Data Security and Caldicott Guardianship

The 1997 report of the Review of Patient-Identifiable Information, chaired by Dame Fiona Caldicott (the Caldicott Report), made a number of recommendations for regulating the use and transfer of patient-identifiable information between NHS organisations in England and to non-NHS bodies.^1,2
It set out 6 principles to consider when any patient identifiable data is accessed or passed on.

1. Justify the purpose(s) for using confidential information.
2. Only use it when absolutely necessary.
3. Use the minimum that is required.
4. Access should be on a strict need-to-know basis.
5. Everyone must understand his or her responsibilities.
6. Understand and comply with the law.

Larger NHS organisations (and non NHS organisations using the data) need to nominate an appropriate Caldicott guardian to act as the ‘conscience’ of the organisation, who then helps to enable appropriate information sharing whilst ensuring the application of the principles above, and advises on options for lawful and ethical processing of information as required.

Individual general medical and dental practices, pharmacists and opticians do not need to appoint a Caldicott Guardian, but do need to have an Information Governance lead who should be a lead clinician or high level manager, with the knowledge and authority to provide the same role.³

In GP surgeries, the responsibility for making decisions about disclosure ultimately rests with the GP.⁴ Data Protection officers may be available to advise on subject access requests by members of the public, and guidance on dealing with such requests is available on the Department of Health website.