Inquiries, reviews, investigations and court orders in health and social care services guidance for health and care professionals

There may be times when public inquiries, reviews, investigations, or law courts request to see the health and care records that you hold for individuals in your care. It is important to comply with these requests and you must work with your information governance (IG) team, senior staff or Caldicott Guardian to respond to them so that information is shared in a lawful way.

Where records are requested, they must not be altered, amended or disposed of, so those dealing with the review, inquiry, investigation or court order know they are accessing the original, genuine records.

Statutory public inquiries are established to investigate issues of serious public concern. A statutory public inquiry has legal powers to require information. You must comply with any formal request that you receive from a statutory public inquiry or explain to the inquiry why you cannot provide the information requested, for example, you do not hold the requested information.

Where the disclosure of personal or confidential information is in response to a formal request for information from a statutory public inquiry, data protection laws will not be breached. In addition, patient or service user consent is not required because the statutory public inquiry has legal powers to require the information. See the information governance (IG) professionals’ section for more information.

If you have any concerns or questions regarding the request from the statutory public inquiry, are not sure if the inquiry is a legitimate public inquiry or you are unsure how to answer a question from a patient or service user you should engage with your IG team, senior staff or Caldicott Guardian.

Non-statutory public inquires, investigations and reviews related to patient safety are often instigated when:

• something has gone wrong
• something may have gone wrong – a near miss incident
• there is a desire to learn more about the safety of a service in order to support improvement in the safety of care

These inquiries, reviews and investigations may be:

• internal, for example a hospital board could conduct an internal investigation following an increased number of deaths in one of its departments, or
• external, for example a safeguarding board may undertake an external review to investigate safeguarding concerns in relation to patients within your organisation

Whether the request for information comes from an internal or external source, if the purpose of the request is to learn lessons to improve patient safety and prevent serious harm or death, it is important that you share it, even across organisational boundaries. You should consider any requests for information on a case by case basis.

Non-statutory public inquiries, independent reviews or investigations allow a level of independence. This can help to ensure that the findings are accurate, unbiased, and objective, or allow for an investigation to take place across multiple services and organisations. The independence comes from the review or investigation being commissioned and conducted by a team which is not part of or affiliated with the organisation(s) related to the incident. An example is the independent investigation into East Kent Maternity and Neonatal Services.

Where confidential information needs to be shared for non-statutory public inquiries, reviews or investigations related to patient safety you should engage with your IG team, senior staff or Caldicott Guardian before sharing information.

Some inquiries and reviews will relate to aspects of health and care that are not about the safety of patients. An example is the independent review of NHS hospital food. It is less likely that this type of review or inquiry will request confidential information. However, it is possible that such a request will be made. In these circumstances you should check with your IG team, senior staff or Caldicott Guardian before sharing information.

There are 4 main types of court in the English justice system:

• criminal
• civil
• family
• coroner’s

Each of these courts may request information from health and care organisations. A request like this is called a court order. A judge can request any information they see as relevant to a case, and you are legally obliged to comply by providing exactly the information requested within the court order. The information should be supplied unredacted, and in its original format where possible, to avoid any doubt about its authenticity.

You will always comply with data protection laws by following a court order. If you cannot comply with the court order, because for example you do not hold the information requested, or you consider the request to be in error or irrelevant, you can work with your IG team, senior staff or Caldicott Guardian to apply to the court to set aside the order. You will need to comply with the subsequent decision made by the judge.

Court orders will usually specify a date when you must present the requested information to the court by or explain why it is not available.