All employees are subject to the requirements of the Data Protection Act, and must maintain strict confidentiality in respect of patients and staff records.