakings support accountability, but they do not replace practical access controls or investigation of suspected misuse.
What should a disclosure record contain?
Record the requester, verified authority, purpose, information released, recipient, date and approving person. Note any required notification or reason it was not appropriate. Keep the record itself protected, because documenting a sensitive disclosure can create another collection of confidential information requiring controlled access.
Check the exact requirement in your licensed copy of the standard.
Put it into practice
Draft, approve and e-sign your SOPs with version control, or get the complete template pack.