Introduction

Everyone using health and social care services in England is entitled to expect that  information they entrust to care providers will be treated in strictest confidence.  The promise of confidentiality has been a cornerstone of medical practice for centuries and the relationship of trust between a doctor and patient depends on it. The patient needs to be able to tell the truth about intimate matters, knowing that this information will not be improperly disclosed. This is equally important in social care, for example when a social worker is making arrangements for an individual’s care and wellbeing.

People using services deserve a lot more than just information security. Individuals need the teams of professionals who are responsible for their care to share information reliably and effectively. Confidential information about an individual must not leak outside the care team, but it must be shared within it in order to provide a seamless, integrated service.

The community can also derive huge benefits from information that has been collected by health and social care services once it has been anonymised to stop any individual being identified. Advances in medical research and improvements in the design of care services depend on making good use of anonymised information. The Health and Social Care Information Centre (HSCIC) plays a leading role in ensuring that information can be used for community benefit.

Confidential information sharing and community benefit are well established throughout health and social care services in England. Although the concepts are straightforward and little contested, they give rise to complex ethical and administrative problems when put into operation. The subject was examined in depth by the Information Governance Review led by Dame Fiona Caldicott, which reported in April 2013¹. It set out seven principles to guide decisions about confidential information (Appendix 1) and made a range of recommendations which were accepted by the government in September 2013. This guide reflects these principles throughout and incorporates the good practice outlined by the Information Governance Review.

The HSCIC has a big part to play in implementing these recommendations and will support and assist health and social care organisations in doing so. It also has statutory responsibility under the Health and Social Care Act 2012 to produce a Code of Practice for processing confidential information covering ‘the practice to be followed in relation to the collection, analysis, publication and other dissemination of confidential information concerning, or connected with the provision of health services or of adult social care in England.

While preparing that code, the HSCIC heard from many stakeholders that there was also an urgent need for a clear guide to processing confidential information about an individual's care. Importantly, this should be a guide that can be understood by service users, patients, carers, relatives and staff – all of whom need to know what to expect when confidential  information is given and received.

The guide needed to focus specifically on what the Information Governance Review termed ‘personal confidential data (PCD)’. This is identifiable information about an individual that they would reasonably expect to be held confidential.  The terms ‘confidential information’ and ‘personal confidential information’ are used interchangeably in this guide.

This guide has been issued through the HSCIC’s powers to provide advice and guidance ‘on any matter relating to the collection, analysis, publication or other dissemination of information.’² Therefore health and social care bodies (or anyone working with them to provide services or care) processing confidential information in relation to the provision of publicly funded health or adult social care activities, must have regard to this guide.

The guide has been designed to be easily accessible and to de-mystify some of the complexities of the laws, principles and obligations that have sometimes got in the way of good decision making in the past. It brings together the array of overlapping ethical and professional principles and laws in relation to using or sharing confidential information. Ethical principles outline the fundamental standards of behaviour expected of health and social care staff. Professional obligations are set by professional regulators and neglecting them can have severe repercussions for staff, such as being struck off the professional register and not being able to practise their profession again. The law sets out duties which are a mix of the decisions of the courts (known as the ‘common law duty of confidentiality³) and legislation such as the Data Protection Act⁴ and the Human Rights Act.⁵

Together, ethical principles and professional obligations have evolved from moral judgement about what is right and wrong. Some of these considerations are so important that they have been enshrined in law. The confidentiality rules within the guide reflect these considerations so that in most cases, readers do not have to consult multiple sources of guidance. That is  not to say that it is always easy to discern what is right. Decisions around sharing confidential information are often not clear cut and require consideration of a balance of interests – those of the individual and the community. This guide aims to enable staff to use their professional judgement confidential in the best interests of the individual and the community.