Sch 10 para 8
(1) No information relating to an NHS foundation trust or other person and obtained by an auditor (or by a person acting on the auditor's behalf) under this Chapter or in the course of an audit under this Chapter may be disclosed except— (a) with the consent of the person to whom the information relates, (b) for the purposes of any functions of an auditor of an NHS foundation trust, (c) for the purposes of the functions of NHS England , (d) for the purposes of the functions of the Comptroller and Auditor General under this Chapter, (e) for the purposes of the functions of the Care Quality Commission , (f) for the purposes of any criminal proceedings. (2) A person who discloses information in contravention of sub-paragraph (1) is guilty of an offence. (3) A person guilty of an offence under sub-paragraph (2) is liable— (a) on summary conviction, to imprisonment for a term not exceeding the general limit in a magistrates’ court or to a fine not exceeding the statutory maximum (or to both), (b) on conviction on indictment, to imprisonment for a term not exceeding two years or to a fine (or to both). (4) In relation to an offence committed before 2 May 2022 the reference in sub-paragraph (3) to a period of imprisonment of 12 months is a reference to a period of imprisonment of 6 months.