substantive rule in bioethics saying that the information a patient reveals to a health care provider is private and has limits on how and when it can be disclosed to a third party; usually the provider must obtain permission from the patient to make such a disclosure.