This information aims to support registrants in understanding how to apply the following Standards of conduct, performance and ethics during the COVID-19 pandemic.
5.1 You must treat information about service users as confidential.
5.2 You must only disclose confidential information if:
- you have permission;
- the law allows this;
- it is in the service user’s best interests; or
- it is in the public interest, such as if it is necessary to protect public safety or prevent harm to other people.
Keeping information secure under pressure
The way you practice will have changed as a result of the pandemic and you may:
- be delivering care and treatment remotely and therefore sharing confidential information in different ways;
- be faced with service users who are unconscious or heavily sedated, and so unable to give their consent to share information; or
- face an increased need to manage media attention and balance promoting your profession and your role in response to COVID-19 with service user confidentiality.
It is important that service users' confidentiality is protected at all times, but we understand that during the COVID-19 pandemic you might sometimes need to depart from established procedures. Our broad approach to regulation during the COVID-19 pandemic, including our recognition of the challenges registrants are likely to face, is outlined in our joint statement from Chief Executives of statutory regulators of health and care professionals.
Data protection and the law
With increased pressures on services, the prompt and efficient sharing of information is all the more important. Data protection should not be seen as a barrier to the vital work you need to do, or your ability to communicate with colleagues and the wider public.
The Information Commissioner’s Office (ICO), the data protection authority in the UK, has outlined that it will take a reasonable and pragmatic approach in its consideration of compliance with data protection during the current COVID-19 pandemic. If you have any questions about the law around data protection, you can visit the ICO’s website or call their helpline on 0303 123 1113. They have also issued a statement on data protection and coronavirus and a data protection and coronavirus information hub.
Our standards are deliberately flexible to allow wider circumstances to be taken into account, and so they will support registrants in sharing information in a proportionate way during the COVID-19 pandemic. By following the principles outlined in the HCPC’s Guidance on confidentiality, you can ensure you are adopting your practise in a way which still meets our standards.
Keeping information safe
We expect you to take all reasonable steps to protect information about service users. What is reasonable will depend on the wider circumstances, and so we recognise this might look different as a result of COVID-19.
Efforts should still be made to ensure records are stored securely and confidential information is only accessed by the appropriate people. If you are speaking to the media, or sharing public health advice, care should be taken not to reveal identifiable information about service users.
Disclosing confidential information
You should only disclose confidential information if you have consent, the law allows this, it is in the service user’s best interests or it is in the public interest.
As far as possible, pressured environments should not prevent you from getting consent from service users. However, where that is not possible – for example as decisions need to be quickly made to minimise the spread of COVID-19 – you will need to be able to justify this in the public interest.
For consent to be valid, it must be voluntary (freely given, without pressure from others) and informed, and the person giving consent must have the capacity to make the decision. You must assume that someone has capacity unless there is significant evidence to suggest otherwise. Further information is set out in our Guidance on confidentiality.
There are still a lot of unknowns in relation to COVID-19 and so you may not be able to give a service user all the information they want. It is important to be open and honest with them about this, and give what information you can in a way they understand.
If you cannot get consent, for example because a service user is unconscious or heavily sedated, or lacks mental capacity, decisions must be made in their best interests in line with relevant mental capacity legislation. The Government has issued guidance on the Mental Capacity Act and COVID-19.
There will also be narrow circumstances where the sharing of this information is permitted by law or as it is in the public interest, including in circumstances where disclosing the information is necessary to prevent a serious crime or serious harm to other people. Preventing the transmission of an infectious disease such as COVID-19 may be considered in the public interest, but you should still try to secure a servicer user’s consent if possible before sharing information.
We would generally advise you seek advice from your employer, trade union or professional body beforehand, or otherwise getting legal advice. However we recognise this may not be possible in an emergency scenario. Any decision to share information without consent should be recorded, so you can evidence the reasons for your decision at a later date if required.
Sharing information with colleagues
Sharing information is part of good practice, and vital when managing the COVID-19 outbreak. NHSX and the Department of Health and Social Care have issued statements to confirm when you use confidential patient information for purposes relating to COVID-19, you can be confident that you are doing so lawfully. You should still take care to ensure you only share information with colleagues where it is necessary, and only disclose information that is relevant.
NHSX have issued information governance guidance in light of COVID-19.
The Department of Health and Social Care has issued several notices under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002.
Additional guidance
If you are employed by an organisation, they are likely to have policies and procedures in place relating to confidentiality. We expect you to practise in line with these and therefore you should seek advice from them on what they expect of you in light of COVID-19. Your professional body may also issue guidance, relevant to your particular profession, on confidentiality.
