Getting our priorities right: good practice guidance

Chapter 3: Information Sharing

64. This chapter outlines some of the legal and practice considerations that should be taken account of when the need to share information between services arises. It is divided into 4 main sections, including:

• a summary of relevant legislation, highlighting the broad principles of information sharing;
• a description of the areas that should be addressed in local information sharing policies and the basic considerations for practitioners when deciding whether to share information;
• confidentiality and consent issues around information sharing; and
• a summary note for use by practitioners.

Legal framework

65. Information sharing is governed by a number of different sources of law:

• administrative law - public bodies must only act within the powers conferred on it by law;
• the Human Rights Act 1998 and the European Convention on Human Rights;
• common law and statutory obligations of confidence;
• the Data Protection Act 1998; and
• European Union law.

66. It is a common misconception that legislation prevents information sharing. It does not. Relevant legislation requires that shared personal information is adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed.

67. The purpose of legislation is not to prevent information sharing, but to ensure that information is shared when necessary and appropriate and that it is proportionate. The broad principles to follow here are listed below:

• where information about a child is being shared, consent should normally be sought, unless doing so would increase the risk to a child or others, or prejudice any subsequent investigation;
• where consent has been given, and where there is a need-to-know, relevant information may be shared; and
• where consent has not been given - but there is still a need-to-know - legislation assists the practitioner to decide whether information sharing should take place.

68. Advice received from the Information Commissioner's Office indicates that where a risk to a child's wellbeing is such, if not addressed, it may lead to harm, then it is likely that information may need to be shared before the situation reaches crisis. In such situations whilst consent is not a requirement it is important that where possible the child or young person and/or their parents are informed of the decision.

69. Legislation supports the common sense approach to making this decision. As a general rule, if information is to be shared by practitioners to prevent or detect crime, to allow the consideration as to whether compulsory measures of supervision might be necessary or where there is a risk of significant harm or serious health risk to the service user and the information to be shared is relevant and proportionate, then the information may be shared. If a child or young person is considered to be at risk of harm, relevant information must always be shared. The National Guidance for Child Protection in Scotland 2010 describes in more detail the legislative framework for child protection in Scotland.

Local policies and data sharing procedures

70. Local Data Sharing Agreements ( DSAs, as described in the Information Commissioner's Office Data Sharing Code of Practice) should usually be in place and describe agreed local processes for sharing information between services.

71. Local Data Sharing Procedures should also be in place. These explain what to do for the ad-hoc sharing of any information, or, when a DSA is not in place. An overarching local policy should also be developed which describes the high level pre-agreement by all local agencies and services to share data.

72. Where local DSA and Data Sharing Procedures are in place, these should be available to all practitioners in concise accessible format. These should take into account the wide range of service partners responsible for their effective implementation. Similar information should be in place for service users and different versions will need to be available to accommodate the needs of different service users.

73. Where available, DSAs will be the main reference used by practitioners for data sharing. In those circumstances where a DSA is not in place, there are 4 basic questions which each practitioner should consider when deciding whether to share information. These are:

• When to share - in what circumstances is it appropriate to share information? Does consent need to be sought?
• Who to share with - who can information be shared with?
• How to share - what means should be used to send information securely to another service or agency?
• What to share - what information is it appropriate to share?

74. If it seems there is a need to share information, the following issues need to be considered:

• Is consent required ? Decide whether sharing will prevent harm or will be in response to a risk to wellbeing that may lead to harm, will assist in the prevention or detection of crime or meets any of the other exemptions described in the Data Protection Act. If information is shared for these particular reasons, it is not necessary to seek consent.
• If consent is sought . If practitioners consider that there is a need to share information - but not for the reasons listed above - then consent should be sought. If consent is not given, information must not be shared.
• The need-to-know. If information is shared - whether with or without consent - it must only be shared with people who have a need-to-know. This means they must have a public agency function (including commissioned services from the third sector) and need the shared information in order to do their job effectively. Where the role of Named Person is in place, then risks to wellbeing should be shared with them.
• Relevance . Only information relevant to the purpose of the instance of data sharing should be shared.
• Proportionality. The least amount of information should be shared to meet the purpose of the instance of sharing.
• Method. A secure method for sharing information must be used.
• Records. Practitioners must keep a record of what is shared, when, who with, how it is shared and the purpose.

Confidentiality

75. Practitioners working in the public, private and third sectors should be aware of the Common Law Duty of Confidentiality. Not all information is confidential. Confidentiality is not an absolute right. Information that is confidential is either considered to be of some sensitivity, is neither lawfully in the public domain nor readily available from another public source, and is shared in a relationship where the person giving the information understood that it would not be shared with others.

76. The duty of confidentiality requires that unless there is a statutory requirement to use information (that had otherwise been provided in confidence) - or a court orders the information to be disclosed - it should only be used for those purposes that the subject has been informed about and has consented to.

77. This duty is not absolute but should only be overridden if the holder of the information can justify disclosure as being in the public interest. Practitioners should consider whether the public interest in disclosure outweighs the duty of confidentiality. Any sharing should be proportionate, to the appropriate person, and go no further than the minimum necessary to achieve the public interest objective of protecting the child.

Consent

78. Two key principles of consent apply to information sharing between practitioners, and/or services and service users. These are that consent must be:

• informed - the individual must understand what is being asked of them and must give their permission freely. Information should also be provided about the possible consequences of withholding information; and

• explicit - the individual clearly and explicitly gives their consent for their information to be shared.

79. In both cases, best practice would suggest that practitioners should make use of a Consent Form.

80. Implied consent is not sufficient for information sharing. Implied consent simply means that the individual has not explicitly said they do not agree to their information being shared, so it is inferred that they do agree. Where there are concerns that seeking consent may place a child at risk, consent should not be sought.

81. Further information on practice considerations surrounding consent can be found in Appendix 2.

Information sharing practice summary note for use by practitioners

82. Diagram 1 below summarises the key information sharing considerations for practitioners. This includes what information to share, who to share with, and how the information should be shared.

^[13]

83. When to share? In general, information can and should be shared when there are any concerns about a child's wellbeing. It is good practice to inform the relevant parties that information is going to be shared and why, but this is different from seeking consent. Legally, if there are concerns about a child's wellbeing, relevant information can be shared without consent.

Practice Examples

An alcohol/drugs worker informing a social worker and/or health visitor when parental drug misuse increases, or attendance at clinic/pharmacy becomes erratic.

A teacher/health visitor speaking to GP/addiction/social work services when there are concerns about the presentation of a child.

A housing officer informing social work services if there are signs in the house that could be affecting the child.

84. What to share? Any information that could have an impact on a child's wellbeing. Practitioners should consider the information and ensure information shared is relevant and proportionate.

Practice Examples

Relevant information may include, for example, information regarding parental mental health and any known examples of how this impacts on parenting capacity. This does not mean that the adult's full medical history needs to be divulged, but only those aspects relevant to the adult's capacity to parent.

Parental drug use (including methods of funding of drug use) - this may include any safety concerns in and around the home, anything that could negatively affect the parenting ability or wellbeing of the child.

85. Who to share with? This will depend on who is requesting the information, how directly involved they are in the child's care, and what impact their knowledge of the information will have on the situation. If in doubt the Named Person or Lead Professional would be a central person to share information with who could then take things forward appropriately.

Practice Examples

Typical groups of people that information should be shared with are: social workers, health visitors, GPs, addiction services and school teachers.

86. How to share? Sharing information verbally initially is the most direct and effective route, but this should be documented and followed up by written communication according to local practice.