Sharing information with the police guidance for health and care professionals

The public interest is generally best served when health and care organisations co-operate with the police as it is necessary to investigate violent crimes, assess the risk of further attacks, and take steps to protect individuals and the public.

Any decisions to disclose confidential patient information must be taken on a case by case basis. A clear legal basis must be identified and recorded, and sharing must be in line with professional guidance. There are legal constraints on what information can and should be provided, but this depends on the circumstances. The following will help if you are asked for information by the police.

Requests (whether written or verbal) should be processed by trained or experienced staff. If you work in a large organisation, there may be a team who is responsible for managing requests. In smaller organisations there should be an individual who is trained to manage requests.

Read and understand your local policy and procedures which should set out how requests for information from the police should be dealt with, including who is responsible for dealing with them.

In some cases, the police may request health and care information out of daytime working hours when they have a suspect in custody who they want to remand to the next available court. In these cases, they may have a short period of time in which to make this decision to detain or release a suspect.

Confidential patient information may be a crucial part of the decision in remand cases, without which remand may not be possible leading to a release of a suspect.

If a decision cannot wait until normal working hours because an individual or wider society is at imminent risk of serious harm, you should try to consult your Caldicott Guardian, if they are available, or a senior clinician who can provide advice and authorise the disclosure of information to the police. If they are unavailable, you should seek advice from the most senior manager on call before making a decision whether to share information.

Local policy and procedures should set out steps for frontline staff detailing what to do if the members of staff who usually deal with requests for information from the police are unavailable.

Where expertise is not available out of hours, and there is an imminent risk of serious harm, you should refer to the when you need to decide whether to provide information to the police section. 

If you are responsible for responding to the police or making a decision about sharing information, it is important that you are prepared in advance of any request.

Decisions on providing information to the police may be:

• in response to a request from the police
• due to an incident which the police should be alerted to for example, reporting knife crime

Remember to seek the expert advice and support you need to make a decision. Decisions about whether to share information with the police may be difficult and need to be thought through carefully. Where possible seek senior advice and support and consider contacting your organisation’s Caldicott Guardian for expert advice (if that is not you).

Where there is a legal duty to disclose, this means you must provide the necessary and relevant information. You should make sure that any disclosure is required by law and, if necessary, ask the police to confirm the statutory or other legal basis they are relying upon. Also, ensure any disclosure you make is consistent with the guidance published by your professional regulator.

Examples include:

• the Prevention of Terrorism Act (1989) and Terrorism Act (2000). You must inform the police if you have information (including confidential patient information) that may assist them in preventing an act of terrorism or help in apprehending or prosecuting a terrorist
• the Road Traffic Act (1988). You must inform the police, when asked, for any information that might identify any driver who is alleged to have committed an offence under the Act
• the Female Genital Mutilation Act (2003). You must report to the police where it appears that a girl under the age of 18 has been subject to genital mutilation

The police sometimes get court orders to obtain information from organisations or individuals and you must comply with court orders. Where possible you should seek advice from your IG manager, senior clinical managers, Caldicott Guardian, Data Protection Officer (DPO) and/or legal advisors/medical defence organisations where a court order has been served.

Where a court order is ambiguous or appears to require disclosure of too much data, it may be possible to query it with the court. The decision to query a court order needs to be made at an appropriate level of seniority and be actioned as quickly as possible.

In some cases, the law provides permission for you to disclose information, but you may not be under a legal duty that means that you must disclose the information. In circumstances where you have to decide whether to disclose information you must take into account patient and service user confidentiality.

You therefore have to decide whether the public interest is best served by:

1. Protecting the confidentiality of the patient or service user,
2. Disclosing confidential patient information, or
3. Disclosing information that does not identify a patient or service user but may still assist the police in their inquiries (for example, the location of a violent incident)

To make this decision you will use your professional judgement. You must record your reasons irrespective of whether or not you share information.

Where the police are making the request, or where you are volunteering information about an adult with capacity, you should generally ask the patient or service user for explicit consent to share confidential patient information with the police.

If a patient or service user refuses consent, the GMC advises that such a refusal should usually be respected (where no one else is at risk of harm). In these situations, the individual should be provided with support to make decisions in their own interests, for example, by arranging contact with agencies which provide help for those experiencing domestic violence. Less intrusive methods of preventing harm should also be considered.

However, you should not ask for consent if you have already decided to share information in the public interest (see ‘Where you decide not to seek consent from the person to share information with the police’).

Professional guidance reflects the difficulty for professionals where adults with capacity refuse disclosure in situations which would put them at risk of serious harm. In relation to disclosures where an individual is considered to be at risk of serious harm, the British Medical Association (BMA) has provided guidance for doctors, which reflects General Medical Council (GMC) guidance on confidentiality and states:

In some circumstances it may not be safe, practical or appropriate to ask the patient for consent to disclose their confidential patient information. For example:

• if the patient or service user lacks the capacity to make the decision. The GMC’s confidentiality guidance provides further information on disclosures about individuals who lack the capacity to consent
• you have reason to believe that seeking consent could put yourself or others at risk of serious harm. For example, you are treating a child who presented with injuries that suggest potential child abuse. You would not tell the parents that you are informing the police, as this may cause the parents to abscond or flee, potentially placing the child at greater risk of physical or mental harm
• you have reason to believe that seeking consent could undermine the purpose of the disclosure, for example by prejudicing the detection, prevention or prosecution of serious crime or where a failure to share information may expose others to a risk of death or serious harm
• it is not possible to seek consent, because the individual is a missing person
• You should always consider whether you should tell the individual about your intention to disclose personal information, unless it is not safe or practicable to do so. If the individual objects to the disclosure you should consider any reasons they give for objecting.

Be aware of, and abide by, the advice on public interest disclosures provided by your professional regulator (for example, the GMC if you are a doctor). The GMC’s guidance on reporting knife and gunshot wounds advises: "you should use your professional judgement to apply the standards to your day-to-day practice. If you do this, act in good faith and in the interests of patients, you will be able to explain and justify your decisions and actions".

In the case of requests for information relating to individuals that are the subject of a missing persons investigation, it is unlikely to be possible or practical to seek consent of the individual to share information about them with the police.

Any requests to share information with the police about people considered missing will need to be considered on a case-by-case basis.

When making these decisions, you should consult with your Caldicott Guardian if possible and consider the police perspective on the risk of harm to the individual, as well as the health and care perspective regarding balancing the duty of confidentiality and the justification for making a disclosure in the public interest. When making these decisions, you should act in accordance with guidance from regulators for example the GMC guidance on confidentiality.

It is recognised that due to the individual being considered missing, up to date information may be absent which could make it challenging to fully ascertain what their wishes would be. However, you should use your professional judgement and knowledge of the patient or service user, and act in good faith to make decisions about disclosures. You will need to review the most up to date information you have available, and any additional information that the police might share with you (as the Caldicott Guardian or health and care professional depending on the case). Using this information, you will need to make a judgement about the likely wishes of the person at the time they went missing in relation to the disclosure of information to the police and/or whether a disclosure in the public interest is justifiable.

The BMA’s Mental Capacity toolkit provides guidance including when a person lacks capacity, assessing capacity and the freedom to make unwise decisions.

The law presumes that adults have capacity unless there is reason to believe otherwise. However, it should be noted that any view of an individual’s likely capacity from a review of their records and information provided can only ever be provisional without a thorough assessment of the patient or service user themselves. You may find for example that there is historical evidence in the record of developing mental health problems, social stress and/or a record of substance misuse that may suggest their capacity at the time of going missing may have been compromised, even if that wasn’t the case when they were last seen by a health and professional.

If there are sufficient grounds to determine that the individual who has gone missing lacks or is likely to have lacked capacity when they went missing, this is likely to raise concerns about their ongoing safety. You should share information promptly with the police, unless there are grounds for delay or it is not in the best interests of the patient or service user to do so.

In a situation where you have grounds to make a presumption that the missing individual has capacity, noting that this may often be far from clear in a situation where going missing is understood to be out of character for that individual, then your professional judgement and knowledge of the patient or service user and their specific circumstances will be helpful in determining whether a disclosure in the public interest is justifiable.

In cases where a person goes missing, there may be significant uncertainty surrounding the circumstances of their disappearance. There is unlikely to be any clear evidence of the individual’s wishes with regard to sharing information about them that might help in a missing person’s investigation.

There are 3 potential scenarios to consider:

The following should be considered when you receive a request from the police and you need to decide whether to share information. The police should provide you with sufficient information to determine if you have a legal basis to disclose the information.

There may be times when it is appropriate to seek additional information to help justify disclosure or, where this is unavailable, challenge a request from the police, for example if you are not sure if an individual or society is at risk of serious harm. You should not feel under pressure to provide confidential patient information and you should never give the police an original health and care record to take away.

The information from the police should include the following:

• the information requested - a clear description of the specific information that is requested.
• the reason for requesting that information - the circumstances of the investigation and why the police are requesting the information.
• why the police think the information requested is necessary and proportionate - you should ensure that the request for information is necessary and proportionate and relevant for the specific inquiry.
• if consent has been obtained - the police request for information should make it clear whether they have sought consent from the individual to share confidential patient information and if not, why not. This could be from someone with parental responsibility or with formal authority to make a decision on behalf of someone who lacks capacity.
• the police’s views on whether there is a public interest justification for sharing confidential patient information in the absence of patient consent - the police request should provide sufficient information on why the disclosure is in the public interest to enable you to determine this. As set out above a disclosure can only be made in the public interest if the benefits to an individual or society outweigh both the patient’s and the public interest in keeping the information confidential. This means that the disclosure must be necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person. Or where the failure to disclose the information may expose others to a risk of death or serious harm

Where time permits, you should seek advice from your Caldicott Guardian, IG lead, medical defence organisation or DPO.

The National Police Chiefs’ Council (NPCC) is rolling out a new standardised 3rd party material request form to request 3rd party material. For health and care, 3rd party material includes requests for:

• medical notes, patient summary, GP records, mental health notes
• counselling records
• social service records
• local authorities’ records

The 3rd party material request form is not used to request CCTV footage.

The police can use 3rd party material request form in cases where they are seeking access to material for the purposes of a criminal investigation or prosecution and where the individual (victims and suspects) has an expectation of privacy. The request for information should be to enable the police to pursue a reasonable line of enquiry, relevant to an issue in the case. The 3rd party material request form should be signed by a senior officer (usually an Inspector / Detective Chief Inspector or Police staff equivalent). The 3rd party material request form will not be used where there is a court order.

The 3rd party material request form should ensure that the police provide sufficient information to enable those making decisions to determine whether the disclosure is justified. If the 3rd party material request form is not used by the police to request information that you hold, the form may not yet been rolled out in your area. However, you could request that the 3rd party material request form is used if you are approached by the police. This will help to ensure that you are provided with sufficient information to enable you to determine if you can share confidential patient information to the police.

If you are satisfied that the police have provided you with sufficient information for you to be confident that there is a legal basis for the disclosure without using the 3rd party material request form, you can proceed on that basis.

You should check the identification of the officer requesting the information. The 3rd party material request form includes a section for the officer to provide their details including their warrant number. If the form is not used, you should ensure that you verify the ID of the officer and request the warrant number.

After receiving a request from the police you should document:

• what was requested,
• who the request was from, that you have verified the ID of the officer, and note the warrant number
• what information was given
• what the basis for disclosure was (such as consent, public interest or legal duty)
• a signature from the requester. This can be documented in the health and care record or a log or register of disclosures

If it is appropriate for you to respond to the police, this should usually be in writing. In an emergency or urgent situation, a verbal response may be provided but this should be followed up in writing as soon as possible.

The majority of police forces use a 3rd party data processor, SFR Medical, to assist with information gathering and report writing, and they are authorised to receive data on the police’s behalf. They currently only deal with requests for medical information, however they are looking to align their scope with the 3rd party material request form.

If you have been asked to provide information either on a CD, DVD, USB or via digital media or email, the files must be encrypted or sent from an NHSmail account or gov.uk account to a police email account. All transfers, including paper, must be to a named individual and be secure. Guidance on secure transfer of information can be found in your organisation’s policies and procedures and/or the Data Security and Protection Toolkit.