Child Protection and Youth at Risk Documents
Storage of Police Information - What to do if you receive information from the Police about patients (Including CYP forms) (04/04/05)
- don't scan
- develop practice policy* for how to store and communicate this information to necessary clinicians
- think about how to communicate this information when the records leave the practice
(* We are indebted to Dr Mansbridge's practice in Southampton who has allowed us to share their practice protocol document should you wish to use it. Click here )
This information should probably not have been shared with you without the explicit and valid legal consent of the young person concerned, unless it was absolutely essential to protect the patient, or some other person, from serious harm.
Very occasionally it may be essential to share the minimum data that will serve a legal purpose in order to draw attention to a serious danger to the patient or to family members or to practice staff. This data may be shared without consent if necessary. However, the reason for the data sharing in such circumstances should be spelt out very clearly in order to fulfil the specific and valid purpose of providing an adequate warning.
If the young person had been informed as to what data would be shared, with whom and for what purpose, and had consented on that basis, then it would be permissible. If this is not the case then there has almost certainly been a breach of data protection, human rights legislation and/or the common law duty of confidentiality.
It is not appropriate to include data about offences in the medical records, unless it is specifically required to inform the medical care of that patient or is essential to protect any other person. If the data is to be retained it should generally be filed separately and then destroyed as soon as it has served the valid legal purpose for which it was shared in the first place.
Should you inadvertently disclose police information that you have filed in the records, you would potentially be in breach of the data protection act, human rights legislation and/or the common law duty of confidentiality.
The LMC has concerns about some of the data sharing that occurs in relation to the welfare of children and young persons. There must always be a good reason for sharing data without valid legal consent. It should never be a routine 'knee jerk' response.
When GPs are asked to share medical data with social services, the police or other professionals working with patients, the doctor has a very strict professional and legal duty of confidentiality. He or she may only share data with someone who shares the same duty of confidentiality. Sadly some non-medical professionals have a somewhat tenuous grasp of the legal and professional obligations of confidentiality!
It is very unlikely that routine and unnecessary data sharing will protect children or young people. It is more likely to contribute to data overload, when important information gets overlooked or lost in a mass of extraneous material. Intelligent data sharing for a specific purpose, with a specific person who has a legal duty to act on that information, and who will act promptly and effectively on that information, is much more likely to protect vulnerable children and young people.
Doctors must share data as and when it is important to do so, not just because of a generally held belief that data sharing is a good idea. It is a good idea, but only if applied intelligently!
For example, the GMC has advised that no part of the Children Act 'requires' the disclosure of data without consent. This does not mean that doctors should never share data in order to protect children, but rather that they must always share sufficient data promptly but only when it is necessary and appropriate to do so.
A doctor may be required to defend any inappropriate disclosure in the courts, or in an NHS or GMC disciplinary procedure. This tends to concentrate the mind when making each individual decision to share data with a third party! If the decision is finely balanced the doctor should always err in favour of protecting a child or young person, rather than protecting the data.
Footnote - Sensitive personal data may include any data relating to "the commission or alleged commission by him of any offence, or any proceedings for any offence committed or alleged to have been committed by him, the disposal of such proceedings or the sentence of any court in such proceedings."
The data provided by the police in this situation would therefore be classified as 'sensitive data' in the Data Protection Act and must be processed according to all of the Data Protection principles set out in Schedule 1. This includes the condition that it may only be processed if it fulfils at least one condition from Schedule 2 and one condition from Schedule 3. The only conditions in Schedule 2 & 3 that would seem to apply to 'routine' information of this sort relate to the need for consent to the processing. Schedule 3 sets out that for sensitive data this consent must be explicit.
We believe therefore that you would have to seek the patient's explicit consent before filing this data in the medical record, unless exceptional circumstances allowed the processing according to the conditions set out in schedules 2 and 3.
CED
