How it works - our duty to share

Are we allowed to share information from your GP record?

“The Caldicott Information Governance review panel found a strong consensus of support among professionals and the public that safe and appropriate sharing in the interests of the individual’s direct care should be the rule, not the exception.”

Caldicott review: information governance in the health and care system

Every minute of every day, staff employed across health and social care services make lawful use of personal confidential data about patients and service users to improve the care those people receive. For the most part, they do so on the legal basis of consent, whether explicit or implied.

How Your Care Connected shares information

Your Care Connected operates on a two-fold consent basis:

Implied consent to share, with explicit consent to view.

This means that the relevant patient information from a patient's record will be made available unless they choose to opt out of sharing completely, but that no one can view this information without the patient's explicit consent when they visit one of the participating organisations (or in instances where the emergency 'break glass' procedure is invoked). 

This model of consent, which we chose after consulting with patients, means that the record is available when it is needed most (e.g. in an emergency and where the patient hasn't opted out), but the power to choose who can see it still rests with the patient where they have the capacity to do so. This was chosen over a full 'opt in' model in order to ensure the benefits of the service were available to as many people as possible.

If a patient chooses to 'opt-out' of Your Care Connected completely, either by returning an opt-out form or by speaking to their practice directly, the information from their record will not be available at all through You Care Connected - even in emergency situations. It is important that patients are made aware of this prior to opting out wherever possible to help them make an informed decision.

To re-enable sharing, the patient would have to visit their practice, as this procedure cannot be done at the secondary care organisation. Similar rules apply if a practice chooses to opt-out of Your Care Connected on behalf of all their patients.

Explicit or implied consent - what's the difference?

Explicit consent

Explicit consent, which is also known as 'express' or 'direct' consent — means that a patient is clearly presented with an option to agree or disagree with the collection, use, or disclosure of personal information.

Implied consent

Implied consent is where a patient’s information has been made available or accessed under the lawful assumption that the patient would be willing to allow it if it is in the interest of their direct care and that they understand how and why their information will be used (for example, when a GP refers you to hospital, you assume they will pass on relevant information through a referral letter).

What is 'direct patient care'?

The Caldicott Review defined it as a clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation of suffering of individuals. It includes supporting individuals' ability to function and improve their participation in life and society. It includes the assurance of safe and high-quality care and treatment through local audit, the management of untoward or adverse incidents, person satisfaction including measurement of outcomes undertaken by one or more registered and regulated health or social care professionals and their team with whom the individual has a legitimate relationship for their care.

Is this legal?

Sharing of patient information for a patient’s direct care, where is it done safely, securely and for the treatment of that patient, is completely legal and covered by data protection and information governance law. The Health and Social Care (Safety and Quality) Act 2015, implemented in October 2015, introduces a new legal duty requiring health and adult social care bodies to share information where this will facilitate care for an individual. According to the Information Governance Alliance's summary of the act:

“The information that is normally shared to support direct care will be confidential personal information and the purpose will clearly facilitate the provision of care so the information must be shared where it is lawful to do so. This means that individuals need to be informed about the proposed sharing and that some form of consent is required. For most types of direct care (where it would be unlikely that an individual would be surprised by the sharing and hasn’t objected) this consent can be implied. Where an individual lacks the capacity to understand about information sharing and give consent information to support their care should be shared in their best interests, but where they have capacity then some form of consent is required. Consideration also needs to be given to what information might need to be shared e.g. information about an individual’s speech, language and communication needs must also be shared where this might facilitate the provision of care”

Sharing based on implied consent is completely legal and actually encouraged for a patient's direct care. Some of the core concepts of sharing in this manner include stating precisely what is being shared and with whom, which we have done in our patient letter, patient information leaflet and on this website.

Dame Fiona Caldicott’s 2013 review of Information Governance provided a clear steer on information sharing that was endorsed by the Government. According to the review, sharing relevant information to support care is essential. The review also found that it is not acceptable that the care a patient or service user receives might be undermined because the different organisations providing  health and care to an individual do not share information effectively. Sharing personal information effectively is a key requirement of good information governance, and many projects, pilots and demonstrators have highlighted how sharing information securely can work for the benefit of patients and service users. You can find the Caldicott 2 report into the sharing of patient information here:

This quick guide on the sharing of patient information, produced by NHS England and in response to Sir Bruce Keogh’s review into urgent and emergency care services, states:

“Information sharing is an important issue for integrated teams to get right. The Health and Social (Safety and Quality) Act 2015, which came into effect on 1st October 2015 sets a duty for information to be shared where it facilitates care for an individual and it is legal to do so. This sharing requires the patient to be informed and provide them with an opportunity to object.”

Please note: The Your Care Connected team do not have access to any personal information, the information is passed directly from your GP to the treating clinician at the hospital, only when you are sat in front of them and have given permission, via a secure network. The person viewing the data must be involved in your direct care and treatment and must have asked for your permission before accessing it (or used the emergency break glass procedure in the event of an emergency).

Further information

Sharing information to improve the care your receive in Birmingham, Sandwell & Solihull © 2018 Your Care Connected