Consent and confidentiality

It is important that you get the service user’s permission, or ‘consent’, before you share or disclose their information or use it for reasons which are not related to the care or services you provide for them. There are some exceptions to this and we cover these later in this guidance.

Our Standards of conduct, performance and ethics say that:

You must only disclose confidential information if:
- you have permission;
- the law allows this;
- it is in the service user’s best interests; or
- it is in the public interest, such as if it is necessary to protect public safety or prevent harm to other people. (5.2)

What is consent?

Consent, for the purposes of confidentiality, means that the service user understands and does not object to:

• the information being disclosed or shared;
• the reason for the disclosure;
• the people or organisations the information will be shared with; and
• how the information will be used.

For consent to be valid, it must be voluntary and informed, and the person giving consent must have the capacity to make the decision.

By ‘voluntary’, we mean that the person makes the decision freely and without being persuaded or pressurised by professionals, family, friends or others.

By ‘informed’, we mean that the service user has enough information to make a decision about whether they give their permission for their information to be shared with other people. (This is sometimes called ‘informed consent’.) Service users should be fully aware of why you need to share any information about them, how you will do so, who you will be sharing the information with and how that information will be used. You should also tell them how not giving their permission is likely to affect the care, treatment or services they receive.

By ‘capacity’ we mean a service user’s ability to use and understand information to make a decision and to tell you that decision. We discuss capacity in more detail below.

There are two types of consent for the purposes of confidentiality: express consent and implied consent.

Express consent

This is where you are given specific permission to do something. You need to get express consent if you are using identifiable information for reasons which are not related to the care, treatment or other services you provide for the service user, or in a way which they would not reasonably expect. It is also important to get express consent if a service user has previously objected to you sharing their information with other people. Express consent can be spoken or written.

If the service user has given you their express consent verbally, it is good practice to keep an ongoing, up-to-date record of this in their formal record. This might include a summary of your discussions, the outcomes of those discussions and any decisions made. If you are employed, your employer may use consent forms or have other procedures in place.

Implied consent

This is where consent from the service user is not expressly spoken or written but can be taken as understood, for example because they have agreed to receive treatment, care or other services. If you are using identifiable information to care for a service user or provide services to them, in most circumstances you will have their implied consent. Most service users will understand the importance of sharing information within the multidisciplinary team.

If you are not sure whether you have implied consent, you should always get express consent.

The Data Protection Act deals with the issue of consent.

You can find more information further down in this guidance.

Capacity

You must keep up to date and follow the law in this area. If you are employed you should also take account of your employer’s policies and processes. If you are self-employed or unsure about a specific situation, you should speak to your professional body or get legal advice.

Examples of reasons an adult service user might lack capacity include:

• a mental-health condition;
• dementia;
• severe learning disabilities;
• brain damage, for example from a stroke;
• a physical or mental condition that causes confusion, drowsiness or loss of consciousness; and
• the effects of alcohol or drugs.

You should assume that adult service users have sufficient capacity unless there is significant evidence to suggest otherwise.

Children and young people

For children under 16, you may need to get consent from someone with parental responsibility. This could be:

• the child’s mother or father;
• the child’s legally appointed guardian;
• a person with a residence order for the child;
• a local authority designated to care for the child; or
• a local authority or person with an emergency protection order for the child.

However, some children under 16 can give consent if they can fully understand the information given to them. This is known as ‘Gillick competence’.

You should treat young people (aged 16 and 17) in the same way as adults and presume they have capacity unless there is significant evidence to suggest otherwise.

Making decisions for people who lack capacity

The law surrounding making decisions on behalf of a person who lacks capacity varies among the UK countries.

In England, Wales and Northern Ireland, the law says you must act in the best interests’ of service users. This includes giving service users who have capacity enough information to make sure that they are able to make a decision about whether they will allow you to share their information with other people.

Both the Mental Capacity Act 2005 and the Mental Capacity Act (Northern Ireland) 2016 set out what you should consider when making ‘best interests’ decisions on behalf of someone who lacks capacity.

You should:

• consider all the circumstances relevant to the service user, for example the type of mental health condition or physical illness they have;
• consider whether they are likely to have capacity in the near future and if the decision can be postponed until then;
• involve them as far as possible;
• take account of the beliefs, values, wishes and instructions they expressed when they had capacity; and
• be aware of the views of, for example, their close relatives, carers and guardians.

However, you need to balance the best interests of the service user against other duties. If you have a legal duty to share the information, or need to share it to protect the public interest, you can share it without the consent of the service user. We explain this in more detail in our guidance on disclosing information without consent.

In Scotland, the Adults with Incapacity (Scotland) Act 2000 sets out the principles you must follow when making decisions on behalf of someone without capacity.

• Any action or decision you take must benefit the person and must only be taken when you cannot reasonably achieve that benefit otherwise.
• Any action or decision you take should be the minimum necessary.
• You must take account of the present and past wishes and feelings of the person, as far as possible.
• You should take account of the views of others who have an interest in the person’s welfare.
• You should encourage the person and allow them to make their own decisions and manage their own affairs as much as possible and develop the skills needed to do so.