1. Reasons for the Policy

• All information about House of Health, particularly patient data, is confidential, whether held electronically or in hard copy.
• Other sensitive information regarding House of Health, such as financial matters, is also confidential.
• Staff members will necessarily have access to such confidential information from time to time.

2. Relevant CQC Fundamental Standard/H+SC Act Regulation (2014)

Regulation 10: “Dignity and Respect.”

3. Applicability

This policy applies to all employees and contractors engaged by House of Health (collectively referred to as ‘members of staff’).

4. Policy

• Members of staff must not under any circumstances disclose patient information to anyone outside House of Health, except to other health professionals on a need-to-know basis, or where the patient has provided written consent, or for legal reasons (e.g., a court order).
• All patient information is confidential, from sensitive diagnoses to the fact of having visited or registered with the organization.
• Members of staff must not disclose any confidential information about House of Health to anyone outside the organization without the express consent of the CQC Registered Manager or their representative.
• Discussions about confidential information should be limited to those who need to know within House of Health.
• The duty of confidentiality owed to individuals under 16 is as significant as that owed to any other individual.
• All patients can expect their personal information will not be disclosed without their permission, except in exceptional circumstances where disclosure is required to protect someone from grave risk of serious harm.
• Electronic transfers of confidential information must be encrypted. Staff must take care that confidential information is not transmitted in error via email or over the internet.
• Members of staff must not remove data from the organization’s computer systems (e.g., on a memory stick or removable drive) off the premises unless authorized to do so.
• Staff who suspect a breach of confidentiality must inform the CQC Registered Manager or their representative immediately.
• Any breach of confidentiality will be treated as a serious disciplinary offense and may lead to dismissal.
• Staff remain bound by the requirement to maintain confidentiality even after leaving employment at House of Health.
• Any breach, or suspected breach, of confidentiality after a staff member has left will be reported to House of Health’s legal team for action.
• Patients wishing to access their own records will be accommodated according to statutory requirements.

5. Responsibilities of Members of Staff

All health professionals must adhere to their professional codes of practice and the law, making every effort to protect confidentiality. No identifiable information about a patient should be shared with anyone outside the organization without the patient’s express permission, except when essential for providing care or protecting someone’s health, safety, or well-being.

Additionally:

• Each health professional is individually accountable for their actions while working together as a team to uphold confidentiality standards and avoid improper disclosures.
• House of Health is responsible for ensuring all staff understand the need for, and maintain, confidentiality.
• The organization has overall responsibility for implementing systems and mechanisms to protect confidentiality.
• All staff members bound by employment contracts or service agreements must not disclose personal information learned during their work to anyone outside House of Health without patient consent, nor discuss any aspect of a patient’s attendance in a manner that could identify the patient, unless necessary for care.

These requirements will be communicated to all staff during their induction.

6. If Disclosure to Third Parties is Necessary

If a patient or another individual is at grave risk of serious harm, the relevant health professional may consult with the CQC Registered Manager or representative, and/or a professional/regulatory body to determine if disclosure without consent is justified. If disclosure is necessary, the patient should be informed prior to disclosure, unless doing so would pose a danger.

Decisions to disclose information to protect health, safety, or well-being will be based on the degree of current or potential harm, rather than the patient’s age. 

Additionally, there may be situations requiring disclosure due to legal processes (e.g., court orders). In cases where the police seek patient information related to serious crime, careful judgment is required, typically needing confirmation from a Director. Medical staff involved are advised to consult their professional indemnity organization before any disclosure.

7. Confidentiality Guidelines for Members of Staff

• Be aware that careless talk can lead to confidentiality breaches; discuss your work only with authorized personnel, preferably in private.
• Always keep confidential documents secure from unauthorized view.
• Verbal reporting about patients should occur privately; if not possible, it should be done quietly to limit the audience.
• When requesting confidential information in overheard circumstances, conduct the conversation as discreetly as possible.
• Provide information over the phone only to the patient or, in the case of minors, their parent or guardian, ensuring confidentiality is maintained.
• The confidentiality owed to individuals under 16 is equal to that owed to adults.
• Prevent unauthorized access to computers through password protection and secure physical measures (e.g., locking doors when offices are unattended). Position screens to minimize visibility to others, and dispose of unwanted paper records safely by shredding.
• If unsure about authorization to disclose, always seek guidance from the CQC Registered Manager or representative before sharing any personal health information.

8. Complaints to ICO

Your Right to Lodge a Complaint with a Supervisory Authority

If you wish to exercise your rights concerning personal data, please contact us at the address provided. If you are dissatisfied with our response, you have the right to lodge a complaint with the supervisory authority.

In the United Kingdom, this authority is: Information Commissioner’s Office

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
(t) 0303 123 1113

(e) casework@ico.org.uk