It is important that you get the service user’s permission, or ‘consent’, before you share or disclose their information or use it for reasons which are not related to the care or services you provide for them. There are some exceptions to this and we cover these later in this guidance.
Our standards of conduct, performance and ethics say that:
You must only disclose confidential information if:
- you have permission;
- the law allows this;
- it is in the service user’s best interests; or
- it is in the public interest, such as if it is necessary to protect public safety or prevent harm to other people. (5.2)
Consent, for the purposes of confidentiality, means that the service user understands and does not object to:
For consent to be valid, it must be voluntary and informed, and the person giving consent must have the capacity to make the decision.
By ‘voluntary’, we mean that the person makes the decision freely and without being persuaded or pressurised by professionals, family, friends or others.
By ‘informed’, we mean that the service user has enough information to make a decision about whether they give their permission for their information to be shared with other people. (This is sometimes called ‘informed consent’.) Service users should be fully aware of why you need to share any information about them, how you will do so, who you will be sharing the information with and how that information will be used. You should also tell them how not giving their permission is likely to affect the care, treatment or services they receive.
By ‘capacity’ we mean a service user’s ability to use and understand information to make a decision and to tell you that decision. We discuss capacity in more detail below.
There are two types of consent for the purposes of confidentiality: express consent and implied consent.
Express consent
This is where you are given specific permission to do something. You need to get express consent if you are using identifiable information for reasons which are not related to the care, treatment or other services you provide for the service user, or in a way which they would not reasonably expect. It is also important to get express consent if a service user has previously objected to you sharing their information with other people. Express consent can be spoken or written.
If the service user has given you their express consent verbally, it is good practice to keep an ongoing, up-to-date record of this in their formal record. This might include a summary of your discussions, the outcomes of those discussions and any decisions made. If you are employed, your employer may use consent forms or have other procedures in place.
Implied consent
This is where consent from the service user is not expressly spoken or written but can be taken as understood, for example because they have agreed to receive treatment, care or other services. If you are using identifiable information to care for a service user or provide services to them, in most circumstances you will have their implied consent. Most service users will understand the importance of sharing information within the multidisciplinary team.
If you are not sure whether you have implied consent, you should always get express consent.
The Data Protection Act deals with the issue of consent.
You can find more information further down in this guidance.
You must keep up to date and follow the law in this area. If you are employed you should also take account of your employer’s policies and processes. If you are self-employed or unsure about a specific situation, you should speak to your professional body or get legal advice.
Examples of reasons an adult service user might lack capacity include:
You should assume that adult service users have sufficient capacity unless there is significant evidence to suggest otherwise.
Children and young people
For children under 16, you may need to get consent from someone with parental responsibility. This could be:
However, some children under 16 can give consent if they can fully understand the information given to them. This is known as ‘Gillick competence’.
You should treat young people (aged 16 and 17) in the same way as adults and presume they have capacity unless there is significant evidence to suggest otherwise.
Making decisions for people who lack capacity
The law surrounding making decisions on behalf of a person who lacks capacity varies among the UK countries.
In England, Wales and Northern Ireland, the law says you must act in the best interests’ of service users. This includes giving service users who have capacity enough information to make sure that they are able to make a decision about whether they will allow you to share their information with other people.
Both the Mental Capacity Act 2005 and the Mental Capacity Act (Northern Ireland) 2016 set out what you should consider when making ‘best interests’ decisions on behalf of someone who lacks capacity.
However, you need to balance the best interests of the service user against other duties. If you have a legal duty to share the information, or need to share it to protect the public interest, you can share it without the consent of the service user. We explain this in more detail in our guidance on disclosing information without consent.
In Scotland, the Adults with Incapacity (Scotland) Act 2000 sets out the principles you must follow when making decisions on behalf of someone without capacity.