An 80-year-old man is admitted to hospital with what turns out to be tuberculosis.

Tuberculosis is a communicable disease, so there can be a justified “duty to protect” others in the hospital through infection-control measures and public health notification. However, MCCQE ethics objectives emphasize that confidentiality remains the default obligation even when disclosure is permitted or required. In such cases, disclosure must follow the minimum necessary principle: only the information essential to reduce risk should be shared, and only with those who need it to perform their role (e.g., direct care team, infection prevention and control, occupational health, and public health). Informing “all staff at the hospital” and including the patient’s identity generally exceeds what is required and constitutes an avoidable breach of privacy.

Consent is not always required when disclosure is mandated by law (reportable diseases) or necessary to prevent serious harm, so option B is too absolute. Option A wrongly implies loss of privacy rights. Option D is incorrect because limited disclosure may be ethically and legally permitted to protect others. Option E is false; clinicians and institutions can be accountable for unjustified or excessive disclosure.