42
94
Information: To share or not to share? The Information Governance Review
• The care team looking after the interests of a child or a family often includes agencies
from outside the normal boundaries of health and social care, from both public and
independent sectors. Working in such teams may require health and social care
professionals to share information with people who are not on a professional register
and may not follow the same information governance rules and procedures.
• Children comprise the only aspect of health and social care policy with two lead
government departments — the Department of Health for children’s health and
Department for Education for children’s social care. The terms of reference for this
review cover children, but our report is to the Secretary of State for Health.
• Cross-government policy is increasingly focusing on early intervention to improve ‘public
welfare’. These initiatives use data to identify ‘at risk’ individuals and groups in order
to offer support e.g. to help troubled families or to combat domestic violence,
trafficking and grooming.
10.2 Parents, children and young people: access to electronic
records
In general, parents or people with parental responsibility should have access to their
child’s health and social care records. However, children should also be involved in
decisions about their care, subject to their capacity to understand and have a view.
As children develop and gain the ability to make their own decisions, there comes a time
when parents should not automatically be able to access the child’s record. The point at
which this transition occurs is different for every child, and is influenced by circumstance,
the parents and the child. Health and social care professionals are accustomed to making a
judgement about when this transition should take place. These professional judgements
can be further complicated in difficult circumstances, for example if the child is living in
an abusive environment. It is not the intention of this review to reduce the discretion
available to professionals to make these subjective decisions on a case-by-case basis.
However, we have to consider the implications for children and parents of our
recommendation in chapter 2 that people should have access to all the personal electronic
records about them, across the whole health and social care system. When should the
parent’s automatic right of electronic access to the child’s record be turned off and at
what stage of maturity should the child’s automatic access be turned on?
The Royal College of General Practitioners explored this difficult problem as part of its
recommendations on patient online access. Although clearly each individual case will
require professional judgement, the college’s standard assumption was that, initially, both
the child and the parent(s) should have full online access. ‘Full’ access should
automatically be switched off when the child reaches the age of 12, although transactional
online services, such as making appointments with a professional, would still be possible.
‘Full’ patient online access would be reinstated to the child when they reach 16 years old
if they have capacity, or earlier if the health or social care professional judges, after
discussions with the child, that they are competent.
43
95
10 Children and families
10.3 Family records
Following the Munro Review
91
there has been a trend in children’s social care to move back
to maintaining ‘family records’. This is not instead of individual case records, but rather
using technology more effectively to maintain both individual and family views of the data.
The challenge in such systems is two-fold:
• To be able to present a meaningful record to each individual family member without
compromising the privacy/confidentiality of other family members (but recognising
what they do or are likely to know about each other).
• The ability to deal differentially with information provided by third parties which may
be shared with some agencies and not others; or some family members and not others.
In this context it is likely that, as a minimum, the child or young person’s record would
hold a family ‘tree’ extending beyond the household, but including any non-relatives
sharing or significantly influencing the household.
The increasing creation and use of family records is a contentious issue, the ICO
Anonymisation code of practice states
92
:
“Information about a large family group might not be personal, but its disclosure
may well breach the privacy rights of the family.
It is advisable to seek specialist advice if you believe a disclosure has novel or
potentially contentious Article 8 implications.”
Recommendation 16
Given the number of social welfare initiatives involving the creation or use of family
records, the Review Panel recommends that such initiatives should be examined in
detail from the perspective of Article 8 of the Human Rights Act. The Law
Commission should consider including this in its forthcoming review of the data
sharing between public bodies.
10.4 Consent relating to children and families
Health and social care professionals may be confronted with extremely complex scenarios
involving the care of children and families, and the obtaining of consent, which require
professionals to exercise judgement of the highest order. Examples are given below:
• Young carers; these can be children as young as five or six. This raises capacity and
sharing challenges.
• There are circumstances where two or more people who have specific needs, are caring
for each other. Examples are married couples or an ageing parent and an adult child
with needs. It may well be that one half of the ‘partnership’ may choose to share
91 The Munro Review of Child Protection: Final Report — A child-centred system, DfE, 2011, https://www.education.gov.uk/publications/
standard/publicationDetail/Page1/CM%208062
92 Anonymisation: managing data protection risk code of practice, ICO, 2012 page 35.
43
96
Information: To share or not to share? The Information Governance Review
everything while the other may choose to be exceptionally selective. This creates many
challenges for people involved in their care.
• On becoming an adult, children who lack capacity present a particular issue as their
parents lose the right of intervention unless they have attained a power of attorney, or
are appointed as deputies of the Court of Protection.
• Evidence from the Information Commissioner’s Office is clear that if consent is sought it
should not normally be over-ridden. However for young people and those with parental
responsibility, there is significant scope for opposing views on consent to be presented.
For individual case-work or direct care of children or young people, the general principles
relating to consent are no different to caring for adults. The differences are related to the
overall process. In all cases where consent to share is the appropriate route the process
should be as follows:
• Check the capacity of the child or young person to make the decision.
• If the child/young person has capacity, seek their consent including consent to share
with those with parental responsibilities and act on the decision.
• If the child/young person does not have capacity, it may still be appropriate to seek
their views and if no concerns seek consent of those with parental responsibility.
• If there are concerns, professional judgement needs to be carefully exercised in
accordance with appropriate ethical and process guidance.
10.5 Cross-agency sharing
In order to provide effective care for children, information often needs to be shared
beyond the normal boundaries of health and social care, in particular taking in
organisations such as schools.
The Review Panel found there is some good practice around information sharing between
health and social care services and organisations such as schools, particularly where there
is a lead professional co-ordinating the care of an individual child. However, there is a
great deal of variation in the processes and standards used for sharing information. For
example, the Review Panel heard that poor information sharing was almost always often a
key characteristic when children’s social care systems were found to be unsafe.
The Review Panel concludes that there would be clear benefits if a single, common
approach to sharing information for children and young people could be adopted, that
aligns with the standards set out in this report.
However, there is an added complexity in that children comprise the only aspect of health
and social care policy with two lead government departments — the Department of Health
for children’s health and Department for Education for children’s social care, and a number
of external regulators, including Ofsted and the Care Quality Commission.
The Review Panel concludes that the Department of Health and the Department for
Education should jointly investigate ways to improve the safe sharing of information
between health and social care services and schools and other services relevant to
Children and young people through the adoption of common standards and procedures
for sharing information.
39
97
10 Children and families
Local authorities and their staff face further challenges in information sharing, even when
a legal basis exists and well-established sharing agreements are in place under section 75
of the NHS Act 2006
93
.
Data sharing arrangements can be extremely complex and subject to significant regulation.
There can be difficulties when clients make the transition from children to adult social
care, where different information technology systems impede the sharing of information.
Further complexity is added through the lack of common internal sharing requirements
across different children and family services, youth offending teams, housing and benefits
services. The development of academies and free schools adds another dimension to
consider, as they are not subject to local authority direction and do not have to employ
registered and regulated staff as teachers.
In practice there are two types of cross-agency sharing:
• exchanges of information among teams from different disciplines, both inside and
outside local authorities, to produce a wider ‘welfare’ care plan; and
• linkage of information held by teams from different disciplines, both inside and outside
local authorities, as part of a process of identification of children or ‘families’ for early
help or intervention.
These are considered briefly in the paragraphs that follow.
10.6 Managing and protecting children’s identities
At the time of this review there was a transition in progress in circumstances where
children are adopted. This would see children keeping the same NHS number when they
are adopted with the exception being in circumstances of safeguarding, when a child’s
identity needs to be protected. In these cases a new NHS number may sometimes
be allocated.
The Review Panel concluded that changing of a child’s NHS number should be avoided
wherever possible. Should the NHS number be utilised more widely in children’s social care
services, the current NHS rules and guidelines will need to be reviewed by the Department
of Health and Department for Education.
In addition, in cases where the location and/or the identity of a child needs to be
protected, for example from family members in cases of abuse, ‘shielding requirements’
are placed on the child’s records.
The Review Panel concluded that where ‘shielding requirements’ exist, they must be
shared appropriately as a priority with health and social care professionals whenever
relevant information about the child is shared.
93 http://www.legislation.gov.uk/ukpga/2006/41/section/75
43
98
Information: To share or not to share? The Information Governance Review
10.7 Welfare care plans
The Review Panel has found that care plans for children and young people often extend
beyond the immediate scope of health and social care to include broader welfare
interventions. For the purposes of this report, we refer to these extended plans as
‘welfare care plans’.
Welfare care plans will typically be generated from case conferences involving a range of
professions and agencies, who will, of necessity, and in accordance with best professional
practice and the law, share a range of information pertinent to the planning of care for the
child. This may result in a plan involving a wider range of professions and individuals to
deliver the plan. This could include teachers, teaching assistants, play workers, youth
workers, etc.
They are not part of the health and social care registered and regulated professions, nor
directly under their supervision. But they are critical to successful interventions. In such
cases there is a duty on the relevant health or social care professional taking the lead in
the case to ensure that those delivering the ‘welfare care plan’ are appropriately informed
about the individual.
10.8 Identifying cases for early help or intervention
Government policy is increasingly seeking to use information to identify individuals or
groups of people, such as families, who may benefit from specific help or early
intervention. Generally, the aim of these interventions is to address problems these
individuals and groups may be facing before they can escalate, potentially causing harm to
themselves, their communities, or wider society. Identifying these people often requires
extensive sharing, linkage and analysis of personal confidential data.
The Review Panel heard a variety of concerns about whether this identification work
always complies with data protection, human rights and confidentiality law. On the other
hand, it also heard criticism of healthcare professionals for citing information governance
rules and procedures as reasons for refusing to engage in this work.
The Review Panel concluded that significant lessons regarding data sharing could be
learned from public health and research communities. Additionally there are significant
opportunities arising from the transfer of public health to local authorities to enable
swifter progress on such welfare programmes. We do not suggest that social problems
affecting troubled families or other groups in society are similar to the diseases that
interest directors of public health and research scientists. However the approach to
information governance adopted in public health and research may be helpful.
10.9 Parallels with public health and research
The definitions of ‘prevention’ adopted in the influential study of public health by the
Commission on Chronic Illness
94
could be adapted to include social welfare interventions
[changes in italics]:
94 http://jama.jamanetwork.com/article.aspx?articleid=321887
How to C#: Cleanup Images body of the image, the Shear method can adjust the text body of RasterImage img = new RasterImage(@"F:\input.png"); ImageProcess process = new ImageProcess(img
adding text to a pdf in reader; adding text to pdf online
41
99
10 Children and families
• Primary Prevention, which seeks to decrease the number of new cases of a disorder or
illness or adverse social welfare events such as crimes, exploitation, incidence of
domestic violence etc.
• Secondary Prevention, which seeks to lower the rate of established cases of a disorder
or illness or adverse social welfare events in the population (prevalence).
• Tertiary Prevention, which seeks to decrease the amount of disability and failures of
participation associated with an existing disorder or adverse social welfare situation.
The benefit of viewing social welfare interventions in this way is that the public health and
research communities have developed sophisticated methods for assessing interventions
and managing information governance. Adapting these approaches to social welfare would
allow the development of rigorous, evidence-based social interventions.
The Review Panel concludes that these three levels of prevention are relevant to the
broader social care and public welfare arenas. At the primary prevention level, there are
initiatives seeking to identify individuals or ‘families’ that are displaying, or are highly
likely to display in the absence of intervention, behaviours that have negative implications
for themselves and for society at large. The secondary prevention level is where individuals
or families have come to the attention of the relevant authorities and their needs are
being assessed. This may be through referral, including self-referral, or through an early
identification system. Tertiary prevention is where the individual or group is in receipt of
services or interventions in response to their needs. This may extend well beyond health
and social care, for example reducing the number of people entering the criminal
justice system.
The Review Panel concluded that applying the lessons from research and public health
to this rapidly changing area of social welfare interventions could overcome many of
the perceived information governance barriers.
Professional standards and good practice
The Review Panel concludes that from an information governance perspective there
is a need to ensure that the process of identifying individuals or groups of people for
early intervention or help (as well as the interventions themselves) are properly
underpinned by meeting all the following criteria:
• There is a basis in law for processing personal confidential data.
• There are appropriate approaches to linking data (see sections 3.14, 6.3, 6.5
and 12.6).
• There are appropriate contractual arrangements in place to process de-identified
data for limited disclosure or limited access (see sections 6.3, 6.5 and 12.10 and
appendix 6).
• If help is to be offered, a clear legitimate relationship should exist between
the individual or family identified and the person making contact with them
(see section 3.6).
14
100
Information: To share or not to share? The Information Governance Review
10.10 Information sharing guidance
A range of Information sharing guidance has been produced in the past decade or more.
Some of the guidance deals with broad information sharing needs in a variety of settings,
for example, the material produced by the Information Commissioner’s Office. Other
guidance has been produced relating to specific purposes and settings such as mental
health, missing persons and domestic violence. The cross-government guidance available
on the Department for Education website has been particularly commended to the review
as a good basis for developing updated guidance and advice. Guidance is also available
from the Department of Health website
95
.
95 http://www.education.gov.uk/childrenandyoungpeople/strategy/integratedworking/a0072915/information-sharing
43
101
11 New and emerging technologies
11.1 The virtual consultation
Increasing numbers of patients are benefiting from new technologies that permit ‘virtual
consultations’ with a clinician, using the telephone, emails or video links rather than
relying on a face-to-face contact between a clinician and the patient. These ‘at a distance’
services have the potential to greatly increase patients’ ability to manage their own care,
especially for individuals with specialised or long term conditions.
Data gathered from these virtual consultations can be used to update an existing patient
record and in some instances the data from the virtual consultation becomes a patient
record in its own right
96
. The Review Panel found there is no standard among providers of
virtual consultation services as to how long data gathered from consultations should be
kept, and in practice the decision is left to individual organisational choice.
The Review Panel concluded that, while many providers have policies for giving patients
a copy of communications between professionals about the outcome of a consultation,
there is sometimes a lack of clarity as to how patients can access their actual record.
The Review Panel concluded that providers of direct care services using virtual
consultations should offer patients access to their record and a copy of all ongoing
communications from that record.
The Review Panel also concluded that any provider offering virtual consultation
services should be able to share, when appropriate, relevant digital information from
the patient, with registered and regulated health or social care professionals
responsible for the patient’s care. This includes both written text or numbers and
images, such as photographs.
11.2 Medical devices
There is a rapidly expanding range of medical devices that may use software or other
technologies to record data about a patient when a clinician or other professional is not
present. These devices then make the information available to either the patient, the
professional or both.
These new processes and technologies present some potential challenges for the health
and social care system, raising questions such as:
• How can a health or social care professional be sure that a measurement from a patient
does indeed reflect a biometric measure of the patient and not someone else’s readings?
• Is the patient able effectively to use the device so the result is reliable?
• Is the provider aware that the monitoring service is actually creating a personal record and
hence must conform to all current and future legislative duties around personal records
concerning personal confidential data? Does the provider communicate this to the patient?
96 Where the virtual consultation becomes a record in its own right, a classification for that record and a retention and review policy should be
applied in line with the NHS Records Management Code of Practice. Current Department of Health advice is that electronic records should
be retained indefinitely. This may not be appropriate for virtual consultations, particularly given the likelihood that the service will be
provided by and the data held by a data processor under contract which at some point is likely to come to an end.
17
102
Information: To share or not to share? The Information Governance Review
• Patients may decide on their own initiative to use a monitoring device, rather than
being recommended to do so by a professional. Are they made aware of the terms and
conditions, particularly regarding the use of personal confidential data?
However, the Review Panel concluded that although services based on these new and
emerging technologies may create some operational challenges, they do not require any
additional information governance principles. The personal confidential data gathered
through these new processes and technologies must be treated in exactly the same way as
any other personal confidential data, and providers of these services must adhere to the
existing legislation and best practice on protecting and appropriate sharing of personal
confidential data.
Recommendation 17
The NHS Commissioning Board, clinical commissioning groups and local authorities
must ensure that health and social care services that offer virtual consultations and/
or are dependent on medical devices for biometric monitoring are conforming to best
practice with regard to information governance and will do so in the future.
Documents you may be interested
Documents you may be interested
