Safeguarding adults: sharing information

Published: January 2015 | Last updated: January 2019

This guide is part of a range of products to support implementation of the adult safeguarding aspects of the Care Act 2014. Sharing the right information, at the right time, with the right people, is fundamental to good practice in safeguarding adults but has been highlighted as a difficult area of practice.

Key messages

Adults have a general right to independence, choice and self-determination including control over information about themselves. In the context of adult safeguarding these rights can be overridden in certain circumstances.
Emergency or life-threatening situations may warrant the sharing of relevant information with the relevant emergency services without consent.
The law does not prevent the sharing of sensitive, personal information within organisations. If the information is confidential, but there is a safeguarding concern, sharing it may be justified.
The law does not prevent the sharing of sensitive, personal information between organisations where the public interest served outweighs the public interest served by protecting confidentiality – for example, where a serious crime may be prevented.
Information can be shared lawfully within the parameters of the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).
There should be a local agreement or protocol in place setting out the processes and principles for sharing information between organisations.
An individual employee cannot give a personal assurance of confidentiality.
Frontline staff and volunteers should always report safeguarding concerns in line with their organisation’s policy – this is usually to their line manager in the first instance except in emergency situations.
It is good practice to try to gain the person’s consent to share information.
As long as it does not increase risk, practitioners should inform the person if they need to share their information without consent.
Organisational policies should have clear routes for escalation where a member of staff feels a manager has not responded appropriately to a safeguarding concern.
All organisations must have a whistleblowing policy.
The management interests of an organisation should not override the need to share information to safeguard adults at risk of abuse.
All staff, in all partner agencies, should understand the importance of sharing safeguarding information and the potential risks of not sharing it.
All staff should understand who safeguarding applies to and how to report a concern.
The six safeguarding principles should underpin all safeguarding practice, including information-sharing.

Introduction

This guide is part of a range of products to support implementation of the adult safeguarding aspects of the Care Act 2014. Sharing the right information, at the right time, with the right people, is fundamental to good practice in safeguarding adults but has been highlighted as a difficult area of practice.

Frontline staff and volunteers should always report safeguarding concerns in line with their organisation’s policy. Policies should be clear about how confidential information should be shared between departments in the same organisation. Effectiveness should be monitored and any internal communication problems resolved.

This guide focuses on the sharing of sensitive or personal information between the local authority and its safeguarding partners (including GPs and health, the police, service providers, housing, regulators and the Office of the Public Guardian) for safeguarding purposes. This may include information about individuals who are at risk of abuse or neglect, service providers or those who may pose a risk to others. It aims to enable partners to share information appropriately and lawfully in order to improve the speed and quality of safeguarding responses.

The Care Act emphasises the need to empower people, to balance choice and control for individuals against preventing harm and reducing risk, and to respond proportionately to safeguarding concerns. The Act deals with the role of the safeguarding adults board (SAB) in sharing strategic information to improve local safeguarding practice. Section 45 ‘the supply of information’ covers the responsibility of others to comply with any request for information from the safeguarding adults board for the purposes of progressing an enquiry.

Sharing information between organisations as part of day-to-day safeguarding practice is not covered in the Care Act because it is already covered in the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation (GDPR), the Human Rights Act and the Crime and Disorder Act. The Mental Capacity Act is also relevant as all those coming into contact with adults with care and support needs should be able to assess whether someone has the mental capacity to make a decision concerning risk, safety or sharing information. This guide summarises key parts of these laws to help increase understanding of the basic principles in relation to safeguarding practice and, in particular, the sharing of safeguarding information.

This guide will be useful to frontline workers and managers from a range of sectors who work with people with care and support needs.

Why do we need to share adult safeguarding information?

Organisations need to share safeguarding information with the right people at the right time to:

prevent death or serious harm
coordinate effective and efficient responses
enable early interventions to prevent the escalation of risk
prevent abuse and harm that may increase the need for care and support
maintain and improve good practice in safeguarding adults
reveal patterns of abuse that were previously undetected and that could identify others at risk of abuse
identify low-level concerns that may reveal people at risk of abuse
help people to access the right kind of support to reduce risk and promote wellbeing
help identify people who may pose a risk to others and, where possible, work to reduce offending behaviour
reduce organisational risk and protect reputation.

Barriers and solutions

Failures in communication and joint working

Adult serious case reviews (now called Safeguarding Adults Reviews) frequently highlight failures between safeguarding partners (local authorities, GPs and health, the police, housing, care providers) to communicate and work jointly. Such failures can lead to serious abuse and harm and in some cases, even death.

How to improve communication and joint working

Strategic

Improve links between public protection forums: safeguarding boards, (children and adults), multi-agency risk assessment conferences (MARACs)*, multi-agency public protection arrangements (MAPPAs)**, health and wellbeing boards and community safety partnerships.
Develop joint approaches to resolve disputes where it is not obvious who should respond to a concern (eg. for an individual who appears vulnerable but does not have care and support needs, for people who refuse support and for those who self-neglect.)
Where appropriate, include partner agencies in enquiries, safeguarding meetings and investigations.
Keep referring agencies informed of progress and outcomes and where appropriate, include them in enquiries and safeguarding meetings.
Monitor information-sharing practice between your organisation and its safeguarding partners.

* MARAC: A multi-agency risk assessment conference is a means of coordinating risk based responses to domestic abuse. [2]
** MAPPA: multi-agency public protection arrangements assess and manage the risks posed by sexual and violent offenders. [13]

Joint training and policy development

Increase knowledge and understanding of multi-agency procedures.
Agree common language, terms and definitions.
Bring together people from different organisations to develop shared perceptions of risk.
Improve understanding of the different roles and responsibilities of safeguarding partners to reduce negative attitudes.
Ensure all staff understand the basic principles of confidentiality, data protection, human rights and mental capacity in relation to information-sharing.

View SCIE’s Social Care TV film, Lessons from the murder of Steven Hoskin.

Robert’s situation dramatically demonstrated the problems caused by different definitions of vulnerability. He was a young, long-term rough sleeper. His first contact with agencies was when he requested support from a day centre for homeless people. He had been living in a tent, but due to ill health and the winter conditions he could no longer manage.

Staff at the voluntary homeless shelter continually stressed Robert’s level of vulnerability but this did not appear to have been fully understood or acknowledged by the out-of-hours housing service. His care needs were overshadowed by a focus on his eligibility under homelessness legislation. Both housing and social services failed to sufficiently acknowledge the concerns of the homeless shelter and primary health care staff. Duties to assess vulnerable people in need of care and support under both housing and community care legislation were not fully considered. The response by housing and care agencies was highly focused on eligibility for service and there was no evidence of a joint approach to meeting Robert’s needs. [3] Two weeks after making contact with agencies, in January 2012, he died from morphine intoxication.

Learning points

As a result of this case the following recommendations have been implemented: [4]

Ensuring that the emergency duty team has an up-to-date knowledge of eligibility criteria, thresholds for assessment, safeguarding procedures and services available for adults.
Ensuring that cover over extended holiday periods is sufficiently robust.
Strengthening working relationships between the housing authority and the local homeless project.
Increasing awareness of the needs of street homeless people among health services.
Improving call-handling within the police and the housing authority.
Additional joint training on rough sleeper-related issues for housing, health and social care staff.

Serious case review in respect of ‘Robert’: Executive summary

Alice lives in a council flat. She is known to have a hoarding problem but has not previously neglected her own hygiene and health needs. Housing officers have intervened in the past, following concerns raised by neighbours. They have advised Alice that she needs to keep her hoarding under control so that it does not become a fire or health and safety risk.

An immediate neighbour calls the housing office to complain about the smell coming from Alice’s flat. She says that Alice seems increasingly unable to cope and is looking dirty and dishevelled. The housing officer, Don, visits. Alice answers the door and does look dirty and unwell. There are unpleasant odours coming from the flat. Alice does not want to let Don enter.

Don asks Alice why she thinks things might be getting more difficult for her. Alice says that her mother recently died. She was close to her mother, who also used to help her and encourage her to keep the hoarding under control. Alice says she does not mind if Don talks to the local authority safeguarding team. Don’s manager suggests he raises a safeguarding alert with the local authority but when he does so the local authority says that Alice is not eligible for social care services so it cannot provide a safeguarding service. Don contacts social services several times and argues that Alice is vulnerable and at risk; her health and wellbeing are clearly deteriorating. He insists that there is a need for joint working to prevent harm in this case. There is continued reluctance to engage from the local authority which Don finds very unhelpful. He discusses this with his manager.

The manager contacts the local authority safeguarding lead and they agree that a joint visit with a social worker should be arranged. Don and Meiling (the social worker) go to see Alice. The situation has not improved. Alice is still reluctant to allow them access but admits she needs help to get both her hoarding and her self-care under control.

Meiling feeds back to her manager that she thinks this will be a long-term piece of work as she will have to gain Alice’s trust and work with mental health colleagues to try and access support for what appears to be obsessive-compulsive disorder. Meiling’s manager agrees that Alice is vulnerable and has care and support needs and that Meiling should take on the case and work with housing and mental health colleagues.

Alice is offered bereavement counselling and support with managing her hoarding behaviour. Meiling is able to get access to the flat with the mental health support worker and they begin to clear some of the hoarded items with Alice. Alice starts to feel better and responds well. Her hygiene also improves.

Learning points

Joint working to support people is likely to lead to more efficient working between services.
Having a joint working agreement in place may avoid lengthy arguments over responsibilities.
The statutory guidance makes clear that self-neglect comes within the legal definition of abuse or neglect. It may therefore warrant a safeguarding response if the individual concerned has care and support needs.
Early intervention is likely to have better outcomes for the individual and it may prevent the need for a higher level of support in the future.
People can become vulnerable to abuse or neglect at any time due to physical or mental ill health, acquired disability, old age, bereavement or environmental factors.
When working with people who self-neglect it is often necessary to take time to build up trust.

Visit SCIE’s Self-neglect resources.

False perceptions about needing evidence or consent to share safeguarding information

Some frontline staff and managers can be over-cautious about sharing personal information, particularly if it is against the wishes of the individual concerned. They may also be mistaken about needing hard evidence or consent to share information. The risk of sharing information is often perceived as higher than it actually is. It is important that staff consider the risks of not sharing safeguarding information when making decisions.

How to address false perceptions

Raise awareness about responsibilities to share information (profession- or work role-specific guidance may help).
Encourage consideration of the risks of not sharing information.
Brief staff and volunteers on the basic principles of confidentiality and data protection.
Improve understanding of the Mental Capacity Act.
Provide a contact number for staff and volunteers to raise concerns.
Be clear in procedures about when to raise a safeguarding concern.
Assure staff and volunteers that they do not necessarily need to have evidence to raise a concern.

Tammy has mental health problems. She visits the GP for a routine check on her medication. While there, she mentions that her partner is violent towards her. The GP expresses concern and Tammy says that it’s nothing to worry about and in any case it’s no wonder he hits her as she’s very annoying. The GP says that she probably isn’t and even if she is, that doesn’t mean she deserves to be hit. Tammy says she doesn’t want to talk about it anymore and doesn’t want the GP to tell anyone.

The GP is mindful of his duty of confidentiality to the patient. He knows that Tammy has no children, and he does not think that she lacks the capacity to make decisions about living with her partner. He decides that it is her right to make the decision to not tell anyone about the violence, but he does make a note on her file about what she has said.

The next time Tammy comes to the surgery she sees a different doctor. This GP has not seen the note on Tammy’s file about the disclosure. Tammy has a bruise on her face; she says she fell over and that her jaw is very painful. The GP sends her to the hospital for an X-ray and it turns out she has a broken jaw. She has treatment from the hospital. The hospital staff do not question Tammy’s account of the cause of her injury.

A few weeks later Tammy calls the police. Her partner has cut her arm open with a knife and is threatening to kill her.

Learning points

When deciding whether to share information against someone’s wishes:

consider whether they have the mental capacity to make the decision and can fully understand the possible consequences
establish whether coercion or duress is involved – this may warrant sharing information without consent
enquire about the frequency and seriousness of the abuse
use gentle persuasion, explain what help and/or protection might be available
talk to other safeguarding partners without disclosing identity in the first instance
make enquiries to establish whether the alleged perpetrator has care and support needs or is a carer
follow up on discussion or disclosures.

Resources

General Medical Council Adult Safeguarding guidance
24-hour National Domestic Violence Freephone Helpline 0808 2000 247 run in partnership between Women’s Aid and Refuge

Complex networks between safeguarding partner agencies

The local authority has the lead responsibility for safeguarding adults with care and support needs, and the police and the NHS also have clear safeguarding duties under the Care Act 2014. Clinical commissioning groups and the police will often have different geographical boundaries and different IT systems. Housing and social care service providers will also provide services across boundaries. This makes sharing information complex in practice.

The Care Act 2014 (Section 6) places duties on the local authority and its partners to cooperate in the exercise of their functions relevant to care and support including those to protect adults. The safeguarding adults board should ensure that it ‘has the involvement of all partners necessary to effectively carry out its duties’. [7]

Addressing problems caused by complex networks:

Agree clear communication channels at the safeguarding adults board and set them out in the strategic plan.
Develop partnership working between neighbouring local authorities.
Set up forums for partners that feed into the safeguarding adults board (e.g. people with care and support needs, carers, housing, service providers and regulators).
Develop shared databases that can identify people who may be at risk of abuse.
Be clear about responsibilities for self-funders and people for whom services are provided outside their local area.

Sharing information to prevent abuse and neglect

Sharing information between organisations about known or suspected risks may help to prevent abuse taking place. The safeguarding adults board has a key role to play in sharing information and intelligence on both local and national threats and risks. The board’s annual report must provide information about any safeguarding adults reviews (SARs). This can include learning to inform future prevention strategies.

Some areas have developed multi-agency safeguarding hubs (MASHs) where key agencies are co-located to enable ‘real-time information-sharing, decision-making and communication’. [8]

Early evidence [8] suggests that multi-agency safeguarding hubs may improve:

identification of risk leading to early intervention and better preventative action
case management, preventing things getting lost in the system
understanding and scrutiny between professional roles
efficiency through better resource allocation and a reduction in duplication.

There may be benefits to other approaches that reflect local needs and resources. These include virtual links between organisations as opposed to co-location and establishing a single point of reporting. Whatever model suits the locality can be used – the emphasis is on improving the quality and speed of responses to safeguarding concerns through better information-sharing.

What if a person does not want you to share their information?

Frontline workers and volunteers should always share safeguarding concerns in line with their organisation’s policy, usually with their line manager or safeguarding lead in the first instance, except in emergency situations. As long as it does not increase the risk to the individual, the member of staff should explain their responsibility to share the concern with their manager.

Managers will need to make decisions about sharing information with external agencies, including the police and local authority. Individuals may not give their consent to the sharing of safeguarding information for a number of reasons. For example, they may be frightened of reprisals, they may fear losing control, they may not trust social services or other partners or they may fear that their relationship with the abuser will be damaged. Reassurance and appropriate support along with gentle persuasion may help to change their view on whether it is best to share information.

If a person refuses intervention to support them with a safeguarding concern, or requests that information about them is not shared with other safeguarding partners, their wishes should be respected. However, there are a number of circumstances where the practitioner can reasonably override such a decision, including:

the person lacks the mental capacity to make that decision – this must be properly explored and recorded in line with the Mental Capacity Act
other people are, or may be, at risk, including children
sharing the information could prevent a crime
the alleged abuser has care and support needs and may also be at risk
a serious crime has been committed
staff are implicated
the person has the mental capacity to make that decision but they may be under duress or being coerced
the risk is unreasonably high and meets the criteria for a multi-agency risk assessment conference referral
a court order or other legal authority has requested the information.

If none of the above apply and the decision is not to share safeguarding information with other safeguarding partners, or not to intervene to safeguard the person:

support the person to weigh up the risks and benefits of different options
ensure they are aware of the level of risk and possible outcomes
offer to arrange for them to have an advocate or peer supporter
offer support for them to build confidence and self-esteem if necessary
agree on and record the level of risk the person is taking
record the reasons for not intervening or sharing information
regularly review the situation
try to build trust and use gentle persuasion to enable the person to better protect themselves.

If it is necessary to share information outside the organisation:

explore the reasons for the person’s objections – what are they worried about?
explain the concern and why you think it is important to share the information
tell the person who you would like to share the information with and why
explain the benefits, to them or others, of sharing information – could they access better help and support?
discuss the consequences of not sharing the information – could someone come to harm?
reassure them that the information will not be shared with anyone who does not need to know
reassure them that they are not alone and that support is available to them.

If the person cannot be persuaded to give their consent then, unless it is considered dangerous to do so, it should be explained to them that the information will be shared without consent. The reasons should be given and recorded. The safeguarding principle of proportionality should underpin decisions about sharing information without consent, and decisions should be on a case-by-case basis.

If it is not clear that information should be shared outside the organisation, a conversation can be had with safeguarding partners in the police or local authority without disclosing the identity of the person in the first instance. They can then advise on whether full disclosure is necessary without the consent of the person concerned.

It is very important that the risk of sharing information is also considered. In some cases, such as domestic violence or hate crime, it is possible that sharing information could increase the risk to the individual. Safeguarding partners need to work jointly to provide advice, support and protection to the individual in order to minimise the possibility of worsening the relationship or triggering retribution from the abuser.

SafeLives (previously CAADA) provide resources for identifying the risk victims face including a Dash risk checklist, which is a risk assessment tool for practitioners who work with adult victims of domestic abuse. It offers a consistent approach to identifying those who are at high risk of harm and whose cases should be referred to a MARAC (multi-agency risk assessment conference) meeting in order to manage their risk. If you are concerned about risk to a child or children, you should make a referral to ensure that a full assessment of their safety and welfare is made.

Mrs Tweedy is 83 and needs some help at home with shopping and cleaning. She has a son who abuses alcohol. Mrs Tweedy complains to the home care worker, Terry, that she is short of money for the week’s shopping because her son took cash from her purse during a recent visit. This has happened before and Mrs Tweedy doesn’t like it but she doesn’t want to get her son into trouble – she says he has enough problems.

Terry explains to Mrs Tweedy that now she knows about this she really should let her manager know. Mrs Tweedy isn’t happy about this; she doesn’t want anyone to talk to her son as he may become angry and threaten her. She is clear that she doesn’t want the police or social services involved. Mrs Tweedy has the mental capacity to make a decision about this. Terry reassures her that she just needs to tell her manager and that nobody else will be told at this stage. Mrs Tweedy says she wishes she’d never mentioned it and appears quite angry.

Terry discusses her concern with her manager in line with her employer’s safeguarding policy. The manager, Eddie, arranges to visit Mrs Tweedy to discuss the situation. Again Mrs Tweedy is clear that she does not want the police or social services involved with her family affairs. Eddie explains that he is worried about Mrs Tweedy’s safety. Mrs Tweedy replies that she’s far safer if they just leave her to deal with it; her son could become violent if they intervene.

Mrs Tweedy is making a clear decision about her son taking money but Eddie is concerned about the threat of violence. He decides to explore with Mrs Tweedy why she thinks that her son might be violent. Mrs Tweedy says he loses his temper when he doesn’t get what he wants – usually this is alcohol or money for alcohol. Eddie says this isn’t acceptable, she should not have to be in fear of her son, and that if they inform social services perhaps some support for her son can be arranged. Mrs Tweedy says the violence is usually shouting and hitting the wall and that her son has never assaulted her. She says she can cope with this but she does wish there were some help for her son.
She agrees:

that Eddie can make initial enquiries with social services about support for her son, but that he won’t be contacted directly about this
that she will let Eddie know if she thinks the threat of violence has increased.

Eddie talks to social services, who already know about Mrs Tweedy’s son, who lives alone, and his problems. They have found it difficult to engage with him, but while they acknowledge that there is some risk to Mrs Tweedy, they do not believe he poses a significant risk to others. The housing officer has frequent contact with him so they can arrange a joint visit, to appear routine, so there will be no indication that Mrs Tweedy has raised a concern. Then they can explore how best to help him.
Eddie feeds this back to Mrs Tweedy. She is happy with this approach and asks for an update once they’ve talked to her son.

Learning points

It is better to work with people, be flexible and offer help to find the best outcome for them.
People can often be persuaded to accept help or intervention if they know that they can remain in control of decision-making and care will be taken to maintain relationships.

Sharing information with carers, family or friends

It is good practice, unless there are clear reasons for not doing so, to work with the carers, family and friends of an individual to help them to get the care and support they need. Sharing information with these people should always be with the consent of the individual. If the person lacks the mental capacity to make a decisions about sharing information with key people, then the Mental Capacity Act should be followed to ensure each decision to share information is in the person’s best interests. Decisions and reasoning should always be recorded.

What if a safeguarding partner is reluctant to share information?

There are only a limited number of circumstances where it would be acceptable not to share information pertinent to safeguarding with relevant safeguarding partners. These would be where the person involved has the mental capacity to make the decision and does not want their information shared and:

nobody else is at risk
no serious crime has been or may be committed
the alleged abuser has no care and support needs
no staff are implicated
no coercion or duress is suspected
the public interest served by disclosure does not outweigh the public interest served by protecting confidentiality
the risk is not high enough to warrant a multi-agency risk assessment conference referral
no other legal authority has requested the information.

Safeguarding adults boards should set out a clear policy for dealing with conflict on information-sharing. If there is continued reluctance from one partner to share information on a safeguarding concern the matter should be referred to the board. It can then consider whether the concern warrants a request, under Clause 45 of the Care Act, for the ‘supply of information’. Then the reluctant party would only have grounds for refusal if it would be ‘incompatible with their own duties or have an adverse effect on the exercise of their functions’. [7]

Powers or obligations to share information

Referring to the Disclosure and Barring Service

The Safeguarding Vulnerable Groups Act (2006) places specific duties on those providing regulated activities. An employer must refer to the Disclosure and Barring Service (DBS) anyone who has been dismissed or removed from their role because they are thought to have harmed, or pose a risk of harm to, a child or adult with care and support needs. This applies even if they have left their job and regardless of whether they have been convicted of a related crime.

A Disclosure and Barring Service has a factsheet on Local authority: Referral duty and power

Professional codes of practice

Many professionals, including those in health and social care, are registered with a body and governed by a code of practice or conduct. These codes often require those professionals to report any safeguarding concerns in line with legislation.

Care workers or care assistants are not registered but there is a voluntary code of conduct published by Skills for Care. The code states that as a healthcare support worker or adult social care worker in England, you must:

report any actions or omissions by yourself or colleagues that you feel may compromise the safety or care of people who use health and care services and, if necessary use whistleblowing procedures to report any suspected wrongdoing.
challenge and report dangerous, abusive, discriminatory or exploitative behaviour or practice.
report things that you feel are not right, are illegal, or if anyone at work is neglecting their duties. This includes when someone’s health and safety is in danger, damage to the environment, a criminal offence, that the company is not obeying the law (like not having the right insurance), or covering up wrongdoing.

Social workers are registered by Social Work England. The professional standards require social workers to:

…respect and promote the human rights, views, wishes and feelings of the people [they] work with, balancing rights and risks and enabling access to advice, advocacy, support and services.

…report allegations of harm and challenge and report exploitation and any dangerous, abusive or discriminatory behaviour or practice.

Duty of candour

Regulations under the Care Act place a duty of candour on all service providers registered with the Care Quality Commission from April 2015. The duty:

aims to ensure transparency and honesty when things go wrong
requires providers to tell the person concerned when something has gone wrong as soon as possible and provide support to them
includes giving an apology and keeping the person informed about any further enquiries.

Commissioners

Those commissioning services should consider whether contracts should place an obligation on service providers to share safeguarding information. Any specifications would need to be in line with policy, regulation and the law.

SCIE resources on Adult Safeguarding: Commissioning

Sharing information on prisoners

The statutory guidance to the Care Act requires local authorities to share information about people with care and support needs in, or in transition from or to, prison or custodial settings. This includes ‘the sharing of information about risk to the prisoner and others where this is relevant’. [7]

Sharing information on those who may pose a risk to others

The police can keep records on any person known to be a target or perpetrator of abuse and share such information with safeguarding partners for the purposes of protection ‘under Section 115 of the Crime and Disorder Act 1998, provided that criteria outlined in the legislation are met’. All police forces now have IT systems in place to help identify repeat and vulnerable victims of antisocial behaviour.

The statutory guidance to the Care Act states that safeguarding adults boards should have a ‘framework and process for any organisation under the umbrella of the SAB to respond to allegations and issues of concern that are raised about a person who may have harmed or who may pose a risk to adults’. The control of information in respect of individual cases must be in accordance with accepted Data Protection and Confidentiality requirements’.

What does the law say about sharing information?

Information-sharing is related to a number of different pieces of legislation:

Confidentiality is an important principle that enables people to feel safe in sharing their concerns and to ask for help. However, the right to confidentiality is not absolute. Sharing relevant information with the right people at the right time is vital to good safeguarding practice.

All staff and volunteers should be familiar with their internal safeguarding procedures for raising concerns. They can also contact either the police or the local authority safeguarding lead for advice, without necessarily giving an individual’s personal details, if they are unsure whether a safeguarding referral would be appropriate.

Some basic principles:

Don’t give assurances about absolute confidentiality.
Try to gain consent to share information as necessary.
Consider the person’s mental capacity to consent to information being shared and seek assistance if you are uncertain.
Make sure that others are not put at risk by information being kept confidential:
- Does the public interest served by disclosure of personal information outweigh the public interest served by protecting confidentiality?
- Could your action prevent a serious crime?
Don’t put management or organisational interests before safety.
Share information on a ‘need-to-know’ basis and do not share more information than necessary.
Record decisions and reasoning about information that is shared.
Carefully consider the risks of sharing information in relation to domestic violence or hate crime.

The revised Caldicott principles

The sharing of information in health and social care is guided by the revised Caldicott principles. These principles are reflected in the General Data Protection Regulation (GDPR) and are useful to other sectors:

They are:

1. Justify the purpose(s)

Every proposed use or transfer of personal confidential data within or from an organisation should be clearly defined, scrutinised and documented, with continuing uses regularly reviewed, by an appropriate guardian.

2. Don’t use personal confidential data unless it is absolutely necessary

Personal confidential data should not be included unless it is essential for the specified purpose(s) of that flow. The need for patients to be identified should be considered at each stage of satisfying the purpose(s).

3. Use the minimum necessary personal confidential data

Where use of personal confidential data is considered to be essential, the inclusion of each individual item of data should be considered and justified so that the minimum amount of personal confidential data transferred or accessible as is necessary for a given function to be carried out.

4. Access to personal confidential data should be on a strict need-to-know basis

Only those individuals who need access to personal confidential data should have access to it, and they should only have access to the data items that they need to see. This may mean introducing access controls or splitting data flows where one data flow is used for several purposes.

5. Everyone with access to personal confidential data should be aware of their responsibilities

Action should be taken to ensure that those handling personal confidential data – both clinical and non-clinical staff – are made fully aware of their responsibilities and obligations to respect patient confidentiality.

6. Comply with the law

Every use of personal confidential data must be lawful. Someone in each organisation handling personal confidential data should be responsible for ensuring that the organisation complies with legal requirements.

7. The duty to share information can be as important as the duty to protect patient confidentiality

Health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by these principles. They should be supported by the policies of their employers, regulators and professional bodies.

The GDPR forms part of the data protection regime in the UK, together with the new Data Protection Act 2018 (DPA 2018). The main provisions of this apply, like the GDPR, from 25 May 2018. The law is wide-reaching and places a range of new duties and responsibilities on organisations that store data from which individuals can be identified. The Information Commissioners Office offers detailed guidance on the new regulation.

The changes in the law do not change our practice with regard to safeguarding adults because the GDPR, like the previous legislation, allows us to share information without consent in certain circumstances. If it is deemed to be in the public interest, data may be collected, processed, shared and stored. It may be stored for longer periods in the public interest and in order to safeguard the rights and freedoms of individuals.

Vital interests

Vitality means ‘life’, vital interests are a lawful basis for sharing personal data to protect someone’s life, but you must check whether there is a less intrusive way to protect the person’s life. You will need to document and justify your decision.

The principles of GDPR

Processed lawfully, fairly and in a transparent manner in relation to individuals
Collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes
Adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed
Accurate and, where necessary, kept up to date
Kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed
Processed in a manner that ensures appropriate security of the personal data

For a more detailed explanation of the principles see the Information Commissioners Office guidance.

Resources

The Information Commissioners Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.

“Professionals and other staff need to understand and always work in line with the Mental Capacity Act 2005. They should use their professional judgement and balance many competing views. They will need considerable guidance and support from their employers if they are to help adults manage risk in ways that put them in control of decision making if possible.” [7]

The Mental Capacity Act will apply if there is any doubt that the person concerned has the mental capacity to make specific decisions about sharing information or accepting intervention in relation to their own safety.
The Mental Capacity Act ‘Code of practice’ states that: ‘The person who assesses an individual’s capacity to make a decision will usually be the person who is directly concerned with the individual at the time the decision needs to be made’. [12]
In most cases a worker should be able to assess whether a person has the mental capacity to make a specific decision – see the two-stage functional test of capacity.

The two-stage functional test of capacity

In order to decide whether an individual has the capacity to make a particular decision, you must answer two questions:

Stage 1: is there an impairment of or disturbance in the functioning of a person’s mind or brain? If so,

Stage 2: is the impairment or disturbance sufficient that the person lacks the capacity to make a particular decision?

The Mental Capacity Act states that a person is unable to make their own decision if they cannot do one or more of the following four things:

understand information given to them
retain that information long enough to be able to make a decision
weigh up the information available to make the decision
communicate their decision – this could be by talking, using sign language or even simple muscle movements such as blinking an eye or squeezing a hand.

Other considerations

Every effort should be made to find ways of communicating with someone before deciding they lack capacity to make a decision.
Different methods (e.g. pictures, communication cards or signing) should be used to support people with communication difficulties to make sure their views are heard.
Family, friends, carers or other professionals should be involved as appropriate.
The mental capacity assessment must be made on the balance of probabilities – is it more likely than not that the person lacks capacity?
You must be able to show in your records why you have come to your conclusion that capacity is lacking for the particular decision in question.

Case study: David

David is a 45-year-old man with learning disabilities. He lives in a housing association flat and has support from adult social services to manage his finances. The housing office has received complaints from the neighbours about noise from the flat. The housing officer, Nimesh, visits David and notices that there are lots of empty alcohol containers lying around. He asks David about the cans and bottles and David says that he has friends who come round in the evening and drink in his flat. Nimesh also notices that there is graffiti on the wall in the living room. He asks David about this and David says that his friend did it. Nimesh asks about the friends and learns that there are a number of much younger men who appear to have befriended David.

Nimesh talks to David about the possible risks and explains that he may be being exploited. He asks David if he can discuss his concerns with other safeguarding partners such as adult social care and the police. He explains that he wants to make sure that David is safe in his flat. David is insistent that he has the right to make friends and he does not want social services or the police informed.

Nimesh considers David’s mental capacity with regard to his decisions to:

maintain relationships with the young men
refuse to share information with the police or adult social care.

Nimesh considers whether David can:

understand the risk of letting the young men drink in his flat and that the graffiti, cans and bottles suggest a lack of respect for him and his personal space
retain that information long enough to be able to make the decisions to keep allowing the men into his flat or not to inform the police or adult social care
weigh up the situation to enable him to make a decision about the possible risks
communicate his decision about this circumstance and risk.

Nimesh is sure David has an impairment – his learning disability – and he is not sure that he can appreciate that he may be being exploited or understand the possible risks or consequences. He discusses this with his manager and they take the decision, in David’s best interests, to raise a safeguarding concern with adult social services. Their decision and reasoning is recorded in David’s file.

Nimesh explains to David why he has to raise a safeguarding concern and explains that social services will need to consider whether it is necessary to involve the police.

Learning points

People with care and support needs may be unaware of the dangers of exploitation.
‘Mate crime’ is a term used to describe situations where a person is befriended because of the opportunities for exploitation.
The Mental Capacity Act supports decision-making where someone may not understand the consequences of their actions or the actions of others.

The key principles of the Act

You should understand the basic principles of the Mental Capacity Act when making decisions about sharing personal information for safeguarding purposes. There are five key principles.

Principle 1: a presumption of capacity. Every adult has the right to make their own decisions and must be assumed to have capacity to do so unless it is proved otherwise. This means that you cannot assume that someone cannot make a decision for themselves just because they have a particular medical condition or disability.
Principle 2: individuals being supported to make their own decisions. A person must be given all practicable help before anyone treats them as not being able to make their own decisions. This means you should make every effort to encourage and support people to make the decision for themselves. If lack of capacity is established, it is still important that you involve the person as far as possible in making decisions.
Principle 3: unwise decisions. People have the right to make decisions that others might regard as unwise or eccentric. You cannot treat someone as lacking capacity for this reason. Everyone has their own values, beliefs and preferences which may not be the same as those of other people.
Principle 4: best interests. Anything done for or on behalf of a person who lacks mental capacity must be done in their best interests.
Principle 5: less restrictive option. Someone making a decision or acting on behalf of a person who lacks capacity must consider whether it is possible to decide or act in a way that would interfere less with the person’s rights and freedoms of action, or whether there is a need to decide or act at all. Any intervention should be weighed up in the particular circumstances of the case.

Unwise decisions

A person with capacity is entitled to make unwise decisions relating to abuse.
If a person making an unwise decision lacks capacity to make that decision, then a decision needs to be made by others in the person’s best interests.
‘Best interests’ decisions must comply with the Mental Capacity Act.
It may be necessary and justified to contest an unwise decision if it appears to be related to exploitation, coercion, grooming, undue influence or duress.
Individuals should be given the opportunity to disclose undue influence and seek appropriate support.
If a person with capacity is making an unwise decision that puts others at risk then it may be justified to share information without their consent.

Resources

SCIE MCA resources
Seven golden rules for information-sharing
The Mental Capacity Act Code of practice
General Data Protection Regulation (GDPR)

Six safeguarding principles

Empowerment
People being supported and encouraged to make their own decisions and informed consent.

Prevention
It is better to take action before harm occurs.

Proportionality
The least intrusive response appropriate to the risk presented.

Protection
Support and representation for those in greatest need.

Partnership
Local solutions through services working with their communities. Communities have a part to play in preventing, detecting and reporting neglect and abuse.

Accountability
Accountability and transparency in safeguarding practice.

Seven golden rules for information-sharing

Remember that the General Data Protection Regulation (GDPR) is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately.
Be open and honest with the person (and/or their family where appropriate) from the outset about why, what, how and with whom information will, or could be, shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
Seek advice if you are in any doubt, without disclosing the identity of the person where possible.
Share with consent where appropriate and, where possible, respect the wishes of those who do not consent to share confidential information. You may still share information without consent if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base your judgement on the facts of the case.
Consider safety and wellbeing: base your information-sharing decisions on considerations of the safety and wellbeing of the person and others who may be affected by their actions.
Necessary, proportionate, relevant, accurate, timely and secure: ensure that the information you share is necessary for the purpose for which you are sharing it, is shared only with those people who need to have it, is accurate and up to date, is shared in a timely fashion, and is shared securely.
Keep a record of your decision and the reasons for it – whether it is to share information or not. If you decide to share, then record what you have shared, with whom and for what purpose.

Resources

Information sharing for community safety: guidance and practice advice, Home Office
Guide to the General Data Protection Regulation (GDPR), Information Commissioner’s Office
Protect (formerly Public Concern at Work) is a whistleblowing charity that can provide independent and confidential advice to workers who are unsure whether or how to raise a public interest concern.
Social Care TV: Safeguarding adults: lessons from the murder of Steven Hoskin, SCIE
Code of conduct for Healthcare Support Workers and Adult Social Care Workers in England, Skills for Care

References

2 – SafeLives (previously CAADA) Information about MARACs.

3 – North Yorkshire Safeguarding Adults Board (2012a) ‘Serious case review in respect of “Robert”‘.

4 – North Yorkshire Safeguarding Adults Board (2013b) ‘Annual report 2012/13’.

5 – Independent Police Complains Commission (IPCC) (2009) ‘IPCC report into the contact between Fiona Pilkington and Leicestershire Constabulary 2004-2007‘.

6 – Home Office and ACPO (2012) ‘Focus on the victim: summary report on the ASB call handling trials’.

7 – Department of Health (2014) ‘Care and support statutory guidance‘.

8 – Home Office (2014) ‘Multi-agency working and information sharing project: final report‘.

2 – Department of Constitutional Affairs (2007) ‘Mental Capacity Act code of practice‘.

13 – Ministry of Justice, HM Prison Service and National Offender Management Service (2014) Multi-agency public protection arrangements (MAPPA)