Child Protection - Information Sharing - HL7 V3 API

Use this API to access Child Protection - Information Sharing (CP-IS) from a scheduled or unscheduled healthcare setting. CP-IS is the national electronic database of child protection information.

Unscheduled care providers

As an unscheduled care provider, you can:

• get a patient's CP-IS information - which automatically triggers a notification to the relevant local authority - see connections 3, 4, 5 and 6 on the diagram

Scheduled care providers

As a scheduled care provider, you can:

• get a patient's CP-IS information without automatically triggering a notification to the relevant local authority - see connections 3 and 4 on the diagram

Local authorities

Local authorities should use the Child Protection - Information Sharing - MESH integration.

Information held in CP-IS

CP-IS holds the following information for each registered patient:

• NHS number
• details of their plan - type, start date and end date
• details of the 25 most recent CP-IS information accesses from unscheduled care settings in England
• the name of the responsible local authority - together with their office hours phone and emergency duty contact numbers

Identifying patients

All records in CP-IS are held against the patient's NHS number. It is therefore very important to ensure you use the correct NHS number for each patient.

For more details, see CP-IS NHS number matching information.

Using NCRS as an interim measure

We prefer care providers to integrate their applications directly with CP-IS using our CP-IS APIs. However, as an interim measure, you can use our National Care Records Service to access CP-IS information.

Spine Mini Service Provider (SMSP) options

There are also commercially available products which give easier access to CP-IS, known as Spine Mini Service Providers (SMSPs).

These and other conforming software products are listed in our Conformance Catalogue.

If you are interested in becoming a provider of one of these products, see Child Protection - Information Sharing - SMSP API standards.

This API can only be used where there is a legal basis to do so. Make sure you have a valid use case before you go too far with your development.

You must do this before you can go live (see ‘Onboarding’ below). 

The following APIs are related to this API:

• Personal Demographics Service - FHIR API - use this to find the correct NHS number for a given patient
• Child Protection - Information Sharing - MESH - use this to integrate with CP-IS from a local authority

This API is in production.

Further information in our roadmap.

This API is a Bronze service, meaning it is supported 8am to 6pm, Monday to Friday excluding bank holidays.

For more details, see service levels.

This API is an HL7 V3 API.

All interactions are asynchronous interactions, using HL7 V3 ebXML messaging.

Some of the interactions are technically asynchronous but function as a real-time request-response pair, for example:

• request CP-IS information (as a care provider)
• receive CP-IS information (as a care provider)

For more details, see HL7 V3.

You need a Health and Social Care Network (HSCN) connection to use this API.

For more details, see Network access for APIs.

This API is user-restricted, meaning an end user must be present, authenticated and authorised to use it.

For authentication, the end user must be:

• a healthcare worker
• strongly authenticated, using either an NHS smartcard or a modern alternative

We support the following security patterns for user-restricted access:

• user-restricted HL7 V3 API, using NHS Care Identity Service 2 (NHS CIS2)
• user-restricted HL7 V3 API, using CIS

For more details on authentication, see user-restricted APIs.

To use this API, the end user must be authorised to perform that activity.

The API itself does not perform any authorisation checks. Rather, the calling system is expected to perform them. The authorisation rules are specified in our national Role Based Access Control (RBAC) database.

For more details see:

• our national Role Based Access Control (RBAC) database on the registration authorities and smartcards page
• DCB1609: Child Protection - Information Sharing for details on specific role codes for CP-IS

You can test this API using our Path to Live environments.

You need to get your software approved with us before it can go live with this API. We call this onboarding. The onboarding process can sometimes be quite long, so it’s worth planning well ahead.

As part of this process, you need to demonstrate that you can manage risks and that your software conforms technically with the requirements for this API. This might impact the design of your software. For details, see Onboarding support information.

To understand how our online digital onboarding process works, see digital onboarding.

For a full list of interactions for this API, see the CP-IS Domain Message Specification.

For details on the general structure of the interactions, see HL7 V3.

For more implementation details for this API, see Implementation process for healthcare organisations.

Scheduled care providers

Support for scheduled care providers to access CP-IS records is provided from 'Child Protection 1.0 Status: RC5 Patch D' onwards.

Security and authorisation details are the same as those for unscheduled care providers, however, scheduled care providers must set the accessEventType value isUnscheduledAccessEvent to 'false' in the CP-IS query payload.