Section 7: Sharing information for direct care

Confidential information needs to be shared between registered and regulated health and social care professionals who have a legitimate relationship with the individual for the purposes of the individual’s direct care. A registered and regulated health or social care professional has a legitimate relationship with the patient or service user when any or all of the following criteria are met

• the individual presents themselves to the professional to receive care
• the individual agrees to a referral from one care professional to another
• the individual is invited by a professional to take part in a screening or immunisation programme for which they are eligible and they accept
• the individual presents to a health or social care professional in an emergency situation where consent is not possible
• the relationship is part of a legal duty e.g. contact tracing in public health
• the individual is told of a proposed communication and does not object for example the consultant in the ambulatory clinic says she will let the patient’s social worker know of events in the clinic and the patient does not object

When providing direct care, a non-regulated member of staff should be able to access a proportion of an individual’s confidential information when any or all of the following criteria are met

• the individual presents themselves to those staff for the purposes of care e.g. NHS 111.
• the staff are professionally supervised by a registered and regulated health or social care professional.
• the staff are managerially directly responsible to a registered and regulated professional for the lawful use of confidential information.
• they have only necessary and very limited access to patient and service user data.
• the individual concerned has given explicit consent that the member of staff should access all or part of their confidential information.
• the staff member is registered on a voluntary register approved by the Professional Standards Authority

And in all cases

• the terms and contractual obligations of employment within an organisation have an explicit duty of confidentiality as part of the contract with sanctions.
• the non-regulated individual is a part of a direct care team with a ‘legitimate relationship’ to the individual

Appropriate communication from a regulated and registered professional to non-regulated staff should be the norm and occur through one of the following routes

• the individual concerned gives explicit consent to the sharing of their confidential information.
• the contact point of the service is a registered and regulated health and social care professional and communication is through implied consent.
• the communication is through the social worker or equivalent professional within the local authority who has organised the package of care (‘care and support plan’).
• the communication is given to the individual concerned, with or without a carer being present, and the individual makes the decision to share their copy of the communication.
• there is a specific safety concern regarding the individual, which is best resolved or mitigated by sharing some of the confidential information about the patient in situations where consent is not possible. In these situations, professional judgement and the patient’s best interests need to apply