Who on your staff needs which part of a person's record

A care worker who has spent years out on visits moves into the office to coordinate them. Their old work meant the notes for the people on their own round; the new work means planning for everyone the service supports. Which parts of each person's record does it call for now? Access that follows each staff member's work, looked at again as people join, move on or leave, is the subject here. This is information, not legal advice. It covers neither what a record holds nor what families are told.

Start from what each staff member's work calls for

England's National Data Guardian, in its principles on confidential information in health and social care, says that only those who need access to a person's confidential information should have it, and then only to the parts they need to see. In Ireland, HIQA's guidance on information governance for health and social care services says each member of staff should only be able to reach information they have a justifiable need to access. The Office of the Privacy Commissioner of Canada suggests that organisations keep files holding sensitive information where only the employees who need them can reach them.

Make sure everyone knows why it matters

NICE's guideline on people's experience of adult social care services in England recommends that providers make sure the practitioners who work for them are aware of issues around information sharing and confidentiality. Human rights guidance for services in Ireland, from HIQA and Safeguarding Ireland, describes staff recognising that all records and other information about a person are confidential, and that any disclosure they might make respects the person's right to a private life.

Help the person understand what happens to their information

England's National Data Guardian says steps should be taken so that the people a health or social care service supports are not surprised by how and why their confidential information is used and know their choices, with the steps varying by the use. HIQA describes services in Ireland encouraging staff to talk with the people they support, so that those people understand how their information will be used and get their questions answered. The same HIQA guidance gives, as an example, a service in Ireland telling people why their information is needed and who it is shared with. Keeping families informed, with the person's say also carries that point.

Look again when someone joins, moves on or leaves

Ontario's Information and Privacy Commissioner, in Canada, describes health organisations in that province naming who is responsible for giving staff access to health information that fits their job, and setting out how that access is revised or withdrawn once their needs are no longer the same, for example on a new job or on leaving. Ireland's Data Protection Commission describes procedures for people joining, moving and leaving, under which earlier access is looked at again once someone's work is different. The care worker in the opening, moving from visits to the office, is one such change.

Test access against the rules that apply to your service

The bodies named above are Irish, Canadian (national and in Ontario) and English, and their guidance is not stretched here to any other country. Who may see a person's information, and how the person hears about it, rest on the data protection and health information rules where a service operates and on its own policies; none is named here, and nothing here says a practice meets them. Work through those questions with your own policies, your regulator and professional advice where you operate.