A colleague’s post shows patient details

Step 1 · Read the instruction

WHAT TO DO

Check the format and the direction of the scale.

• 1InstructionRank these independent actions
  Judge each action on its own. The options look like steps on an escalation ladder (colleague, registrar, regulator), which makes it tempting to rank them in that order. Rank how appropriate each is, not the sequence you’d climb.
• 2Instruction1, most appropriate, to 4, least appropriate
  1 is best. Each rank is used once.

Step 2 · Work out your role and who is affected

WHAT TO DO

Ask who can fix the problem, and what your relationship with them is.

• 3ScenarioYou see that
  You’ve seen the post yourself, so this is not a rumour or someone else’s report. You can act on it.
• 4Scenarioan F1 colleague has posted a photo
  The colleague is junior to you, and they’re the one person who can delete the post in seconds. Because you’re more senior, speaking to them directly is easier and safer than it would be with a consultant.

The people affected are the patient, whose privacy is being breached, and the colleague, whose career could be harmed by an overreaction.

Step 3 · Separate facts from assumptions, and find the risk

WHAT TO DO

Find the risk and its timescale. Is the harm finished, or still happening?

• 5Scenarioa public social media account
  Anyone can see it, and it can be shared or saved. The harm isn’t a single event in the past: it continues while the post stays up.
• 6Scenarioa patient’s full name is visible
  The patient is identifiable, so this is a real confidentiality breach, not just a borderline photo.

Don’t assume what the colleague intended. The question doesn’t say whether it was a careless mistake or something worse, or whether it has happened before. You’ll see one option makes exactly this assumption.

Step 4 · Name the tension and write your task

WHAT TO DO

Name the duties that pull against each other.

You need to stop an ongoing breach of a patient’s confidentiality quickly, while responding proportionately to a colleague who has probably made a mistake.

Your task: I need to get the post taken down quickly and proportionately, and be ready to escalate if that doesn’t work.

Step 5 · Read each option literally

WHAT TO DO

Break each option into verb + recipient + timing + condition. Ask what it is for: removal, advice, investigation or support?

• 7Option AContact the colleague promptly
  A goes to the person who can delete the post, and the timing is prompt. It also tells them exactly what the problem is.
• 8Option Aask them to remove the post
  A is a clear request with a clear outcome: the post comes down.
• 9Option Bso that they can deal with it
  B involves someone who can help, which is reasonable. But removal now depends on the registrar finding time to act, then contacting the colleague. The post stays up for longer.
• 10Option CReport the colleague to the GMC.
  C uses the regulator, whose role is investigating fitness to practise. That isn’t the need here, and a GMC report doesn’t remove the post. It’s disproportionate as a first response to what appears to be a one-off mistake.
• 11Option Dobviously did not intend
  D relies on “obviously”, an assumption the stem doesn’t support. Even if the mistake was innocent, intent doesn’t protect the patient: the name stays public.

Step 6 · Sort into good, acceptable and poor

WHAT TO DO

Group the options before comparing them.

Step 7 · Compare neighbours and settle the order

WHAT TO DO

Explain each comparison with a fact from the scenario. Be careful with rules of thumb.

A versus B. Both are reasonable. A ranks above B because the post is public and still visible, so speed of removal matters most, and the colleague can remove it immediately. A private approach doesn’t stop you escalating later if it fails.

Note that this isn’t because “a direct conversation always beats telling a senior”. That rule fails when harm is serious, the person has power over you, or speaking privately would be unsafe. Here the facts support A: the colleague is junior, the mistake looks one-off and they can fix it quickly.

B versus C. Both involve someone else. B ranks above C because the registrar can help locally and proportionately. C’s purpose, a regulatory investigation, doesn’t match the need, which is removing the post.

C versus D. This is the hardest pair. Both are poor, so ask which leaves the bigger duty unmet. D lets the breach continue indefinitely and does nothing for the patient. C is excessive, but it treats the breach as a breach. Leaving the patient’s name public is worse than overreacting.

What could change the answer

WHAT TO DO

Ask which fact would make your preferred action inappropriate.

• If the colleague refused to remove the post, or had posted identifiable patient information before, escalating to a senior would become necessary. Local information governance or incident reporting might also be needed.
• If the post contained clinical details or images of the patient, the breach would be more serious. Even after removal, it might need reporting through local processes.

The exam-speed version

1. Ranking, 1 is best. Don’t rank the escalation ladder.
2. Identifiable patient, public post, still visible, so harm is ongoing. The colleague is junior and can delete it.
3. Task: get it down quickly and proportionately.
4. A is fastest and proportionate. B is slower. C is the wrong tool. D leaves it up, so D last.

Take this into your next question

Lesson: match escalation to its purpose. Ask what each option is for. If the need is removal, go to the person who can delete the post. A regulator is for investigation, and only when that is warranted.

When it applies: confidentiality breaches, social media and concerns about colleagues. See social media and private messaging and match escalation to the need.