A. This is the patient's personal data. You must have the patient's explicit consent and must only release information which the Data Subject has explicitly consented to. It might be reasonable to suggest that the insurance company contact the consultant who performed the procedure and with whom they have a contract. Our advice would be to disclose to the patient themselves and allow them to disclose to whomever they wished.