Skip to main content
Caption: floating buttons
 
spacer_valid
View East Riding Safeguarding Children Partnership View East Riding Safeguarding Children Partnership
spacer_valid 2
View Working Together View Working Together
Caption: main heading
 

2.4.2 Information Sharing, Confidentiality and Security of Information


Contents

  1. Key Points
  2. Seven Golden Rules of Information Sharing
  3. Frequently Asked Questions about Information Sharing
  4. Procedure for Sharing Information


1. Key Points

  1. Personal information about children and their families, which is held in case records, must be treated as confidential. However, appropriate sharing of such information between agencies is vital for early intervention to ensure that children with additional needs receive the services they require. It is also essential to protect children from Significant Harm;
  2. Practitioners are sometimes uncertain about when they can share information lawfully. It is important therefore that they:
    • Understand and apply good practice in sharing information at an early stage as part of preventative work;
    • Understand what information is and is not confidential, and the need in some circumstances to make a judgement about whether confidential information can be shared, in the public interest, without consent;
    • Understand what to do when they have reasonable cause to believe that a child may be suffering or likely to suffer, Significant Harm and are clear of the circumstances when information can be shared where they judge that a child is suffering or likely to suffer Significant Harm;
    • Understand what to do when they have reasonable cause to believe that an adult may be suffering, or may be at risk of suffering, serious harm and are clear of the circumstances when information can be shared where they judge that an adult is at risk of serious harm.
  3. Elected members do not have a right of access to an individual's case file;
  4. Records must be kept in locked cabinets and drawers.


2. Seven Golden Rules of Information Sharing

Taken from Information sharing - Advice for practitioners providing safeguarding services to children, young people, parents and carers (Department for Education).

  1. Remember that the Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR) and human rights laws are not barriers to justified information sharing but provide a framework to ensure that personal information about living individuals is shared appropriately;
  2. Be open and honest with the individual (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so;
  3. Seek advice from other practitioners if you are in any doubt about sharing the information concerned, without disclosing the identity of the individual where possible;
  4. Share with informed consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, there is good reason to do so, such as where safety may be at risk. You will need to base your judgment on the facts of the case. When you are sharing or requesting personal information from someone, be certain of the basis upon which you are doing so. Where you have consent, be mindful that an individual might not expect information to be shared;
  5. Consider safety and well-being: Base your information sharing decisions on considerations of the safety and wellbeing of the individual and others who may be affected by their actions;
  6. Necessary, proportionate, relevant, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely (Practitioners must always follow their organisation’s policy on security for handling personal information);
  7. Keep a record of your decision and the reasons for it - whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.


3. Frequently Asked Questions about Information Sharing

Practitioners who are asked, or wish, to share information must use their professional judgment to decide whether to share or not and what information it is appropriate to share, unless there is a statutory duty or court order to share.

To inform your decision-making this section sets out further information illustrating the key principles underlying information sharing. This section explains these through seven key questions. They are:

  1. Is there a legitimate purpose for your agency to share the information?
  2. Does the information enable a person to be identified?
  3. Is the information confidential?
  4. If the information is confidential, do you have consent to share?
  5. If consent is refused, or there are good reasons not to seek consent to share confidential information, is there a sufficient public interest to share information?
  6. If the decision is to share, are you sharing the right information in the right way?
  7. Have you properly recorded your information sharing decision?

Is there a legitimate purpose for your agency to share information?

If you are asked to or wish to share information about a child, you need to have a good reason or legitimate purpose to share information. This will be relevant to whether the sharing is lawful in a number of ways.

Any sharing of information must comply with the law relating to confidentiality, data protection and human rights. Establishing a legitimate purpose for sharing information is an important part of meeting those requirements.

Where you have a statutory duty or a court order to share information

In some situations you are required by law to share information, for example, where a court orders certain information or case files to be brought before the court.

In such situations you must share the information, even if it is confidential and consent has not been given, unless in the case of a court order your organisation is prepared to challenge it and is likely to receive legal advice. Consent from the individual is not required in these situations and should not be sought because of the potential consequences of refusal. Wherever possible, subject to the considerations set out below, you should inform the individual concerned that you are sharing the information, why, and with whom.

Does the information enable a living person to be identified?

In most cases the information covered by this guidance will be about an identified living individual. It may also identify others, such as a parent or carer. If the information is anonymised, it can lawfully be shared as long as the purpose is legitimate. If, however, the information does allow a person to be identified, it is personal information and is subject to data protection and other laws. Wherever possible, you must be open about what information you might need to share and why. In some situations it may not be appropriate to inform a person that information is being shared or seek consent to this sharing, for example if it is likely to hamper the prevention or investigation of a serious crime (i.e. a crime causing Significant Harm to a child or serious harm to an adult) or put a child at risk of Significant Harm or an adult at risk of serious harm.

Is the information confidential?

Confidential information is:

  • Personal information of a private or sensitive nature; and
  • Information that is not already lawfully in the public domain or readily available from another public source; and
  • Information that has been shared in circumstances where the person giving information could reasonably expect that it would not be shared with others.

This is a complex area and you should seek advice if you are unsure.

There are different types of circumstances that are relevant to confidentiality. One is where a formal confidential relationship exists, as between a doctor and patient, or between a social worker, counsellor or lawyer and their client. Here, it is generally accepted that information is provided in confidence. In these circumstances, all information provided by the individual needs to be treated as confidential. This is regardless of whether or not the information is directly relevant to the medical, social care or personal matter that is the main reason for the relationship.

Another circumstance is, for example, an informal conversation, where a pupil may tell a teacher a whole range of information but only asks the teacher to treat some specific information as confidential. In this circumstance, only the information specific to the pupil's request would be considered to be confidential.

There are also circumstances where information not generally regarded as confidential (such as name and address) may be provided in the expectation of confidentiality and therefore should be considered to be confidential information.

Sometimes people may not specifically ask you to keep information confidential when they discuss their own issues or pass on information about others, but may assume that personal information will be treated as confidential. In these situations you should check with the individual whether the information is or is not confidential, the limits around confidentiality and under what circumstances information may or may not be shared with others.

Confidence is only breached where the sharing of confidential information is not authorised by the person who provided it or, if about another person, by the person to whom it relates. If the information was provided on the understanding that it would be shared with a limited range of people or for limited purposes, then sharing in accordance with that understanding will not be a breach of confidence. Similarly, there will not be a breach of confidence where there is explicit consent to the sharing.

Information about an individual or family is confidential to the agency as a whole, and not to individual practitioners. However, individual practitioners do have a responsibility to maintain the confidentiality of the information. They should only share confidential information with other practitioners in the same agency or team for genuine purposes, for example, to seek advice on a particular case or ensure cover for work while on leave. This should be explained clearly to the individual or family at the start of the involvement.

Do you have consent to share?

Consent issues can be complex, and lack of clarity about them can sometimes lead practitioners to incorrect assumptions that no information can be shared. This section gives further information to help you understand and address the issues. It covers:

  1. What constitutes consent;
  2. Whose consent should be sought;
  3. When consent should not be sought.

  • What constitutes consent?

    Consent must be 'informed' - this means that the person giving consent needs to understand why information needs to be shared, what will be shared, who will see their information, the purpose to which it will be put and the implications of sharing that information.

    Consent can be 'explicit' or 'implicit'. Obtaining explicit consent for information sharing is best practice and ideally should be obtained at the start of the involvement, when working with the individual or family to agree what support is required. It can be expressed either verbally or in writing, although written consent is preferable since that reduces the scope for subsequent dispute. Implicit consent can also be valid in many circumstances. Consent can legitimately be implied if the context is such that information sharing is intrinsic to the activity or service, and especially if that has been explained or agreed at the outset, for example when conducting an Early Help Assessment.

    An example of implicit consent is where a GP refers a patient to a hospital specialist and the patient agrees to the referral; in this situation the GP can assume the patient has given implicit consent to share information with the hospital specialist. However, explicit consent would be required to share information outside the bounds of the original service or setting, for example, for a different type of referral.

In a multi agency service, explicit consent for information sharing is usually obtained at the start of the involvement of the service and covers all the agencies within the service. This would provide implicit consent to share information within the multi agency service but there would be a need to seek additional explicit consent for sharing with practitioners and agencies outside the service.

It is best practice to set out clearly your agency's policy on sharing information when the service is first accessed. The approach to securing consent should be transparent and respect the individual. For example, it is good practice to set out clearly your agency's policy on sharing information to children and families, when they first access the service. Consent must not be secured through coercion, or inferred from a lack of response to a request for consent. If there is a significant change in the use to which the information will be put compared to that which has previously been explained, or a change in the relationship between the agency and the individual, consent should be sought again. Individuals have the right to withdraw consent at any time.

  • Whose consent should be sought?

    You may also need to consider whose consent should be sought. Where there is a duty of confidence it is owed to a person who has provided the information on the understanding it is to be kept confidential. It is also owed to the person to whom the information relates, if different from the information provider. A child or young person with the capacity to understand and make their own decisions may give (or refuse) consent to sharing.

    Children aged 12 or over may generally be expected to have sufficient understanding. (This is presumed in law for young people aged 16 or 17.) Younger children may also have sufficient understanding. When assessing a child's understanding you should explain the issues to the child in a way that is suitable for their age, language and likely understanding. Where applicable, you should use their preferred mode of communication.

    The following criteria should be considered in assessing whether a particular child on a particular occasion has sufficient understanding to consent, or refuse consent, to sharing of information about them:
    • Can the child understand the question being asked of them?
    • Does the child have a reasonable understanding of:
      • What information might be shared?
      • The main reason or reasons for sharing the information?
      • The implications of sharing that information, and of not sharing it?
    • Can the child:
      • Appreciate and consider the alternative courses of action open to them?
      • Weigh up one aspect of the situation against another?
      • Express a clear personal view on the matter, as distinct from repeating what someone else thinks they should do?
      • Be reasonably consistent in their view on the matter, or are they constantly changing their mind?

In most cases, where a child cannot consent or where you have judged that they are not competent to consent, a person with Parental Responsibility should be asked to consent on behalf of the child. If a child is judged not to have the capacity to make decisions, their views should still be sought as far as possible.

Where parental consent is required, the consent of one such person is sufficient. In situations where family members are in conflict you will need to consider carefully whose consent should be sought. If the parents are separated, the consent of the parent with whom the child resides would usually be sought. If the child is subject to a Care Order, practitioners should liaise with the relevant local authority about questiu0ns of consent.

If you judge a child to be competent to give consent, then their consent or refusal to consent is the one to consider even if a parent or carer disagrees. Where parental consent is not required, you should encourage the young person to discuss the issue with their parents. However you should not withhold the service on condition that they do so.

These issues can raise difficult dilemmas. Wherever appropriate, you should try to work with all involved to reach an agreement or understanding of the information to be shared. You must always act in accordance with your professional code of practice where there is one and consider the safety and well being of the child, even where that means overriding refusal to consent. You should seek advice from your manager if unsure.

  • When not to seek consent

    There will be some circumstances where you should not seek consent from the individual or their family, or inform them that the information will be shared, for example where to do so would:
    • Place a child at increased risk of Significant Harm; or
    • Place an adult at risk of serious harm; or
    • Prejudice the prevention, detection or prosecution of a serious crime (i.e. a crime involving Significant Harm to a child or serious harm to an adult); or
    • Lead to unjustified delay in making enquiries about allegations of Significant Harm to a child or serious harm to an adult.

You should not seek consent where you are required by law to share information through a statutory duty or court order. In these situations, subject to the considerations set out above, you should inform the individual concerned that you are sharing the information, why, and with whom.

Is there sufficient public interest to share the information?

Eliciting the views of children and parents is important and represents good practice. However, even if consent is refused, that does not automatically preclude you from sharing confidential information.

A public interest can arise in a wide range of circumstances, for example to protect children from Significant Harm, protect adults from serious harm, promote the welfare of children or prevent crime and disorder. There are also public interests, which in some circumstances may weigh against sharing, including the public interest in maintaining public confidence in the confidentiality of certain services.

The key factors in deciding whether or not to share confidential information are necessity and proportionality, i.e. whether the proposed sharing is likely to make an effective contribution to preventing the risk and whether the public interest in sharing information overrides the interest in maintaining confidentiality.

It is not possible to give guidance to cover every circumstance in which sharing of confidential information without consent will be justified. It is possible however to identify some circumstances in which sharing confidential information without consent will normally be justified in the public interest.

These are:

  • When there is evidence that the child is suffering or likely to suffer Significant Harm; or
  • Where there is reasonable cause to believe that a child may be suffering or likely to suffer Significant Harm; or
  • To prevent Significant Harm arising to children or serious harm to adults, including through the prevention, detection and prosecution of serious crime, i.e. any crime which causes or is likely to cause Significant Harm to a child or serious harm to an adult.

Where there is a clear risk of Significant Harm to a child, the public interest test will almost certainly be satisfied.

There will be cases where sharing limited information without consent is justified to enable practitioners to reach an informed decision about whether further information should be shared or action should be taken. The information shared should be necessary for the purpose and proportionate.

In deciding whether the public interest justifies disclosing confidential information without consent, you should be able to seek advice from your line manager whose role is to support you in these circumstances.

If you decide to share confidential information without consent, you should explain to the person that you intend to share the information and why, unless one of the points set out in “when not to seek consent" above is met.

If the decision is to share, are you sharing the proper information appropriately and securely?

If your decision is to share, you should share information in a proper and timely way. This means:

  • Share only the information which is necessary for the purpose for which it is being shared;
  • Understand the limits of any consent given, especially if the information has been provided by a third party;
  • Distinguish clearly between fact and opinion;
  • Share the information only with the person or people who need to know;
  • Check that the information is accurate and up-to-date;
  • Share it in a secure way, for example confirm the identity of the person you are talking to, ensure the intended person will be on hand to receive a fax;
  • Establish with the recipient whether they intend to pass it on to other people, and ensure they understand the limits of any consent which has been given;
  • Inform the person to whom the information relates, and, if different, any other person who provided the information, if you have not already and it is safe to do so.

Have you properly recorded your decision?

You should record your decision and the reasons for it whether or not you decide to share information. If the decision is to share, you should record what information was shared and with whom.


4. Procedure for Sharing Information

Any disclosure of information must be considered with reference to the above key points.

All requests for the disclosure of information must be recorded with details of the disclosure (if appropriate), to whom it was made, when, how and why.

If there is a concern by the designated worker about confidentiality and the disclosure of information a discussion must take place with the Line Manager responsible for the designated work.

End