GETTING OUR PRIORITIES RIGHT (GOPR)

Chapter 3

INFORMATION SHARING

This chapter outlines some of the legal and practice considerations that should be taken account of when the need to share information between services arises. It is divided into four main sections, including:

• A summary of relevant legislation - highlighting the broad principles of information sharing.
• Describes the areas that should be addressed in local data sharing policies, and also, the basic considerations for practitioners when deciding whether to share information.
• Highlights confidentiality and consent issues around information sharing.
• Provides a Summary Note for use by practitioners.

For practitioners' ease of reference, the key messages from this Third Chapter are summarised below.

SUMMARY MESSAGES FROM THIRD CHAPTER - INFORMATION SHARING

Legislation

The purpose of legislation surrounding information sharing is not to prevent information sharing, but to ensure that information sharing is necessary, proportionate and appropriate.

The default position here is that information should always be shared where a child is considered to be at risk of harm.

Confidentiality

Practitioners working with children and families should be aware of the Common Law Duty of Confidentiality.

Not all information is confidential. Confidentiality is not an absolute right.

Confidentiality should not be interpreted as absolute secrecy.

There are circumstances in which confidential information can be shared, for example if there are concerns about a child's safety.

Consent

Consent must be informed and unambiguous.

Consent must always be recorded.

• If consent is refused or withdrawn, it may still be necessary to share information - e.g. where a practitioner feels that there are sufficient grounds to believe that a child is at risk.
• The reasons for sharing information in these circumstances should always be recorded.
• Consent should not be sought where this may cause risk to a child - and again - the reasons for this should always be recorded.

INTRODUCTION

130. The previous chapter described the information that services should gather when deciding that children need help. This chapter describes the principles that enable effective information sharing.

131. Information Sharing, Confidentiality and Consent are key elements for services to consider when supporting children and their families. It is vitally important that all practitioners across the public, private and Third Sectors - including children's services and adult services - understand the policy context and also the legislative framework that allows them to securely share and exchange information.

132. This chapter first summarises some of the legal and practice considerations for services here when the need to share information arises.

LEGAL FRAMEWORK

133. Data sharing is governed by a number of different sources of law:

• Administrative law - public bodies must only act within the powers conferred on it by law.
• The Human Rights Act 1998 and the European Convention on Human Rights.
• Common law and statutory obligations of confidence.
• The Data Protection Act 1998.
• European Union law.

134. It is a common misconception that legislation prevents information sharing. It does not. Relevant legislation requires that shared personal data is adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

135. The purpose of legislation is not to prevent information sharing, but to ensure that information is shared when necessary and appropriate and that it is proportionate. The broad principles to follow here are listed below:

• Where information about a child is being shared, consent should normally be sought, unless doing so would increase the risk to a child or others, or prejudice any subsequent investigation.
• Where consent has been given, and where there is a need-to-know, relevant information may be shared.
• Where consent has not been given - but there is still a need-to-know - legislation assists the practitioner to decide whether information sharing should take place.
• Legislation supports the commonsense approach to making this decision. As a general rule, if information is to be shared by practitioners to prevent or detect crime or where there is a risk of significant harm or serious health risk to the service user and the information to be shared is relevant and proportionate, then the information may be shared.
• If a child or young person is considered to be at risk of harm, relevant information must always be shared.
• The National Guidance for Child Protection in Scotland 2010 describes in more detail, the legislative framework for child protection in Scotland.

LOCAL POLICIES AND DATA SHARING PROCEDURES

136. Local Data Sharing Agreements (DSAs, as described in the Information Commissioner's Office Data Sharing Code of Practice) should usually be in place and describe agreed local processes for sharing information between services.

137. Local Data Sharing Procedures should also be in place. These explain what to do for the ad-hoc sharing of any information, or, when a DSA is not in place. An overarching local policy should also be developed which describes the high level pre-agreement by all local agencies and services to share data.

138. The scope and extent to which different Agencies and Services develop such agreements and procedures will vary. This will depend on factors such as geographic location and the necessary links to deliver effective business or practice. Also, these links may only develop over time - in light of experience based on the development of best practice.

139. Where local DSA and Data Sharing Procedures are in place, these should be available to all practitioners in concise accessible format. These should take into account the wide range of service partners responsible for their effective implementation.

140. Similar information should be in place for service users and different versions will need to be available to accommodate the needs of different service users.

141. Where available, DSAs will be the main reference used by practitioners for data sharing. In those circumstances where a DSA is not in place, there are four basic questions which each practitioner should consider when deciding whether to share information. These are:

• When to share - in what circumstances is it appropriate to share information? Does consent need to be sought?
• Who to share with - who can information be shared with?
• How to share - what means should be used to send information securely to another service or agency?
• What to share - what information is it appropriate to share?

142. If it seems there is a need to share information, the following questions need to be asked:

• Is consent required? Decide whether sharing will prevent harm, will assist in the prevention or detection of crime or meets any of the other exemptions described in the Data Protection Act. If information is shared for these particular reasons, it is not necessary to seek consent
• If consent is sought. If practitioners consider that there is a need to share information - but not for the reasons listed above - then consent should be sought. If consent is not given, information must not be shared.
• The need-to-know. If information is shared - whether with or without consent - it must only be shared with people who have a need-to-know. This means they must have a public agency function (including commissioned services from the third sector) and need the shared information in order to do their job effectively.
• Relevance. Only information relevant to the purpose of the instance of data sharing should be shared.
• Proportionality. The least amount of information should be shared to meet the purpose of the instance of sharing.
• Method. A secure method for sharing information must be used.
• Records. Practitioners must keep a record of what is shared, when, who with, how it is shared and the purpose.

CONFIDENTIALITY

143. Practitioners working in the public, private and third sectors should be aware of the Common Law Duty of Confidentiality.

144. Not all information is confidential. Confidentiality is not an absolute right. Information that is confidential is either considered to be of some sensitivity, is neither lawfully in the public domain nor readily available from another public source, and is shared in a relationship where the person giving the information understood that it would not be shared with others.

145. The duty of confidentiality requires that unless there is a statutory requirement to use information (that had otherwise been provided in confidence) - or a court orders the information to be disclosed - it should only be used for those purposes that the subject has been informed about and has consented to.

146. This Duty is not absolute but should only be overridden if the holder of the information can justify disclosure as being in the public interest.

147. Practitioners should consider whether the public interest in disclosure outweighs the duty of confidentiality. Any sharing should be proportionate, to the appropriate person, and go no further than the minimum necessary to achieve the public interest objective of protecting the child.

CONSENT

148. Two key principles of consent apply to information sharing between practitioners, and/or services and service users. These are that consent must be:

• Informed - The individual must understand what is being asked of them and must give their permission freely. Information should also be provided about the possible consequences of withholding information.
• Explicit - The individual clearly and explicitly gives their consent for their information to be shared.

149. In both cases, best practice would suggest that practitioners should make use of a Consent Form.

150. Implied Consent is not sufficient for information sharing. Implied Consent simply means that the individual has not explicitly said they do not agree to their information being shared, so it is inferred that they do agree. Where there are concerns that seeking consent may place a child at risk, consent should not be sought.

151. Further information on practice considerations surrounding consent can be found in Appendix 1.

INFORMATION SHARING PRACTICE SUMMARY NOTE FOR USE BY PRACTITIONERS

152. The diagram below summarises the key information sharing considerations for practitioners. This includes what information to share, who to share with, and how the information should be shared.

153. When to share - in general, information can and should be shared when there are ANY concerns about a child's well-being. It is good practice to inform the relevant parties that information is going to be shared and why, but this is different from seeking consent. Legally, if there are concerns about a child's well-being, relevant information can be shared without consent. Practitioners should also see related footnote number 20.

PRACTICE EXAMPLES

An Alcohol/Drugs Worker informing Social Work and/or Health Visitor when parental drug misuse increases, or attendance at clinic/pharmacy becomes erratic.

A School/Health Visitor speaking to GP/Addictions/SW services when there are concerns about the presentation of a child.

154. What to share? - Any information that could have an impact on a child's well-being. Practitioners should consider the information and ensure information shared is relevant and proportionate.

PRACTICE EXAMPLES

Relevant information may include, for example, information re: parental mental health and any known examples of how this impacts on parenting capacity. This does not mean that the adult's full medical history needs to be divulged, but only those aspects relevant to the adult's capacity to parent.

Parental drug use (including methods of funding of drug use) - this may include any safety concerns in and around the home, anything that could negatively affect the parenting ability or well-being of the child.

155. Who to share with? - this will depend on who is requesting the information, how directly involved they are in the child's care, and what impact their knowledge of the information will have on the situation. If in doubt the named person or lead professional would be a central person to share information with who could then take things forward appropriately.

PRACTICE EXAMPLES

Common types of people that information should be shared with are: Social Workers, Health Visitors, GPs, Addiction Services, School Teachers

156. How to share? - sharing information verbally initially is the most direct and effective route, but this should be documented and followed up by written communication according to local practice.