NHS INTERVIEW GUIDE

Confidentiality and Information Governance Interview Questions: How to Answer Them

The principles behind NHS confidentiality and information governance questions, 12 practice questions with tips, worked scenario answers, common mistakes and a preparation plan.

Last updated 24 October 2026 · Created by a practising NHS doctor · Independent of the NHS

Quick answer

How do I answer confidentiality and information governance questions in an NHS interview?

Show that you treat information as the patient's, share only the minimum with people who need to know, check identity and consent before giving anything out, and follow local policy. Name the Caldicott Principles and UK GDPR at principle level, explain when you would share for safeguarding, say you would report breaches immediately, and support it all with a real STAR example.

Key takeaways

Need to know and minimum necessary are the core ideas.
Always verify identity and consent before sharing.
Confidentiality never outweighs safeguarding someone at risk.
Report breaches immediately and be open about mistakes.
Use a STAR example with no identifying details.

To answer confidentiality and information governance questions in an NHS interview, show that you treat personal information as belonging to the patient, share only what is needed with people who need it, check identity before giving anything out, and follow local policy. Back this up with a real example, and show that you know when sharing is the right thing to do, such as for safeguarding, and that you would report a breach straight away rather than hide it.

These questions come up for almost every NHS post, from receptionists and healthcare assistants to nurses, therapists, porters and managers, because everyone handles personal information. This guide covers the principles panels expect, 12 practice questions with tips, worked scenario answers, the mistakes that cost marks and a short preparation plan. The questions are original practice material, not questions from any real interview.

In this guide

Why do NHS interviews ask about confidentiality?
What principles of confidentiality should I know for an NHS interview?
How do I answer a phone enquiry question in an NHS interview?
What should I say about social media and confidentiality?
When is it right to share confidential information without consent?
What should I do if there is a data breach?
What confidentiality and information governance questions might I be asked?
What do interview panels look for in a confidentiality answer?
What are the common mistakes in confidentiality interview answers?
How should I prepare for confidentiality questions?
Where can I get more help preparing?

Why do NHS interviews ask about confidentiality?

Panels ask because one careless disclosure can harm a patient, break the law and damage trust in the service. They want to know you protect information as a habit, not only when someone is watching.

Information governance (IG) is the set of rules and practices for handling information safely and lawfully. Most trusts require yearly IG or data security training, so panels expect the basics in every role. Link your answer to the NHS values of respect and dignity and to patient safety.

What principles of confidentiality should I know for an NHS interview?

You need the principles, not legal detail. Panels listen for a few core ideas that apply in every role.

Most NHS policies rest on the UK GDPR and the Data Protection Act 2018. In short, personal data must be used lawfully, fairly and transparently, for a clear purpose, kept to the minimum needed, accurate, not held longer than necessary and secure. Health information is a special category that needs extra protection. There is also a common law duty of confidentiality and your regulator's standards. Application differs across the four UK nations, so follow local policy.

The Caldicott Principles are the NHS framework most panels recognise. The eight principles are: justify the purpose, use identifiable information only when necessary, use the minimum necessary, give access on a need to know basis, make sure everyone understands their responsibilities, comply with the law, remember the duty to share can be as important as the duty to protect, and tell patients how their information is used. Every NHS organisation has a Caldicott Guardian who advises on difficult sharing decisions.

Need to know: only open records you need for your current task, never out of curiosity.
Minimum necessary: share only the details the other person needs.
Check identity: confirm who someone is and their right to the information first.
Secure handling: lock screens, use secure email, follow smartcard rules, use confidential waste.
Ask and escalate: if unsure, ask your manager, the IG team or the Caldicott Guardian.

How do I answer a phone enquiry question in an NHS interview?

Say you would not confirm anything about a patient, even that they are in hospital or registered with the service, until you have checked who the caller is and that the patient has agreed to them being told. Then explain what you would do instead, so you still sound helpful.

Good steps include taking the caller's details, checking the record for consent or a nominated contact, using any agreed password, calling back on a verified number and passing a message to the patient or clinical team. Requests from police or solicitors usually go through a formal process handled by the IG or legal team.

Worked scenario: an anxious relative on the phone

Question: A caller says she is a patient's daughter and wants to know how her mother is. What would you do?

Answer: I would be kind, because she is clearly worried, but I would not confirm her mother is on the ward until I knew she was entitled to that. I would take her name and number and check the record for a named contact or agreed password. If she was not listed, I would explain that I protect every patient's privacy, then ask the patient, if they have capacity, whether they are happy for me to share an update. If they agreed, I would call back or ask the nurse in charge to speak to her. If unsure at any point, I would check with the nurse in charge and follow our policy. The patient stays in control of their information and the daughter still gets help.

What should I say about social media and confidentiality?

Say you never post anything about patients, colleagues or workplace incidents, even without names, because small details can identify someone. Add that you follow your trust's social media policy and your professional body's guidance.

Useful points: no photos in clinical areas, no friend requests from patients, no discussing work in public groups, and reporting a colleague's inappropriate post through the proper route.

When is it right to share confidential information without consent?

Sharing without consent can be right when it is needed to protect someone from serious harm, such as a safeguarding concern, or when the law requires it. Show the panel you would not let confidentiality stop you protecting a child or an adult at risk.

Explain that you would follow your safeguarding policy, involve your manager or safeguarding lead, share only what is relevant with the right people, and record what you shared, with whom and why. Never promise a patient you will keep a secret before you know what it is. Our separate safeguarding guide covers these scenarios in more depth.

What should I do if there is a data breach?

Say you would act quickly, contain the problem if you safely can, tell your manager and report it on the incident system straight away. Panels want honesty and speed, not someone who tries to fix it quietly.

Breaches include a letter or email sent to the wrong person, a lost handover sheet, an unlocked screen or looking at a record without reason. The IG team decides whether to report it to the Information Commissioner's Office, which has strict time limits, so delay matters.

Worked STAR example: a misdirected email

Situation: In my admin role I realised I had emailed a clinic letter to a patient with a similar name.

Task: I needed to limit the harm and report it properly.

Action: I told my manager within minutes, tried to recall the email and, with my manager's guidance, phoned the recipient to ask them to delete it and confirm they had. I logged an incident the same day and helped the IG team with their questions.

Result: The recipient confirmed deletion and the correct patient was told what had happened. I now check two identifiers before sending, and our team added a name check to the letter process, which I shared at a team meeting.

What confidentiality and information governance questions might I be asked?

Here are 12 practice questions with a tip for each.

What does confidentiality mean to you? Tip: link it to trust, respect and patient safety, not just rules.
What is information governance? Tip: give a plain definition and one practical example from your work.
Can you name the Caldicott Principles or explain one? Tip: explain need to know and the duty to share well rather than reciting a list.
A caller asks if their friend is a patient here. What do you do? Tip: verify, check consent, offer to pass a message.
A colleague is looking at a celebrity's record. What would you do? Tip: challenge if safe, report to your manager, explain why.
You find patient notes left in a public corridor. What next? Tip: secure them, return them, report it as an incident.
A patient asks you to keep a secret. How do you respond? Tip: explain you cannot promise until you know it might not involve risk.
When would you share information without consent? Tip: safeguarding and legal duties, with escalation and records.
You sent information to the wrong person. What would you do? Tip: contain, report immediately, be open, learn.
A friend messages asking about a neighbour you saw in clinic. What do you say? Tip: say nothing, not even confirmation, and stay friendly.
How do you keep information secure day to day? Tip: locked screens, smartcards, confidential waste, quiet conversations.
Tell us about a time you protected someone's privacy. Tip: use STAR and focus on your own actions.

What do interview panels look for in a confidentiality answer?

Panels usually score you higher when your answer shows the following.

Patient first: you see the information as the patient's, not the organisation's.
Practical steps: you say exactly what you would do, in order.
Balance: you protect privacy but would share when safety demands it.
Knowing your limits: you escalate to a manager, IG team or Caldicott Guardian when unsure.
Honesty: you report mistakes promptly and learn from them.

What are the common mistakes in confidentiality interview answers?

Reciting law without action: naming UK GDPR but never saying what you would do.
Being too rigid: saying you would never share anything, which ignores safeguarding.
Being too relaxed: giving updates to someone who sounds genuine without checking.
Breaching confidentiality in the answer: using real names or identifying details in your example.
Hiding errors: describing fixing a breach quietly instead of reporting it.
Forgetting the person: sounding cold to a worried relative instead of helpful and kind.

How should I prepare for confidentiality questions?

A few focused hours are usually enough. Try this plan in the week before.

Day 1: read your trust's confidentiality, IG and social media policies if they are public, and the job description.
Day 2: learn the eight Caldicott Principles in your own words and the main ideas of UK GDPR.
Day 3: write two STAR examples: one where you protected privacy and one where you shared or escalated appropriately.
Day 4: practise the phone, social media and breach scenarios out loud, ideally with a colleague, mentor or practice educator.
Day 5: refresh your mandatory IG training notes and run through the 12 questions above.

Where can I get more help preparing?

Good free sources include your trust's IG team and policies, NHS Jobs interview advice, your line manager or practice educator, your union or professional body such as the RCN or Unison, and careers services. Some people pay for a coach.

Healthcare Interview Prep is one self-study option, covering 471 NHS roles with 40 original practice questions and model answers each; the first 8 are free and a full role bank is £4.99 for 12 months. It does not offer live coaching or mock interviews, so also practise with a real person.

Frequently asked questions

Do I need to know UK GDPR in detail for an NHS interview?

No. For most roles you only need the principles: use personal data lawfully and for a clear purpose, keep it to the minimum, keep it accurate and secure, and do not keep it longer than needed. Panels care far more about what you would actually do in a situation than about legal wording. IG specialist or records management roles may expect more detail, so check the person specification.

What are the 8 Caldicott Principles in simple terms?

Justify why you need the information, use identifiable data only when necessary, use the minimum needed, limit access to those who need to know, make sure everyone understands their responsibilities, follow the law, remember the duty to share can be as important as the duty to protect, and tell patients how their information is used. Explaining two or three of these well in an interview is better than reciting all eight.

Can I tell a patient's family how they are doing?

Only if the patient has agreed, or there is another lawful basis, for example when someone lacks capacity and sharing is in their best interests under local policy. Check the record for a named contact, confirm the caller's identity and ask the clinical team if unsure. In an interview, show you would protect privacy while still being kind and offering to pass on a message.

Is looking at my own medical record at work a breach?

In many trusts, yes. Accessing any record, including your own or a family member's, without a work reason usually breaks local policy, and system access is often audited. The right route is a formal request, such as a subject access request, or asking your GP. Saying this in an interview shows you understand need to know applies to everyone, including you.

What counts as a data breach in the NHS?

Any incident where personal information is lost, shared with the wrong person, accessed without reason or not kept secure. Common examples are misdirected letters or emails, lost handover sheets, unlocked screens and inappropriate record access. Staff should report it straight away to their manager and on the incident system. The IG team then decides whether it must be reported to the Information Commissioner's Office.

Practice question banks for related NHS roles

Practise with NHS interview questions for your role

Each NHS role on this site has 40 original practice questions with full model answers. The first 8 are free to read, and the rest of a role's bank costs £4.99 with 12 months' access and no subscription.

More NHS interview guides

Healthcare Interview Prep is an independent NHS interview preparation website. It is not affiliated with, endorsed by or connected to the NHS. Example questions and answers are original practice material, not official or leaked interview questions.

Healthcare Interview Prep: practice questions and model answers for 471 NHS roles across 11 sectors, created by a practising NHS doctor.