When you walk into a clinic or hospital, you hand over some of the most sensitive information you will ever share: your medical history, your test results, your scans, your mental health, and sometimes details of your private life that even your closest family does not know. That trust is not a social courtesy. It is a precondition for good medicine, because a patient who fears that their secrets will leak will hold back exactly what the doctor needs to know. This is why confidentiality is one of the oldest duties of the medical profession, and why modern legal systems, Kuwait's included, have turned it from an ethical expectation into a legal obligation with real consequences when it is breached.
Yet the same complaints keep coming up in practice. A hospital employee tells a patient's employer about the diagnosis. A nurse discusses a well-known patient's case in a messaging group. A scan or medical report ends up circulating on social media. A test result reaches a relative before it reaches the patient. Each time, the person affected asks the same questions: Is this something the law actually punishes? Who is responsible, the individual employee or the hospital as well? And how do I prove what happened and claim compensation?
This article answers those questions from a practical, Kuwait-specific angle. It does not repeat the general theory of professional secrecy, which we covered in Disclosure of Professional Secrets under Kuwaiti Law, and it does not deal with your right to see and copy your own file, which is explained in When a Hospital Refuses to Release Your Medical File. Instead, it focuses on the opposite situation: your medical information has gone to someone else without your permission. What liability follows, and what should you do from the first moment?
Quick Answer
Yes. When a doctor, nurse or any other worker at a healthcare facility discloses a patient's medical information without consent and without a lawful reason, that disclosure is unlawful and can give rise to three distinct types of liability at the same time:
- Disciplinary liability before the competent health authority and the employing facility, which can affect the practitioner's licence to practise.
- Civil liability to compensate the patient for material loss (such as a lost job or opportunity) and moral harm (damage to reputation and dignity, distress and humiliation). The individual is liable for their own fault, and the hospital or clinic is liable alongside them as the employer, and also under the treatment contract where the facility is private.
- Criminal liability where the elements of the offence of disclosing a professional secret under the Kuwaiti Penal Code (Law No. 16/1960) are met, potentially combined with offences under the Anti-Cybercrime Law (Law No. 63/2015) where the information was spread by electronic means.
Disclosure is not unlawful where the patient consented, where the law requires reporting (for example certain infectious diseases), where a court or competent investigating authority requests the information, or where it is genuinely necessary to protect another person from serious harm, and in each case only to the extent necessary. The first step for anyone affected is to preserve the evidence immediately, then complain, then pursue a legal claim.
The Legal Framework
Medical confidentiality in Kuwait does not rest on a single provision. It is the product of several bodies of law working together.
The law regulating the practice of medicine and patients' rights
Kuwait's legislation governing the practice of medicine, the allied health professions and patients' rights sets out the duties owed by doctors and their assistants to patients. Respect for the patient's privacy and the confidentiality of information learned through professional practice sit at the core of those duties, alongside the situations in which disclosure is permitted. Breaches of professional duties can lead to disciplinary sanctions under this framework. For the broader picture of who is licensed and subject to these duties, see Regulation of Health Professions in Kuwait.
The Penal Code (Law No. 16/1960)
The Kuwaiti Penal Code criminalises disclosing secrets that a person learns by virtue of their profession, trade or position, outside the situations the law permits. Doctors, pharmacists, nurses and similar professionals are the classic example of people entrusted with secrets because of their work. The same Code also contains the defamation and insult offences, which may overlap with disclosure where the revelation is accompanied by comments that attack the patient's honour or standing.
The Civil Code (Law No. 67/1980)
The Civil Code is the source of civil liability in both of its forms: liability in tort, which obliges anyone who causes harm to another through fault to make good that harm, and contractual liability where a private facility and a patient have a treatment contract that implicitly includes a duty of confidentiality. The Civil Code also makes a principal (the employer) liable for the harm caused by its employee's wrongful act when committed in the course of, or because of, the employee's duties, and it recognises that compensation covers moral as well as material harm.
The Anti-Cybercrime Law (Law No. 63/2015)
This law becomes relevant when the disclosure or publication happens through an information network or electronic means: posting a photo of a report on a social media account, circulating a test result in a messaging group, or accessing a health information system without authorisation to look at a patient's file with no clinical reason. Working out the precise legal characterisation in a given case requires a careful look at the facts.
Criminal procedure, civil procedure and evidence
The Criminal Procedure Code (Law No. 17/1960) governs how complaints are filed and investigated, and allows the victim to bring a civil claim for damages before the criminal court alongside the prosecution. Together with the Civil and Commercial Procedure Code (Law No. 38/1980) and the Evidence Law (Law No. 39/1980), it also governs how courts and investigators can obtain medical records, which is one of the most important lawful exceptions to confidentiality.
Data protection rules and internal policies
In addition, there are rules on the protection of personal data, and internal policies within healthcare facilities that define who may access electronic records and require every access to be logged. These policies are not a separate source of criminal penalties, but they matter a great deal for proof and for establishing the facility's own fault. For the wider context, see Personal Data Protection under Kuwaiti Law.
Substantive Rules
1. What counts as a medical secret?
A medical secret is any information a healthcare provider obtains in the course of practising their profession, whether the patient said it, the doctor discovered it on examination, or it appeared in a test, scan or report. It is not limited to the diagnosis. It covers the bare fact that a person attends a particular clinic (a psychiatric clinic, an addiction service, a fertility clinic), the medication they are prescribed, test results even when they are normal, and the personal and family information mentioned during a consultation. The prevailing test is whether the patient has a legitimate interest in keeping the information private, even without an express request, because the medical relationship itself presupposes confidentiality.
Information does not stop being secret simply because some people already know part of it. A doctor who confirms a rumour, or adds details to it, may be committing a disclosure in their own right, because they lend the story the credibility of an insider.
2. Who is bound by confidentiality?
The duty is not limited to the treating doctor. It extends to everyone who learns the information through their work in the health system, including:
- Doctors of every grade, including trainees and consultants asked for an opinion.
- Nurses, laboratory and radiology technicians, physiotherapists and pharmacists.
- Administrative staff in reception, medical records, insurance and billing, and IT staff who run the systems.
- The healthcare facility itself, public or private, as the holder of the record and the party responsible for controlling and protecting access to it.
The duty survives the end of treatment and the end of employment. A doctor who has left a hospital is not free to talk about cases treated there.
3. Who owns the right to the information?
The person entitled to the secret is the patient, not their family, employer or sponsor. Where the patient is an adult with full capacity, the starting point is that nobody sees their information without their consent, even a spouse, parent or child. The position differs for minors and people lacking capacity, where a guardian or legal representative exercises access and consent rights in the patient's interest. We discussed part of this in Emergency Treatment of a Minor without the Guardian's Consent.
A more delicate question concerns deceased patients: does confidentiality survive death, and who can authorise disclosure? The prevailing view is that the duty does not end with death, and that heirs may have a legitimate interest in access for specific purposes such as proving malpractice or pursuing an insurance claim. However, the scope of that access, and which heirs may exercise it, are matters on which opinions differ, and the court decides them case by case.
4. The most common forms of disclosure
- Telling the employer: a doctor or staff member calls the patient's manager and reveals the diagnosis, or sends a detailed report instead of a sick note limited to what is needed to justify the absence. An employer normally needs to know that the employee was unwell and for how long, not what the illness was.
- Telling the family without consent: informing a spouse or parents of a pregnancy, a mental health condition or a sexually transmitted infection affecting an adult patient who has not agreed.
- Leaking a scan or report: photographing a screen with a phone, sending a file to someone with no role in care, or leaving records where others can read them.
- Talking about the case on social media: a practitioner posts about an "unusual case" with enough detail for people to identify the patient, even without a name, or staff circulate photos of a famous patient in a chat group.
- Leaking a test result: revealing a pregnancy, virus or drug test result to someone other than the patient, or sending it to the wrong phone number because contact details were never updated. Where the problem is an incorrect result rather than its disclosure, see Medical Laboratory Errors in Test Results.
- Snooping in electronic records: an employee opens the file of a relative, neighbour or colleague out of curiosity, with no clinical role, and then passes on what they saw.
- Careless data handling: weak system security, or patient reports left in public corridors. Here the facility may be liable even if nobody intended a disclosure.
5. When disclosure is allowed
Not every disclosure of medical information is unlawful. The law and medical practice recognise situations where disclosure is permitted or even required:
- Patient consent: if an adult patient agrees that a specific person or body may see specific information, disclosure within those limits is lawful. Written consent is safer, and consent to tell a spouse about one result does not mean consent to tell the whole family.
- Notifiable infectious diseases: health legislation requires certain infectious diseases to be reported to the health authorities to protect public health. The report goes to the competent authority, to the extent necessary, and does not justify telling anyone else.
- Court or investigation requests: if a court, the Public Prosecution or another competent investigating authority asks for the file or report, or appoints an expert to examine it, providing it is not a breach. How medical expertise works in court is covered in Medical Expert Evidence before Kuwaiti Courts.
- Protecting others from serious harm: in exceptional cases, a serious and imminent risk to an identified person may justify disclosing what is strictly necessary to prevent it. This exception is narrow, its limits are debated, and it must not be stretched.
- The doctor's own defence: if a patient accuses a doctor of wrongdoing before a court or disciplinary body, the doctor may use the information needed for the defence before that body only, not publicise it.
- Communication within the care team: sharing information among the doctors and nurses actually involved in the patient's care is part of treatment, not a breach, as long as it stays within clinical need.
The common thread is that disclosure must go to the right recipient, to the extent necessary, for a legitimate purpose. Step outside any of those limits and it becomes an unlawful disclosure again.
6. Disciplinary liability
Healthcare workers answer to their employer and to the authority that licenses and supervises them. Sanctions range from warnings to suspension or measures affecting the licence, depending on the seriousness and repetition of the breach. Disciplinary liability is independent of civil and criminal liability: a criminal complaint being shelved does not prevent disciplinary action, and a disciplinary sanction does not replace compensation. A disciplinary outcome does not put money in the patient's pocket, but it helps with proof, because it usually amounts to an official finding that the breach occurred.
7. Civil liability and compensation
Civil liability rests on three elements: fault, harm, and a causal link between them.
- Fault: an unauthorised disclosure, or negligence in protecting the information. Negligence is enough; intent to harm is not required for civil liability.
- Material harm: losing a job, non-renewal of a contract, a missed promotion or job opportunity, the cost of psychological treatment needed after the incident, or business losses caused by the information spreading.
- Moral harm: in disclosure cases this is often the most significant head of damage: embarrassment and distress, damage to reputation and standing, effects on family and social relationships, and the stigma attached to certain conditions.
- Causation: the harm must flow from the disclosure. If an employee was dismissed for reasons unrelated to the leaked information, the claim for job loss weakens, though moral harm remains.
The judge assesses compensation in light of the circumstances: how sensitive the information was, how widely it spread, who received it, the patient's social and professional position, and how the responsible party behaved afterwards (apologising and limiting the damage, or making it worse).
8. The hospital's liability for its staff
The employee who leaked the secret rarely has the means to pay meaningful compensation, so the facility's liability matters a great deal in practice. It can arise in several ways:
- Vicarious liability: the hospital or clinic is liable for harm its doctor, nurse or employee causes through a wrongful act committed in the course of, or because of, their duties. A disclosure by someone who accessed the information because of their job will usually be clearly connected to that job. After paying, the facility may seek recovery from the employee at fault.
- The facility's own fault: if the facility failed to put adequate access controls in place, did not log access to its systems, or stored records carelessly, its fault is direct rather than vicarious.
- Contractual liability in private facilities: the relationship between a patient and a private hospital is contractual, and confidentiality is part of what the facility undertakes, so a breach is a breach of contract.
In government hospitals and health centres, the claim is usually brought against the competent public body as the employer, alongside the employee. Identifying the right defendant and the competent court in a claim against a government body is a technical procedural question that should be settled before filing, because getting it wrong costs time. For the broader framework of healthcare provider accountability, see Medical Liability in Kuwait.
9. Criminal liability
The offence of disclosing a professional secret generally requires that the accused learned secrets through their profession or position, that the information was a secret obtained through that profession, that they revealed it to someone with no right to it, outside the situations the law allows, and that they acted with criminal intent, meaning they knew it was a secret and meant to reveal it. The better view is that mere negligence is not enough for this intentional offence, although it is enough for civil and disciplinary liability.
It is important to distinguish disclosure from defamation. Defamation typically involves attributing a shameful fact to someone, whereas disclosure is complete even if the information is entirely true, because what the law protects is the secret, not the truth. Where the disclosure comes with mocking or insulting comments or false claims, several offences may be engaged at once; see Insult and Defamation Offences under Kuwaiti Law and Insult and Defamation on Social Media.
Where the disclosure or publication happens electronically, the Anti-Cybercrime Law (Law No. 63/2015) may apply alongside the Penal Code. People outside the health sector who repost leaked information may also face liability depending on what they did, even though they were never bound by professional secrecy themselves.
Principles of the Court of Cassation
The following general principles, settled in the case law of the Kuwaiti Court of Cassation, are relevant to medical disclosure claims:
- The Court of Cassation has consistently held that a principal is liable for its employee's acts where the wrongful act was committed in the course of, or because of, the employee's duties, and that it is sufficient that the job gave the employee the opportunity to commit the wrong or helped them do so.
- The Court of Cassation has consistently held that assessing the compensation needed to make good the harm falls within the discretion of the trial court, provided it identifies the elements of harm compensated and gives sound reasons.
- The Court of Cassation has consistently held that moral harm covers anything affecting a person's honour, standing, reputation, feelings and emotions, and that it is compensable.
- The Court of Cassation has consistently held that establishing the fault giving rise to liability, and the causal link between it and the harm, are questions of fact for the trial court.
- The Court of Cassation has consistently held that a final criminal judgment binds the civil court on matters it necessarily decided, namely whether the act occurred and who committed it.
Methodological note: these principles are stated in general terms reflecting the settled approach of the Kuwaiti courts on civil liability, vicarious liability and compensation. We have deliberately not cited case numbers or dates. They are no substitute for reading the published judgments and analysing the facts of each case, as outcomes depend on the circumstances.
Practical Steps and Documents
Step 1: Preserve the evidence immediately
Evidence of disclosure disappears quickly. Messages are deleted, posts are taken down and witnesses lose their nerve. As soon as you learn of the incident:
- Take screenshots that show the account name or sender's number, the date and time, and the link where there is one.
- Keep the original message on the device and do not delete it, since a screenshot alone may be challenged.
- Write down who told you, who received the information and how it reached them, and ask for written statements if possible.
- Record any consequences: a letter from your employer, a change in how you are treated, or an administrative decision based on the information.
Step 2: Complain to the facility
Submit a written complaint to the hospital or clinic management or the patient relations office, stating what happened and when, and expressly asking it to:
- Investigate the person responsible.
- Preserve the access logs for your electronic record (who opened it and when) and not destroy them. These logs are often the strongest evidence of who saw the file.
- Inform you in writing of the outcome.
Keep a stamped copy or proof of delivery. A written complaint proves the facility was on notice, and its response, or its silence, may become evidence later.
Step 3: Complain to the health authorities
File a complaint with the government body within the Ministry of Health that supervises health professions and facilities, whether the facility is public or private, to trigger disciplinary proceedings. This can produce an official decision confirming the breach.
Step 4: Criminal complaint
Where the disclosure was deliberate, or involved publication on social media, you can file a complaint at the competent police station or with the competent investigating authority depending on how the facts are characterised. Electronic offences may be referred to the specialised cybercrime unit. A well-organised evidence file should accompany the complaint, and you may join a civil claim for damages to the criminal proceedings.
Step 5: Civil claim
You may also bring a standalone civil claim for compensation before the competent court against the individual responsible and the facility. The court may order production of the medical file or access logs, or appoint an expert to examine the facts. Compensation claims are subject to limitation periods, so do not delay; it is wise to have a lawyer review the matter early so the deadlines can be calculated precisely.
Documents usually needed
- Proof of the treatment relationship: patient card, appointments, receipts, or a copy of the relevant report.
- Proof of the disclosure: screenshots, original messages, witness statements.
- Complaints filed with the facility and the health authority, and any replies.
- Proof of harm: a dismissal or warning letter, psychological treatment reports, or evidence of the social impact.
- The police report or criminal case reference, if any.
Mistakes to avoid
- Responding publicly to the poster on social media in a way that spreads the information further or exposes you to liability yourself.
- Deleting messages before preserving them properly.
- Relying on a verbal complaint with no written trace.
- Threatening or negotiating with the employee outside legal channels.
Hypothetical Cases
Case 1: The clinic that called the manager
An employee at a private company attends a psychiatric clinic for depression and is given sick leave. The HR manager calls the clinic to verify the leave, and the receptionist says the patient is "being treated for a mental condition and is on strong medication." A few weeks later the company terminates the contract, citing restructuring.
Analysis: The employer is entitled to verify the sick leave, but revealing the nature of the illness and treatment goes beyond what was needed and amounts to disclosure. The receptionist is liable, and so is the clinic as employer. Linking the disclosure to the termination requires proof of causation; the timing and a change in treatment can be useful indicators. Alongside the compensation claim against the clinic, the employee retains rights against the employer under the Private Sector Labour Law (Law No. 6/2010) if the termination was abusive.
Case 2: The scan in the chat group
A public figure undergoes surgery in a hospital. A technician photographs the scan from the machine's screen and sends it to a group of friends, and it spreads across social media with mocking comments.
Analysis: The facts combine disclosure of a professional secret by the technician, the use of electronic means to publish it, and possibly other offences by those who reposted it with insulting comments. The person affected can file a criminal complaint, ask the hospital to preserve the device and system logs, and sue the technician and the hospital for compensation. The breadth of circulation and the nature of the abuse will weigh in the assessment of damages. On photography inside healthcare facilities specifically, see Photography inside Hospitals, Courts and Government Buildings.
Case 3: The test result that reached the family
An adult woman has a test at a private laboratory. The phone number on file is her father's, from a much earlier visit. The lab sends the result by text message to her father, who learns something she wanted to keep private, causing family problems.
Analysis: There was no intent to disclose, so an intentional criminal offence is hard to establish. But civil liability may arise from negligence in updating contact details and failing to verify the recipient before sending sensitive information. The judge may consider whether the patient contributed to the problem (for example by giving her father's number previously and never updating it), which can affect the amount awarded.
Quick Comparison
- Deliberate disclosure by an employee to a specific person (as in Case 1): possible criminal liability, plus disciplinary and civil liability for the employee and the facility.
- Deliberate disclosure with online publication (as in Case 2): the same, with the possible application of the Anti-Cybercrime Law, usually higher damages because of wider circulation, and possible liability for those who repost.
- Negligent disclosure without intent (as in Case 3): mainly civil and disciplinary liability; an intentional offence is usually unlikely; the patient's own contributory fault may be considered.
- Disclosure to a competent authority as required by law (reporting an infectious disease, producing a file at the court's request): no liability as long as it is limited to what is necessary and goes to the right body.
- Disclosure with the patient's consent: lawful within the scope of consent, and a breach beyond it.
Frequently Asked Questions
Can the hospital tell my spouse or family about my condition without my permission?
As a rule, no, if you are an adult with full capacity. The right to the information belongs to the patient alone, and being a relative or spouse does not in itself confer a right of access. The position differs in emergencies where the patient is unconscious and an urgent decision is needed, or where the patient is a minor or lacks capacity.
Can my employer ask to know my diagnosis?
An employer usually needs proof that you were ill and for how long you could not work, not the detailed diagnosis. Where a job requires a particular level of fitness, what is needed is a statement of fitness or unfitness, not the whole file. Anything beyond that requires your consent.
Is it a disclosure if the doctor did not mention my name?
It can be, if the details given are enough for people to identify you, such as your job, area, age and the nature of the case. What matters is whether you can be identified, not whether your name was used.
Who should I sue: the doctor or the hospital?
You can sue both. The doctor or employee is liable for their own fault, and the hospital is liable as employer, and may also be liable for its own failings in protecting data. Including the facility matters in practice because it is better placed to pay compensation.
Am I entitled to compensation if I did not lose any money?
Yes. You can claim for moral harm alone, such as distress, embarrassment and damage to your reputation, even without a direct financial loss. The court assesses the amount according to the circumstances.
If the information is true, is it lawful to share it?
No. Truth does not justify disclosure. The law protects the secret itself; the information does not have to be false. This is one of the key differences between disclosure and defamation.
Can the hospital give my file to the court without my consent?
If a court or competent investigating authority requests the file through the proper legal process, providing it is not a breach. That does not allow the hospital to send your file to the other party in a dispute outside those channels.
How can I prove that a particular employee opened my electronic record?
Electronic health systems usually log every access to a record. Ask the facility in writing to preserve those logs immediately; the court or investigating authority can order their production. For access to your own medical file, see the article on hospitals refusing to release the medical file referred to in the introduction.
Is there a difference between a government and a private hospital?
The duty of confidentiality is the same in both. What differs is the nature of the relationship (usually contractual in the private sector), the defendant the claim is brought against, and certain procedural aspects of suing government bodies.
Does a disciplinary complaint stop me from claiming compensation?
No. The three tracks (disciplinary, criminal and civil) are independent and can run in parallel. A disciplinary finding or a criminal conviction can actually strengthen a compensation claim.
Can someone who reposted the leaked information be held liable?
They may be, depending on what they did, particularly where the repost was abusive or made electronically; that is for the investigating authority and the court to assess. They are not bound by professional secrecy, but they are subject to the general rules on liability and cybercrime.
Can a doctor discuss my case in a lecture or research paper?
Cases may be presented for scientific and teaching purposes if they are fully stripped of anything that identifies the patient, or with the patient's consent. Showing identifying images or details without consent may amount to disclosure.
What if a pharmacist reveals what medication I take?
Pharmacists are bound by confidentiality like other healthcare providers, and revealing a patient's medication can reveal the illness itself. Dispensing errors are a separate matter, covered in Pharmacist Dispensing Errors in Kuwait.
Conclusion
A medical secret belongs neither to the doctor nor to the hospital. It belongs to the patient, who entrusts it to others only as far as treatment requires. Anyone who betrays that trust does not merely breach professional ethics; they expose themselves and their facility to disciplinary and civil liability, and potentially to criminal liability where its elements are met. Kuwaiti law gives the person affected real tools to enforce their rights, provided they use them in an organised way and in good time.
The most important point to remember is that evidence in disclosure cases is fragile and short-lived. Electronic access logs, preserved messages and the testimony of those who received the information are the backbone of any claim. The hospital's liability for its staff is the practical route to meaningful compensation, and the lawful exceptions to confidentiality are narrowly defined and must not be stretched.
For their part, healthcare facilities should treat patient confidentiality as part of service quality rather than an administrative burden: training staff, restricting access to records, monitoring logs, and setting clear procedures for dealing with requests from employers and families. Prevention costs far less than compensation claims and lost patient trust. For an example of how a medical compensation claim is built in a different context, see Dental Malpractice in Kuwait.
Legal Notice
This article is general legal information and is not legal advice on any specific case. How a disclosure is characterised, who the right defendant and competent court are, how limitation periods run, and the prospects of compensation all depend on the specific facts and documents, and legislation and case law may change.
If your medical information has been disclosed, or you are a healthcare facility that wants to review its confidentiality procedures, the team at Yumnaak Law Firm will be glad to look at your situation. You can contact us or book an appointment at our office.
