1.8 Information Sharing and Confidentiality
SCOPE OF THIS CHAPTER
There are other guidance documents, including a pocket guide, case examples and training materials which can also be accessed via the Department for Education website.
For information sharing with employers where there are allegations against a person who works with children, see Appendix One of the Managing Allegations Against Adults who Work with Children and Young People Procedure
Where there are professional differences in relation to the need to share information, please also refer to the Resolution of Professional Disagreements Procedure.
- Seven Golden Rules for Information Sharing
- Further Information to Inform Decision Making
- Caldicott Guardian
|1.1||Sharing information is vital for early intervention to ensure that children with additional needs receive the services they require. It is also essential to protect children from suffering Significant Harm.|
Practitioners are sometimes uncertain about when they can share information lawfully. It is important therefore that they:
|1.3||Staff in adults' services are aware that problems faced by those with responsibilities as parents are often likely to affect children and other family members. However this information is not always shared and opportunities to put preventative support in place for the children and the family are missed. Where an adult receiving services is a parent or carer, sharing information with colleagues in children's services could ensure that any additional support required for their children can be provided early.|
|1.4||Where a practitioner has concerns that a child may be at risk of Significant Harm, it may be possible to justify sharing information without consent - the circumstances in which this can happen are set out in the following sections of this chapter.|
- Remember that the Data Protection Act is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately
- Be open and honest with the person (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
- Seek advice if you are in any doubt, without disclosing the identity of the person where possible.
- Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgment on the facts of the case. See also 3.4 below regarding the need for consent
- Consider safety and well-being: Base your information sharing decisions on considerations of the safety and wellbeing of the person and others who may be affected by their actions.
- Necessary, proportionate, relevant, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely.
- Keep a record of your decision and the reasons for it - whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.
Practitioners who are asked, or wish, to share information must use their professional judgment to decide whether to share or not and what information it is appropriate to share, unless there is a statutory duty or court order to share.
To inform your decision-making this section sets out further information illustrating the key principles underlying information sharing. This section explains these through seven key questions. They are:
- Is there a legitimate purpose for you or your agency to share the information?
- Does the information enable a person to be identified?
- Is the information confidential?
- If the information is confidential, do you have consent to share?
- If consent is refused, or there are good reasons not to seek consent to share confidential information, is there a sufficient public interest to share information?
- If the decision is to share, are you sharing the right information in the right way?
- Have you properly recorded your information sharing decision?
3.1 Is there a legitimate purpose for you or your agency to share information?
If you are asked to or wish to share information about a child, you need to have a good reason or legitimate purpose to share information. This will be relevant to whether the sharing is lawful in a number of ways.
If you work for a statutory service such as education, social care, health or youth justice, or if you work in the private or voluntary sector and are contracted by one of the statutory agencies to provide services on their behalf, the sharing of information must be within the functions or powers of that statutory body. It is likely that this will be the case if you are sharing the information as a normal part of the job you do for that agency.
Whether you work for a statutory service or within the private or voluntary sector, any sharing of information must comply with the law relating to confidentiality, data protection and human rights. Establishing a legitimate purpose for sharing information is an important part of meeting those requirements. There is more information about the legal framework for sharing information in the document 'Information Sharing: Further Guidance on Legal Issues'.
Different agencies may have different standards for sharing information. You will need to be guided by your agency's policies and procedures, any local information sharing protocols, and - where applicable - by your professional code.
Where you have a statutory duty or a court order to share information
In some situations you are required by law to share information, for example, in the NHS where a person has a specific disease about which environmental health services must be notified. There will also be times when a court will make an order for certain information or case files to be brought before the court.
These situations are relatively unusual and where they apply you will know or be told about them. In such situations you must share the information, even if it is confidential and consent has not been given, unless in the case of a court order your organisation is prepared to challenge it and is likely to receive legal advice. Consent from the individual is not required in these situations and should not be sought because of the potential consequences of refusal. Wherever possible, subject to the considerations set out in 3.2, you should inform the individual concerned that you are sharing the information, why, and with whom.
3.2 Does the information enable a living person to be identified?
In most cases the information covered by this guidance will be about an identified living individual. It may also identify others, such as a child, parent or carer. If the information is anonymised, it can lawfully be shared as long as the purpose is legitimate. If, however, the information does allow a person to be identified, it is personal information and is subject to data protection and other laws. Wherever possible,you must be open about what information you might need to share and why. In some situations it may not be appropriate to inform a person that information is being shared or seek consent to this sharing, for example if it is likely to hamper the prevention or investigation of a serious crime (i.e. a crime causing Significant Harm to a child or serious harm to an adult) or put a child at risk of Significant Harm or an adult at risk of serious harm.
3.3 Is the information confidential?
Confidential information is:
- Personal information of a private or sensitive nature; and
- Information that is not already lawfully in the public domain or readily available from another public source; and
- Information that has been shared in circumstances where the person giving information could reasonably expect that it would not be shared with others.
This is a complex area and you should seek advice if you are unsure.
There are different types of circumstances that are relevant to confidentiality. One is where a formal confidential relationship exists, as between a doctor and patient, or between a social worker, counsellor or lawyer and their client. Here, it is generally accepted that information is provided in confidence. In these circumstances, all information provided by the individual needs to be treated as confidential. This is regardless of whether or not the information is directly relevant to the medical, social care or personal matter that is the main reason for the relationship.
Another circumstance is, for example, an informal conversation, where a pupil may tell a teacher a whole range of information but only asks the teacher to treat some specific information as confidential. In this circumstance, only the information specific to the pupil's request would be considered to be confidential.
There are also circumstances where information not generally regarded as confidential (such as name and address) may be provided in the expectation of confidentiality and therefore should be considered to be confidential information.
Sometimes people may not specifically ask you to keep information confidential when they discuss their own issues or pass on information about others, but may assume that personal information will be treated as confidential. In these situations you should check with the individual whether the information is or is not confidential, the limits around confidentiality and under what circumstances information may or may not be shared with others.
Confidence is only breached where the sharing of confidential information is not authorised by the person who provided it or, if about another person, by the person to whom it relates. If the information was provided on the understanding that it would be shared with a limited range of people or for limited purposes, then sharing in accordance with that understanding will not be a breach of confidence. Similarly, there will not be a breach of confidence where there is explicit consent to the sharing.
Information about an individual or family is confidential to the agency as a whole, and not to individual practitioners. However, individual practitioners do have a responsibility to maintain the confidentiality of the information. They should only share confidential information with other practitioners in the same agency or team for genuine purposes, for example, to seek advice on a particular case or ensure cover for work while on leave. This should be explained clearly to the individual or family at the start of the involvement.
Public bodies that hold information of a private or sensitive nature about individuals for the purposes of carrying out their functions (for example Children's Social Care, Children's Health Services or adult mental health services) may also owe a duty of confidentiality, as people have provided information on the understanding that it will be used for those purposes. In some cases the agency may have a statutory obligation to maintain confidentiality, for example in relation to the case files of Looked After children.
Consent issues can be complex, and lack of clarity about them can sometimes lead practitioners to incorrect assumptions that no information can be shared. This section gives further information to help you understand and address the issues. It covers:
- what constitutes consent;
- whose consent should be sought;
- when consent should not be sought.
- What constitutes consent?
Consent must be 'informed' - this means that the person giving consent needs to understand why information needs to be shared, what will be shared, who will see their information, the purpose to which it will be put and the implications of sharing that information.
Consent can be 'explicit' or 'implicit'. Obtaining explicit consent for information sharing is best practice and ideally should be obtained at the start of the involvement, when working with the individual or family to agree what support is required. It can be expressed either verbally or in writing, although written consent is preferable since that reduces the scope for subsequent dispute. Implicit consent can also be valid in many circumstances. Consent can legitimately be implied if the context is such that information sharing is intrinsic to the activity or service, and especially if that has been explained or agreed at the outset, for example when conducting a Common Assessment.
An example of implicit consent is where a GP refers a patient to a hospital specialist and the patient agrees to the referral; in this situation the GP can assume the patient has given implicit consent to share information with the hospital specialist. However, explicit consent would be required to share information outside the bounds of the original service or setting, for example, for a different type of referral.
In a multi agency service, explicit consent for information sharing is usually obtained at the start of the involvement of the service and covers all the agencies within the service. This would provide implicit consent to share information within the multi agency service but there would be a need to seek additional explicit consent for sharing with practitioners and agencies outside the service.
It is best practice to set out clearly your agency's policy on sharing information when the service is first accessed. The approach to securing consent should be transparent and respect the individual. For example, it is good practice to set out clearly your agency's policy on sharing information to children and families, when they first access the service. Consent must not be secured through coercion, or inferred from a lack of response to a request for consent. If there is a significant change in the use to which the information will be put compared to that which has previously been explained, or a change in the relationship between the agency and the individual, consent should be sought again. Individuals have the right to withdraw consent at any time.
- Whose consent should be sought?
You may also need to consider whose consent should be sought. Where there is a duty of confidence it is owed to a person who has provided the information on the understanding it is to be kept confidential. It is also owed to the person to whom the information relates, if different from the information provider. A child or young person who has the capacity to understand and make their own decisions, may give (or refuse) consent to sharing.
Children aged 12 or over may generally be expected to have sufficient understanding. (This is presumed in law for young people aged 16 or 17.)Younger children may also have sufficient understanding. When assessing a child's understanding you should explain the issues to the child in a way that is suitable for their age, language and likely understanding. Where applicable, you should use their preferred mode of communication.
The following criteria should be considered in assessing whether a particular child on a particular occasion has sufficient understanding to consent, or refuse consent, to sharing of information about them:
- Can the child understand the question being asked of them?
- Does the child have a reasonable understanding of:
- what information might be shared?
- the main reason or reasons for sharing the information?
- the implications of sharing that information, and of not sharing it?
- Can the child:
- appreciate and consider the alternative courses of action open to them?
- weigh up one aspect of the situation against another?
- express a clear personal view on the matter, as distinct from repeating what someone else thinks they should do?
- be reasonably consistent in their view on the matter, or are they constantly changing their mind?
In most cases, where a child cannot consent or where you have judged that they are not competent to consent, a person with Parental Responsibility should be asked to consent on behalf of the child. If a child is judged not to have the capacity to make decisions, their views should still be sought as far as possible.
Where parental consent is required, the consent of one such person is sufficient. In situations where family members are in conflict you will need to consider carefully whose consent should be sought. If the parents are separated, the consent of the parent with whom the child resides would usually be sought. If the child is subject to a Care Order, practitioners should liaise with the relevant local authority about questiu0ns of consent.
If you judge a child to be competent to give consent, then their consent or refusal to consent is the one to consider even if a parent or carer disagrees. Where parental consent is not required, you should encourage the young person to discuss the issue with their paretns. However you should not wit hold the service on condition that they do so.
These issues can raise difficult dilemmas. Wherever appropriate, you should try to work with all involved to reach an agreement or understanding of the information to be shared. You must always act in accordance with your professional code of practice where there is one and consider the safety and wellbeing of the child, even where that means overriding refusal to consent. You should seek advice from you manager or nominated safeguarding adviser if unsure.
- When not to seek consent
There will be some circumstances where you should not seek consent from the individual or their family, or inform them that the information will be shared, for example where to do so would:
- o place a child at increased risk of Significant Harm; or
- place an adult at risk of serious harm; or
- prejudice the prevention, detection or prosecution of a serious crime (i.e. a crime involving Significant Harm to a child or serious harm to an adult); or
- lead to unjustified delay in making enquiries about allegations of Significant Harm to a child or serious harm to an adult.
You should not seek consent where you are required by law to share information through a statutory duty or court order. In these situations, subject to the considerations set out in 4.2, you should inform the individual concerned that you are sharing the information, why, and with whom.
3.5 Is there sufficient public interest to share the information?
Eliciting the views of children and parents is important and represents good practice. However, even if consent is refused, that does not automatically preclude you from sharing confidential information.
A public interest can arise in a wide range of circumstances, for example to protect children from Significant Harm, protect adults from serious harm, promote the welfare of children or prevent crime and disorder. There are also public interests, which in some circumstances may weigh against sharing, including the public interest in maintaining public confidence in the confidentiality of certain services.
The key factors in deciding whether or not to share confidential information are necessity and proportionality, i.e. whether the proposed sharing is likely to make an effective contribution to preventing the risk and whether the public interest in sharing information overrides the interest in maintaining confidentiality.
It is not possible to give guidance to cover every circumstance in which sharing of confidential information without consent will be justified. It is possible however to identify some circumstances in which sharing confidential information without consent will normally be justified in the public interest.
- when there is evidence that the child is suffering or is at risk of suffering Significant Harm; or
- where there is reasonable cause to believe that a child may be suffering or at risk of significant harm; or
- to prevent significant harm arising to children or serious harm to adults, including through the prevention, detection and prosecution of serious crime, i.e. any crime which causes or is likely to cause significant harm to a child or serious harm to an adult.
Where there is a clear risk of Significant Harm to a child, the public interest test will almost certainly be satisfied.
There will be cases where sharing limited information without consent is justified to enable practitioners to reach an informed decision about whether further information should be shared or action should be taken. The information shared should be necessary for the purpose and proportionate.
In deciding whether the public interest justifies disclosing confidential information without consent, you should be able to seek advice from your line manager or a nominated individual whose role is to support you in these circumstances. If you are working in the NHS or a local authority the Caldicott Guardian may be helpful (see Section 4, Caldicott Guardian). Advice can also be sought from professional bodies, for example the General Medical Council or the Royal College of Nursing.
If the concern is about possible abuse or neglect, all organisations working with children will have a named person who undertakes a lead role for safeguarding children, so consulting this person may also be helpful.
If you decide to share confidential information without consent, you should explain to the person that you intend to share the information and why, unless one of the points at 3.4 "when not to seek consent" is met.
3.6 If the decision is to share, are you sharing the proper information appropriately and securely?
If your decision is to share, you should share information in a proper and timely way. This means:
- share only the information which is necessary for the purpose for which it is being shared;
- understand the limits of any consent given, especially if the information has been provided by a third party;
- distinguish clearly between fact and opinion;
- share the information only with the person or people who need to know;
- check that the information is accurate and up-to-date;
- share it in a secure way, for example confirm the identity of the person you are talking to, ensure the intended person will be on hand to receive a fax;
- establish with the recipient whether they intend to pass it on to other people, and ensure they understand the limits of any consent which has been given;
- inform the person to whom the information relates, and, if different, any other person who provided the information, if you have not already and it is safe to do so.
3.7 Have you properly recorded your decision?
You should record your decision and the reasons for it whether or not you decide to share information. If the decision is to share, you should record what information was shared and with whom.
You should work within your agency's arrangements for recording information and within any local information sharing protocols in place.
Caldicott Guardians were introduced in 1997 following concerns about the use of patient identifiable information in health agencies. In particular, the government felt that despite the introduction of the Data Protection Act in 1984, patient information was not sufficiently secure. Caldicott Guardians have responsibility to ensure that patient identifiable information is safeguarded. Given the increasing partnership working between health and social care, the Caldicott Guardian arrangements were also implemented in local authorities with social care responsibilities, several years later.
A Caldicott Guardian is therefore appointed in each NHS or social care organisation and has specific responsibilities to oversee information sharing in the organisation in relation to patient and service user identifiable information - to ensure that it takes place in accordance with the data protection principles as set out in this chapter.
The six Caldicott principles are:
- Justify the purpose of every proposed use or transfer.
- Don't do it unless it is absolutely necessary.
- Use the minimum necessary.
- Access to the information should be on a strict need to know basis.
- Everyone with access to it should be aware of their responsibilities.
- Understand and comply with the law.
he Caldicott Guardian is not there to prevent information sharing between health and social care organisations, but is there to make sure that this is done in a way which safeguards people's rights to privacy and confidentiality, and in accordance with data protection principles.