A range of steps should be taken to ensure no surprises for patients and service users. This is to ensure they can have clear expectations about how and why their confidential information is used, and what choices they have about this. These steps will vary depending on the use. As a minimum, this should include providing accessible, relevant and appropriate information - in some cases, greater engagement will be required.