{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

Caldicott Principles and Patient Information Policy

1. Purpose

This policy ensures that our care home manages personal and sensitive information in a lawful, ethical, and confidential manner, in accordance with Caldicott Principles, General Data Protection Regulation (GDPR), Data Protection Act 2018, and CQC regulations. Protecting the privacy and dignity of the people we support is a fundamental responsibility, ensuring that their data is used only when necessary and in their best interests. This policy aligns with Regulation 10 – Dignity and Respect​, Regulation 12 – Safe Care and Treatment​, and Regulation 17 – Good Governance​.

2. Scope

This policy applies to all staff members, volunteers, third-party contractors, and anyone handling personal data within our care home. It covers:

• Collection, processing, storage, sharing, and disposal of patient information.
• Confidentiality in verbal, written, and electronic records.
• Compliance with the seven Caldicott Principles to protect individuals’ personal and medical data.
• Responsibilities of the Caldicott Guardian within our organisation.

3. Related Policies

• CH04 – Good Governance Policy (Ensuring appropriate record-keeping and data protection).
• CH08 – Dignity and Respect Policy (Protecting personal information as a component of dignity).
• CH34 – Confidentiality and Data Protection (GDPR) Policy (Managing data access and security).
• CH35 – Duty of Candour Policy (Ensuring transparency when handling incidents involving patient data breaches).
• CH42 – Communication and Engagement with Service Users and Families Policy (Ensuring appropriate information sharing).

4. The Seven Caldicott Principles

We adhere to the Caldicott Principles, ensuring patient information is managed responsibly.

1. Justify the Purpose – We only use patient-identifiable data when necessary. Before using or sharing data, staff must assess why the information is required and document the justification. Audits are conducted to ensure data usage aligns with legal requirements.
2. Use the Minimum Necessary Information – Staff are trained to only access and share the minimum amount of information required to fulfil a task. Access to records is strictly limited, and role-based permissions are enforced.
3. Use Information on a Need-to-Know Basis – Staff must not share personal data unless it is absolutely necessary for the individual’s care or safety. Access to digital and paper records is restricted, and unauthorised disclosure is strictly prohibited.
4. Access to Personal Information Must Be Strictly Controlled – Only authorised staff have access to personal information. The Registered Manager and Data Protection Officer oversee access controls, ensuring strict confidentiality measures are in place.
5. Everyone with Access to Personal Information Must Understand Their Responsibilities – All staff undergo mandatory confidentiality training, ensuring they understand data protection laws and confidentiality obligations. Regular training updates are provided to keep staff aware of changes in legislation.
6. Comply with the Law – Our care home follows GDPR, the Data Protection Act 2018, and CQC regulatory requirements. Policies are reviewed annually to maintain compliance, and Data Protection Impact Assessments (DPIAs) are carried out before implementing new data-processing activities.
7. The Duty to Share Information Can Be as Important as the Duty to Protect It – While data confidentiality is paramount, staff must also share information appropriately when required to safeguard individuals, support their care, or meet legal obligations. Information-sharing decisions must be documented and based on professional judgment.

5. Roles and Responsibilities

• Caldicott Guardian (Data Protection Officer): Oversees patient information security, ensures compliance with Caldicott Principles, and advises staff on best practices.
• Registered Manager: Ensures all staff adhere to this policy, monitors compliance, and liaises with external agencies (e.g., CQC, ICO) when necessary.
• Care Staff: Handle personal information responsibly, maintain confidentiality, and only share data where necessary. Must report any breaches immediately.
• IT and Administration Staff: Maintain secure electronic records and storage, ensuring access control measures are upheld.

6. Information Security and Data Management

To ensure secure collection, storage, and disposal of personal information, we implement the following measures:

• Paper Records: Stored in locked cabinets with access limited to authorised personnel.
• Electronic Records: Stored securely on encrypted servers with role-based access control.
• Email and Digital Communication: Only secure email systems are used for sharing patient-identifiable information. No personal emails are permitted for data transfer.
• Mobile Devices and Laptops: Staff using portable devices must encrypt and password-protect them. Unauthorised removal of patient records from the care home is strictly prohibited.
• Data Retention: Personal records are stored in line with NHS and CQC guidelines and securely destroyed when no longer required.
• Breach Management: All data breaches must be reported to the Data Protection Officer immediately. If necessary, the ICO and affected individuals will be notified within 72 hours, in compliance with GDPR.

7. Information Sharing Protocols

• Information is shared only when necessary and in line with Caldicott Principles and GDPR.
• We obtain explicit consent from the person receiving care (or their legal representative) before sharing information, except where required for safeguarding or legal obligations.
• Multi-agency working is facilitated by secure communication between our care home, NHS, and local authorities, ensuring continuity of care.
• Requests for information from external bodies (e.g., CQC, local authority, NHS) are processed in accordance with legal and ethical considerations.

8. Confidentiality and Staff Training

• All staff sign a Confidentiality Agreement upon joining the organisation.
• Mandatory training on GDPR, Caldicott Principles, and information security is provided.
• Regular audits are conducted to identify any risks related to patient information handling.
• Disciplinary action will be taken against staff members who breach confidentiality protocols.

9. Handling Complaints and Concerns

• If an individual believes their information has been mishandled, they may submit a complaint under the CH14 – Receiving and Acting on Complaints Policy.
• The complaint will be investigated, and appropriate corrective actions will be taken.
• If unresolved, the complaint may be escalated to the Information Commissioner’s Office (ICO) or CQC.

10. Policy Compliance and Monitoring

• The Data Protection Officer and Registered Manager are responsible for ensuring ongoing compliance with this policy.
• Annual audits and staff compliance checks will be carried out to identify and address risks.
• Any non-compliance with this policy will result in corrective actions, further training, or disciplinary action where necessary.

11. Policy Review

This policy will be reviewed annually or sooner if there are legislative changes, new CQC requirements, or updates in data protection regulations.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.