Sharing information with the police

The police may ask health and care organisations to provide them with information about patients and service users to support their work. There are times when this information:

• must be provided to the police because the law requires it, for example, information relating to a road traffic accident. You will usually be told of this type of sharing although this will not always be the case
• may be provided to the police because a sufficiently important reason has been given by the police. An example is in relation to the prevention or detection of a serious crime such as an assault where the victim has suffered serious harm. You will usually be asked before your information is shared with the police in these circumstances. However, there are times when it is not appropriate to inform or ask you about the sharing. An example is where asking you would put another person at risk of serious harm. Each request is considered carefully on a case-by-case basis

Where a decision is made to share information with the police, health and care organisations will only share the minimum amount of information they require to investigate or prevent crime. It may be that your address is shared rather than your health and care information. If you attended an out-patients appointment at a particular time, confirmation of this could be shared without details of the treatment you received.

The public interest is generally best served when health and care organisations co-operate with the police as it is necessary to investigate violent crimes, assess the risk of further attacks, and take steps to protect individuals and the public.

Any decisions to disclose confidential patient information must be taken on a case-by-case basis. A clear legal basis must be identified and recorded, and sharing must be in line with professional guidance. There are legal constraints on what information can and should be provided, but this depends on the circumstances. The following will help if you are asked for information by the police.

Make sure you know who is responsible for dealing with police requests

Requests (whether written or verbal) should be processed by trained or experienced staff. If you work in a large organisation, there may be a team who is responsible for managing requests. In smaller organisations there should be an individual who is trained to manage requests.

Read and understand your local policy and procedures which should set out how requests for information from the police should be dealt with, including who is responsible for dealing with them.

Out of hours requests

In some cases, the police may request health and care information out of daytime working hours when they have a suspect in custody who they want to remand to the next available court. In these cases, they may have a short period of time in which to make this decision to detain or release a suspect.

Confidential patient information may be a crucial part of the decision in remand cases, without which remand may not be possible leading to a release of a suspect.

If a decision cannot wait until normal working hours because an individual or wider society is at imminent risk of serious harm, you should try to consult your Caldicott Guardian, if they are available, or a senior clinician who can provide advice and authorise the disclosure of information to the police. If they are unavailable, you should seek advice from the most senior manager on call before making a decision whether to share information.

Local policy and procedures should set out steps for frontline staff detailing what to do if the members of staff who usually deal with requests for information from the police are unavailable.

Where expertise is not available out of hours, and there is an imminent risk of serious harm, you should refer to the When you need to decide whether to provide information to the police section below.

Make sure you know what to do if you are responsible for making a decision

If you are responsible for responding to the police or making a decision about sharing information, it is important that you are prepared in advance of any request.

Decisions on providing information to the police may be:

• in response to a request from the police
• due to an incident which the police should be alerted to for example, reporting knife crime

Remember to seek the expert advice and support you need to make a decision. Decisions about whether to share information with the police may be difficult and need to be thought through carefully. Where possible seek senior advice and support and consider contacting your organisation’s Caldicott Guardian for expert advice (if that is not you).

When you must provide information to the police

Where there is a legal duty to disclose, this means you must provide the necessary and relevant information. You should make sure that any disclosure is required by law and, if necessary, ask the police to confirm the statutory or other legal basis they are relying upon. Also, ensure any disclosure you make is consistent with the guidance published by your professional regulator.

Examples include:

• the Prevention of Terrorism Act (1989) and Terrorism Act (2000). You must inform the police if you have information (including confidential patient information) that may assist them in preventing an act of terrorism or help in apprehending or prosecuting a terrorist
• the Road Traffic Act (1988). You must inform the police, when asked, for any information that might identify any driver who is alleged to have committed an offence under the Act
• the Female Genital Mutilation Act (2003). You must report to the police where it appears that a girl under the age of 18 has been subject to genital mutilation

The police sometimes get court orders to obtain information from organisations or individuals and you must comply with court orders. Where possible you should seek advice from your IG manager, senior clinical managers, Caldicott Guardian, Data Protection Officer (DPO) and/or legal advisors/medical defence organisations where a court order has been served.

Where a court order is ambiguous or appears to require disclosure of too much data, it may be possible to query it with the court. The decision to query a court order needs to be made at an appropriate level of seniority and be actioned as quickly as possible.

When you need to decide whether to provide information to the police

In some cases, the law provides permission for you to disclose information, but you may not be under a legal duty that means that you must disclose the information. In circumstances where you have to decide whether to disclose information you must take into account patient and service user confidentiality.

You therefore have to decide whether the public interest is best served by:

1. Protecting the confidentiality of the patient or service user,
2. Disclosing confidential patient information, or
3. Disclosing information that does not identify a patient or service user but may still assist the police in their inquiries (for example, the location of a violent incident)

To make this decision you will use your professional judgement. You must record your reasons irrespective of whether or not you share information.

Where you seek consent from the person to share information with the police (including where they refuse)

Where the police are making the request, or where you are volunteering information about an adult with capacity, you should generally ask the patient or service user for explicit consent to share confidential patient information with the police.

If a patient or service user refuses consent, the GMC advises that such a refusal should usually be respected (where no one else is at risk of harm). In these situations, the individual should be provided with support to make decisions in their own interests, for example, by arranging contact with agencies which provide help for those experiencing domestic violence. Less intrusive methods of preventing harm should also be considered.

However, you should not ask for consent if you have already decided to share information in the public interest (see ‘Where you decide not to seek consent from the person to share information with the police’).

Professional guidance reflects the difficulty for professionals where adults with capacity refuse disclosure in situations which would put them at risk of serious harm. In relation to disclosures where an individual is considered to be at risk of serious harm, the British Medical Association (BMA) has provided guidance for doctors, which reflects General Medical Council (GMC) guidance on confidentiality and states:

Further guidance on disclosure in these circumstances includes:

• The GMC’s confidentiality guidance
• The BMA's guidance on adults at risk, confidentiality and disclosure of information
• Local Government Association guide on adult safeguarding and domestic abuse.
• Department of Health and Social Care guidance on public interest disclosures.

Where you decide not to seek consent from the person to share information with the police

In some circumstances it may not be safe, practical or appropriate to ask the patient for consent to disclose their confidential patient information. For example:

• if the patient or service user lacks the capacity to make the decision. The GMC’s confidentiality guidance provides further information on disclosures about individuals who lack the capacity to consent
• you have reason to believe that seeking consent could put yourself or others at risk of serious harm. For example, you are treating a child who presented with injuries that suggest potential child abuse. You would not tell the parents that you are informing the police, as this may cause the parents to abscond or flee, potentially placing the child at greater risk of physical or mental harm
• you have reason to believe that seeking consent could undermine the purpose of the disclosure, for example by prejudicing the detection, prevention or prosecution of serious crime or where a failure to share information may expose others to a risk of death or serious harm
• it is not possible to seek consent, because the individual is a missing person (see below)

You should always consider whether you should tell the individual about your intention to disclose personal information, unless it is not safe or practicable to do so. If the individual objects to the disclosure you should consider any reasons they give for objecting.

Be aware of, and abide by, the advice on public interest disclosures provided by your professional regulator (for example, the GMC if you are a doctor). The GMC’s guidance on reporting knife and gunshot wounds advises: "you should use your professional judgement to apply the standards to your day-to-day practice. If you do this, act in good faith and in the interests of patients, you will be able to explain and justify your decisions and actions".

Missing persons

In the case of requests for information relating to individuals that are the subject of a missing persons investigation, it is unlikely to be possible or practical to seek consent of the individual to share information about them with the police.

Any requests to share information with the police about people considered missing will need to be considered on a case-by-case basis.

When making these decisions, you should consult with your Caldicott Guardian if possible and consider the police perspective on the risk of harm to the individual, as well as the health and care perspective regarding balancing the duty of confidentiality and the justification for making a disclosure in the public interest. When making these decisions, you should act in accordance with guidance from regulators for example the GMC guidance on confidentiality.

It is recognised that due to the individual being considered missing, up to date information may be absent which could make it challenging to fully ascertain what their wishes would be. However, you should use your professional judgement and knowledge of the patient or service user, and act in good faith to make decisions about disclosures. You will need to review the most up to date information you have available, and any additional information that the police might share with you (as the Caldicott Guardian or health and care professional depending on the case). Using this information, you will need to make a judgement about the likely wishes of the person at the time they went missing in relation to the disclosure of information to the police and/or whether a disclosure in the public interest is justifiable.

Where you have a reasonable belief that a missing person likely lacks capacity

The BMA’s Mental Health Capacity toolkit provides guidance including when a person lacks capacity, assessing capacity and the freedom to make unwise decisions.

The law presumes that adults have capacity unless there is reason to believe otherwise. However, it should be noted that any view of an individual’s likely capacity from a review of their records and information provided can only ever be provisional without a thorough assessment of the patient or service user themselves. You may find for example that there is historical evidence in the record of developing mental health problems, social stress and/or a record of substance misuse that may suggest their capacity at the time of going missing may have been compromised, even if that wasn’t the case when they were last seen by a health and professional.

If there are sufficient grounds to determine that the individual who has gone missing lacks or is likely to have lacked capacity when they went missing, this is likely to raise concerns about their ongoing safety. You should share information promptly with the police, unless there are grounds for delay or it is not in the best interests of the patient or service user to do so.

Where you have a reasonable belief that a missing person has capacity

In a situation where you have grounds to make a presumption that the missing individual has capacity, noting that this may often be far from clear in a situation where going missing is understood to be out of character for that individual, then your professional judgement and knowledge of the patient or service user and their specific circumstances will be helpful in determining whether a disclosure in the public interest is justifiable.

In cases where a person goes missing, there may be significant uncertainty surrounding the circumstances of their disappearance. There is unlikely to be any clear evidence of the individual’s wishes with regard to sharing information about them that might help in a missing person’s investigation.

There are 3 potential scenarios to consider:

1. Where the person’s disappearance suggests that they are at risk of serious harm

In these circumstances, there may be a concern that the person themselves may be the victim of serious crime that is linked to their disappearance. In these circumstances, and in accordance with guidance from regulators, for example the GMC confidentiality guidance, it is likely that it will be justifiable to make a disclosure to share information which could help to find the individual and prevent serious harm. It is important that the minimum amount of information is shared and strictly limited confidential patient information should only be shared if it has a clear role in helping to find a missing person who is at risk.

2. Where the disappearance is unexplained

Often the fact that a person is missing is likely to mean that there is a significant suspicion that they have come to harm or may be at risk of coming to harm, or further harm. In these circumstances, where a person has not indicated that they do not want to be found, and after consideration of all other relevant factors of the individual case, the course of action should prioritise the potential to prevent serious harm to an individual or the loss of life. In these circumstances, it is likely that it will be justifiable on public interest grounds to share strictly limited confidential patient information with the police if it could assist in finding the person. As above, only the minimum amount of information should be shared.

3. Where there is clear evidence the person wanted to go missing

In some rare cases, a person’s disappearance might be accompanied by clear evidence that they intended to go missing and do not want to be found. In these circumstances if it is also the case that the person is:

• an adult with capacity who is not considered to be at serious risk
• not the suspect of a serious crime
• does not pose a risk to others

It is unlikely to be justifiable to disclose confidential patient information about them to the police (unless a court has ordered disclosure). This is because if an individual is understood to have capacity and is not otherwise at serious risk, that person has a right to go missing and have their confidentiality protected.

General points to consider when responding to any request

The following should be considered when you receive a request from the police and you need to decide whether to share information. The police should provide you with sufficient information to determine if you have a legal basis to disclose the information.

There may be times when it is appropriate to seek additional information to help justify disclosure or, where this is unavailable, challenge a request from the police, for example if you are not sure if an individual or society is at risk of serious harm. You should not feel under pressure to provide confidential patient information and you should never give the police an original health and care record to take away.

The information from the police should include the following:

• the information requested - a clear description of the specific information that is requested.
• the reason for requesting that information - the circumstances of the investigation and why the police are requesting the information.
• why the police think the information requested is necessary and proportionate - you should ensure that the request for information is necessary and proportionate and relevant for the specific inquiry.
• if consent has been obtained - the police request for information should make it clear whether they have sought consent from the individual to share confidential patient information and if not, why not. This could be from someone with parental responsibility or with formal authority to make a decision on behalf of someone who lacks capacity.
• the police’s views on whether there is a public interest justification for sharing confidential patient information in the absence of patient consent - the police request should provide sufficient information on why the disclosure is in the public interest to enable you to determine this. As set out above a disclosure can only be made in the public interest if the benefits to an individual or society outweigh both the patient’s and the public interest in keeping the information confidential. This means that the disclosure must be necessary for the prevention, detection or prosecution of serious crime, especially crimes against the person. Or where the failure to disclose the information may expose others to a risk of death or serious harm

Where time permits, you should seek advice from your Caldicott Guardian, IG lead, medical defence organisation or DPO.

Standardised police 3rd party material request form

The National Police Chiefs’ Council (NPCC) is rolling out a new standardised 3rd party material request form to request 3rd party material. For health and care, 3rd party material includes requests for:

• medical notes, patient summary, GP records, mental health notes
• counselling records
• social service records
• local authorities’ records

The 3rd party material request form is not used to request CCTV footage.

The police can use 3rd party material request form in cases where they are seeking access to material for the purposes of a criminal investigation or prosecution and where the individual (victims and suspects) has an expectation of privacy. The request for information should be to enable the police to pursue a reasonable line of enquiry, relevant to an issue in the case. The 3rd party material request form should be signed by a senior officer (usually an Inspector / Detective Chief Inspector or Police staff equivalent). The 3rd party material request form will not be used where there is a court order.

The 3rd party material request form should ensure that the police provide sufficient information to enable those making decisions to determine whether the disclosure is justified. If the 3rd party material request form is not used by the police to request information that you hold, the form may not yet been rolled out in your area. However, you could request that the 3rd party material request form is used if you are approached by the police. This will help to ensure that you are provided with sufficient information to enable you to determine if you can share confidential patient information to the police.

If you are satisfied that the police have provided you with sufficient information for you to be confident that there is a legal basis for the disclosure without using the 3rd party material request form, you can proceed on that basis.

Police ID check

You should check the identification of the officer requesting the information. The 3rd party material request form includes a section for the officer to provide their details including their warrant number. If the form is not used, you should ensure that you verify the ID of the officer and request the warrant number.

Documenting the information you share

After receiving a request from the police you should document:

• what was requested,
• who the request was from, that you have verified the ID of the officer, and note the warrant number
• what information was given
• what the basis for disclosure was (such as consent, public interest or legal duty)
• a signature from the requester. This can be documented in the health and care record or a log or register of disclosures

Transfer of information to the police

If it is appropriate for you to respond to the police, this should usually be in writing. In an emergency or urgent situation, a verbal response may be provided but this should be followed up in writing as soon as possible.

The majority of police forces use a 3rd party data processor, SFR Medical, to assist with information gathering and report writing, and they are authorised to receive data on the police’s behalf. They currently only deal with requests for medical information, however they are looking to align their scope with the 3rd party material request form.

If you have been asked to provide information either on a CD, DVD, USB or via digital media or email, the files must be encrypted or sent from an NHSmail account or gov.uk account to a police email account. All transfers, including paper, must be to a named individual and be secure. Guidance on secure transfer of information can be found in your organisation’s policies and procedures and/or the Data Security and Protection Toolkit.

It is important your local organisation has a policy in place in relation to disclosures of information to the police and you are able to provide advice to colleagues in the event of a request for information from the police.

Data Protection Act requirements

The UK GDPR and the Data Protection Act 2018 (DPA) set out exemptions from some of the rights and obligations in some circumstances. This includes the prevention and detection of crime (schedule 2 paragraph 2 of the DPA). This enables the work of the police to be exempt from a number of requirements (though not all) where meeting them would undermine work to investigate and prosecute crime. The Information Commissioner’s Office (ICO) has provided guidance on sharing personal data with law enforcement authorities.

Generally, you will be able to rely upon GDPR Article 6(1)(e) [public task] and, where it is necessary to share health information, Article 9(2)(g) [substantial public interest] as the bases for complying with data protection requirements when making a disclosure to the police for them to pursue a reasonable line of enquiry.

Whilst other Acts provide a duty to disclose information in certain circumstances, data protection law does not itself provide a duty to disclose. In addition to compliance with data protection legislation, you need to determine if there is a legal basis for setting aside the duty of confidentiality if confidential patient information is requested by the police (see next section).

Common Law Duty of Confidentiality

There will be times where there is a:

• statutory duty to provide information to the police (see the Guidance for healthcare workers section above)
• legal permission to disclose information to the police that does not amount to a legal duty

In the absence of a statutory duty to disclose confidential patient information to the police:

• the explicit consent of the patient or service user is required, or
• the disclosure would need to be in the public interest
  • to protect individuals or society from risks of serious harm, or
  • for the prevention, detection or prosecution of serious crime, especially crimes against the person

When making disclosure in the public interest, the benefit to an individual or to society must outweigh both the patient’s and the public interest in keeping the information confidential. Your Caldicott Guardian should also be involved so that you can make a shared decision about disclosure.

Health and care professionals will also need to comply with the professional standards set by their regulators. The GMC provide advice on disclosures whether an individual is at risk of serious harm. Their guidance states ‘that in very exceptional circumstances, disclosure without consent may be justified in the public interest to prevent a serious crime such as murder, manslaughter or serious assault even where no one other than the patient is at risk.

This is only likely to be justifiable where there is clear evidence of an imminent risk of serious harm to the individual, and where there are no alternative (and less intrusive) methods of preventing that harm. This is an uncertain area of law and, if practicable, you should seek independent legal advice before making such a disclosure without consent.’ Department of Health guidance is also available on public interest disclosures.

Requests for access to records of deceased individuals

The Access to Health Records Act should not be used as the basis for disclosing information to the police, because the police are not listed as a party who can request access to records of deceased people under the Act.

The duty of confidentiality continues to apply after death so unless you have a legal duty to share information (for example a court order), the disclosure would need to be in the public interest as set out above.

Reviewing and redacting records

Disclosures to the police would still be subject to legal redactions, for example if they contain 3rd party information. This is unless there is a justification for disclosing that information (for example, information about the 3rd party is relevant to the police investigation and disclosure will help protect the patient, the 3rd party or others from serious harm).

In some cases, the police may want to inspect the record at your premises, rather than have a copy sent. In these cases, you should agree on a time for the visit (which should be as soon as possible). Review the record ahead of the visit to ensure that you will not inadvertently disclose information that is irrelevant to police inquiries. Ideally, you should have a clinician available to help the police understand any medical terms or content that might be unfamiliar to them. You should never give the police an original health and care record to take away.

Providing information in a reasonable timeframe

You should respond to police requests in a timely manner (this will vary depending on the amount of information relevant to the enquiry), or within the timeframe stipulated on a court order. If the request is going to take longer than anticipated to respond to, it is advisable to contact the police or court and explain the situation.

In some cases, the police may request medical information out of daytime working hours (see HCP section). You should put in place local policy and procedures which set out what frontline staff should do to respond to urgent police requests out of hours including where individuals or society is at imminent risk of serious harm.

The data subject is also free to make a Subject Access Request (SAR) and share their information with the police in that way. You should not however ask patients or service users to use the SARs process as a way for your organisation to avoid considering and appropriately responding to requests from the police.

Standard 3rd party material request form

The National Police Chiefs’ Council (NPCC) is rolling out a new standardised 3rd party material request form to request 3rd party material including health and care information. This has been developed with input from NHS England, the National Data Guardian and the Information Commissioner’s Office. See the health and care professional section for further information about this and the information which should be included in requests.

Further information

• British Medical Association - Confidentiality and health records toolkit
• Criminal Justice Board - National Guidance for Local Criminal Justice Boards
• General Medical Council - Confidentiality Guidance & Reporting gunshot and knife wounds
• Local Government Association – Guide on adult safeguarding and domestic abuse
• Ministry of Justice – Data Sharing for the Criminal Justice System Guidance
• Nursing & Midwifery Council - The Code - Professional Standards for Nurses, Midwives and Nursing Associates2
• Royal College of Obstetricians & Gynaecologists - Mandatory reporting of FGM
• Royal College of Pathologists - Code of practice and performance standards for forensic pathology