The Caldicott Principles
Justify the purpose
Justified purposes include provision of care, assuring and improving the quality of care and treatment (clinical audit), investigating complaints and risk management. Medical and health services research is also a justified purpose but in all cases Local Research Ethical approval is required and where information is not anonymised, the patient's explicit consent is required. Teaching that directly involves an individual or their information also requires their explicit consent.
Do not use patient-identifiable information unless it is absolutely necessary
It is necessary to use patient-identifiable information for provision of care. In all other circumstances information should be modified so that some or all of those who might see it are not aware of the individual's identity.
Use the minimum necessary patient-identifiable information
Where use of patient-identifiable information is considered to be essential, each individual item of information should be justified with the aim of reducing identifiability. Ask yourself, do you really need to know that information? If not, don't use it.
Access to patient-identifiable information should be on a strict need to know basis.
Only those individuals who need access to patient-identifiable information should have access to it, and they should only have access to the information items they need to see. In research, when discussing data with a colleague only provide them with the data required for that discussion. Keep information secure to ensure it does not get into the hands of anyone who should not have it, either deliberately or by accident.
Everyone should be aware of their responsibilities
Whilst it is vital that those concerned with the care of individuals have ready access to information required for that care, in return it is important that service users and carers can trust that personal information will be kept confidential, and that their privacy is respected by all carers and researcher alike. It is the Lead Investigator's responsibility to ensure that research teams are aware of, and comply with, the Caldicott Principles.
Understand and comply with the law
By law, all staff have an obligation to safeguard confidentiality of personal information.
Is there anything else I need to know?
In addition to the Caldicott Principles you are required by law to comply with the Data Protection Act 1998 (www.dataprotection.gov.uk)
And finally..........
If you are using personal data for research, remember to inform the Trust's Data Protection Officer. Research that makes use of existing patient-identifiable data (and stored samples) must have the permission of the Caldicott Guardian.
There are a range of statutory provisions that limit or prohibit the use and disclosure of information in specific circumstances. Up to date details can be found on the Department of Health website.