5.2 Information Sharing and Confidentiality (TSSP)

Audio & Quick Read Summary

1. Introduction

Staff often work within a multi-agency arena and therefore need to be confident when they can share information with other professionals. Good information sharing is essential for providing safe and effective care. Sharing the right information, at the right time with the right people, is fundamental to good safeguarding practice.

Sharing information between organisations as part of day to day safeguarding practice is covered in the common law duty of confidentiality in the following legislation:

• the Data Protection Act 2018;
• the UK General Data Protection Regulation (UK GDPR) (see Data Protection chapter);
• the Human Rights Act 1998.

As a general principal people must assume it is their responsibility to raise a safeguarding concern if they believe an adult at risk is suffering or likely to suffer abuse or neglect, and / or are a risk to themselves or another, rather than assume someone else will do so. They should share the information with the local authority and / or the police if they believe or suspect that a crime has been committed or that the individual is immediately at risk.

There are certain circumstances when sharing information is not appropriate and doing so can cause detriment to adults and the service. However, not sharing information can have serious consequences. Whether information is shared with or without the adult’s consent, the information sharing process should abide by the principles of the Data Protection Act.

Where the person lacks the mental capacity to give informed consent, staff should always consider the requirements of the Mental Capacity Act 2005 (see Mental Capacity) and whether sharing the information would be in the person’s best interests if the person is not able to provide informed consent themselves.

All staff must exercise their professional judgement on an individual case basis, and if necessary seek help from their line manager and/or seek legal advice before making a decision. All decisions and outcomes need to be recorded appropriately.

Staff must apply a consistent and responsible approach to information sharing and should ensure that they are familiar with the information sharing procedures and supporting government guidance in relation to information sharing.

2. Duty to Cooperate

Local authorities and partner organisations should cooperate in order to deliver effective safeguarding activity, both at a strategic level and in individual cases, where they may need to ask one another to take specific action in that case.

The Care Act 2014 describes a general duty to cooperate between the local authority and other organisations providing care and support. This includes a duty on the local authority itself to ensure cooperation between its adult care and support, housing, public health and children’s services. The Care Act also provides a new ability to request cooperation from a relevant partner or another local authority, in relation to an individual case. The local authority or relevant partner must cooperate as requested, unless doing so would be incompatible with their own duties or have an adverse effect on the exercise of their functions.

If an organisation is refusing to share information, the organisation conducting an enquiry can escalate to the SAP to consider using Care Act powers, which puts an obligation on organisations to comply with a request for information in order that the SAP can perform its duties.

The Act sets out five aims of cooperation between partners which are relevant to care and support, although it should be noted that the purposes of co-operation are not limited to these matters. They are:

• promoting the wellbeing of adults needing care and support and of carers;
• improving the quality of care and support for adults and support for carers (including the outcomes from such provision);
• smoothing the transition from children’s to adults’ services;
• protecting adults with care and support needs who are currently experiencing or at risk of abuse or neglect; and
• identifying lessons to be learned from cases where adults with needs for care and support have experienced serious abuse or neglect.

Organisations that refuse to comply with requests for cooperation or information should provide written reasons for the refusal.

3. Principles of Sharing Information

When sharing information with other practitioners and organisations, applying the following principles will ensure that all information which is shared is:

• Necessary and proportionate: When taking decisions about what information to share, you should consider how much information you need to release. Data protection legislation requires you to consider the impact of disclosing information on the information subject and any third parties. Any information shared must be proportionate to the need and level of risk.
• Relevant: Only information that is relevant to the purposes should be shared with those who need it. This allows others to do their job effectively and make sound decisions.
• Adequate: Information should be adequate for its purpose. Information should be of the right quality to ensure that it can be understood and relied upon.
• Accurate: Information should be accurate and up to date and should clearly distinguish between fact and opinion. If the information is historical then this should be explained.
• Timely: Information should be shared in a timely fashion to reduce the risk of harm. Timeliness is key in emergency situations and it may not be appropriate to seek consent for information sharing if it could cause delays and therefore harm to an adult or child. Practitioners should ensure that sufficient information is shared, as well as consider the urgency with which to share it.
• Secure: Information should be shared in an appropriate, secure way. Practitioners must always follow their organisation’s policy on security for handling personal information.
• Record: Information sharing decisions should be recorded whether or not the decision is taken to share. If the decision is to share, reasons should be cited including what information has been shared and with whom, in line with organisational procedures. If the decision is not to share, it is good practice to record the reasons for this decision and discuss them with the requester. In line with each organisation’s own retention policy, the information should not be kept any longer than is necessary. In some circumstances this may be indefinitely, but if this is the case there should be a review process (see also Case Recording chapter).

4. Seven Golden Rules for Sharing Information

1. Remember that data protection legislation is not a barrier to justified information sharing, but provides a framework to ensure that personal information about living individuals is shared appropriately.
2. Be open and honest with the individual (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
3. Seek advice from other practitioners or your line manager if you are in any doubt about sharing the information concerned; you should do this without disclosing the identity of the individual where possible.
4. Where possible share information with consent and respect the wishes of those who do not consent to having their information shared. Under the UK GDPR and Data Protection Act, you may still share information without consent if, in your judgement, there is a lawful basis to do so, such as where safety may be at risk. You will need to base your judgement on the facts of the case. When you are sharing or requesting personal information from someone, be certain of the basis upon which you are doing so. Where you have consent, be mindful that an individual might not expect information to be shared.
5. Consider safety and wellbeing: Base your information sharing decisions on considerations of the safety and well-being of the individual and others who may be affected by their actions.
6. Necessary, proportionate, relevant, adequate, accurate, timely and secure: Ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those individuals who need to have it, is accurate and up-to-date, is shared in a timely fashion, and is shared securely.
7. Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.

5. When and How to Share Information

When asked to share information, you should consider the following questions to help you decide if and when to share. If the decision is taken to share, you should consider how best to effectively and securely share the information.

5.1 When

Q. 1 Is there a clear and legitimate purpose for sharing information? This includes taking action in relation to safeguarding children and adults.

• Yes – see Q.2
• No – do not share

Q.2 Does the information enable an individual to be identified?

• Yes – see Q.3
• No – you can share but should consider how

Q.3 Is the information confidential?

• Yes – see Q.4
• No – you can share but should consider how

Q.4 Do you have consent?

• Yes – you can share but should consider how
• No – see Q.5

Q.5 Is there another reason to share information such as to fulfil a public function or to protect the vital interests of the information subject? See also Section 7, Sharing Information with the Safeguarding Adults Board / Partnership.

• Yes – you can share but should consider how
• No – do not share

5.2 How

• Identify how much information to share;
• Distinguish fact from opinion;
• Ensure that you are giving the right information to the right individual;
• Ensure that you are sharing the information securely;

Inform the individual that the information has been shared if they were not aware of this, as long as this would not create or increase risk of harm

All information sharing decisions and reasons must be recorded in line with your organisation or local procedures. If at any stage you are unsure about how or when to share information, you should seek advice and ensure that the outcome of the discussion is recorded.

6. Confidentiality

A duty of confidence arises when sensitive personal information is obtained and/or recorded in circumstances where it is reasonable for the subject of the information to expect that the information will be held in confidence. Adults at risk provide sensitive information and have a right to expect that the information that they directly provide and information obtained from others will be treated respectfully and that their privacy will be maintained. The challenges of working within the boundaries of confidentiality should not impede taking appropriate action. Whenever possible, informed consent to the sharing of information should be obtained. However:

• emergency or life threatening situations may warrant the sharing of relevant information with the relevant emergency services without consent;
• the law does not prevent the sharing of sensitive, personal information within organisations. If the information is confidential, but there is a safeguarding concern, sharing it may be justified;
• the law does not prevent the sharing of sensitive, personal information between organisations where the public interest served outweighs the public interest served by protecting confidentiality, for example, where a serious crime may be prevented.

The Care and Support Statutory Guidance states that agencies should draw up a common agreement relating to confidentiality and setting out the principles governing the sharing of information, based on the welfare of the adult or of other potentially affected adults.

Any agreement should be consistent with the principles set out in Section 3, Principles of Sharing Information ensuring that:

• information will only be shared on a ‘need to know’ basis when it is in the interests of the adult;
• confidentiality must not be confused with secrecy;
• informed consent should be obtained but, if this is not possible and other adults are at risk 
of abuse or neglect, it may be necessary to override the requirement; and
• it is inappropriate for agencies to give assurances of absolute confidentiality in cases where there are concerns about abuse, particularly in those situations when other adults may be at risk.

Where an adult has refused to consent to information being disclosed for these purposes, practitioners must consider whether there is an overriding public interest that would justify information sharing (for example because there is a risk that others are at risk of serious harm) and wherever possible, the appropriate Caldicott Guardian should be involved. Confidentiality: NHS Code of Practice sets out guidance on public interest disclosure.

Decisions about who needs to know and what needs to be known should be taken on a case by case basis, within agency policies and the constraints of the legal framework.

The duty to share information for individual care is as important as the duty to protect patient confidentiality. Health and social care practitioners should feel about to share confidential information in the best interests of patients / adults, within the framework provided by the Caldicott Principles. Principles of confidentiality designed to safeguard and promote the interests of an adult should not be confused with those designed to protect the management interests of an organisation. These have a legitimate role but must never be allowed to conflict with the welfare of an adult. If it appears to an employee or person in a similar role that such confidentiality rules may be operating against the interests of the adult then a duty arises to make full disclosure in the public interest (see Whistleblowing chapter).

In certain circumstances, it will be necessary to exchange or disclose personal information, which will need to be in accordance with the legislation on confidentiality and data protection legislation where this applies.

7. Sharing Information with the Safeguarding Adults Board / Partnership

See also Chapter 14, Care and Support Statutory Guidance, Department of Health and Social Care

In order to carry out its functions, the SAB/P will need access to information that a wide number of people or other organisations may hold. Some of these may be SAB/P members, such as the NHS and the police. Others will not be, such as private health and care providers or housing providers / housing support providers or education providers.

In the past, there have been instances where the withholding of information has prevented organisations being fully able to understand what ‘went wrong’ and so has hindered them identifying, to the best of their ability, the lessons to be applied to prevent or reduce the risks of such cases reoccurring. If someone knows or suspects that abuse or neglect is happening they must act upon that knowledge, not wait to be asked for information.

A SAB/P may request a member of staff to supply information to it or to another person. The person who receives the request must provide the information provided to the SAB if:

• the request is made in order to enable or assist the SAB/P to do its job;
• the request is made of a person who is likely to have relevant information and then either:
  • the information requested relates to the person to whom the request is made and their functions or activities or;
  • the information requested has already been supplied to another person subject to a SAB/P request for information.

8. Information for People who use Care and Support, Carers and the General Public

Information in a range of media should be produced in different, user friendly formats for people with care and support needs and their carers. These should explain clearly what abuse is and also how to express concern and make a complaint. Adults with care and support needs and carers should be informed that their concern or complaint will be taken seriously, be dealt with independently and that they will be kept involved in the process to the degree that they wish to be. They should be reassured that they will receive help and support in taking action on their own behalf. They should also be advised that they can nominate an advocate or representative to speak and act on their behalf if they wish (see Independent Advocacy chapter).

Where appropriate local authorities should provide information on access to appropriate services such as how to obtain independent legal advice or counselling services for example (see Information and Advice chapter). The involvement of adults at risk in developing such communication is sensible.

A number of local safeguarding adult boards / premierships (SABs / SAPs) or multi-agency safeguarding hubs (MASHs) have developed helpful and accessible information aimed at adults in order that they can protect themselves from abuse.