Guidance

Information sharing and suicide prevention: consensus statement

Published 26 August 2021

Applies to England

The Department of Health (DHSC) has produced this statement with:

• Royal College of Psychiatrists
• Royal College of General Practitioners
• Royal College of Nursing
• The Royal College of Midwives
• Institute of Health Visiting
• Directors of Adult Social Services (ADASS)
• The British Association of Social Workers
• The British Psychological Society
• Mental Health Network NHS Confederation

Introduction

The suicide prevention strategy for England places a new emphasis on families bereaved or affected by suicide. This aims to improve information and support for families who are concerned about a relative who may be at risk of suicide and to better support those who have been bereaved by suicide.

We have heard from a number of families bereaved by suicide about their experiences with services, and issues of confidentiality have been a recurring theme. They have repeatedly raised concerns that practitioners can seem reluctant to take information from families and friends or give them information about a person’s suicide risk.

To help address these concerns, this consensus statement for information sharing and suicide prevention was developed and published in 2014. The statement was subsequently updated and republished in 2021, to reflect the current legal position including the implementation of the UK General Data Protection Regulation (UK GDPR).

Confidentiality, consent and capacity are all issues which have rightly received a great deal of careful attention over the years. It is clear that, where the common law duty of confidentiality applies, practitioners will usually be under a duty to respect a person’s refusal to consent to disclosure of their suicide risk, if the person has the relevant capacity and they do not pose a risk to anyone but themselves.

This statement does not change practitioners’ current legal duties of confidentiality in respect of the people they are caring for. It is designed to promote greater sharing of information within the context of the relevant law, and to clarify that this is a matter of professional judgement for an individual practitioner providing care to an individual person.

This statement also does not attempt to reproduce the guidance available to practitioners from their own professional organisations. There will be specific considerations for healthcare professionals such as doctors, nurses, midwives and allied health professionals where the common law duty of confidentiality applies to a practitioner’s interactions with people as their patients. Where the duty does not apply practitioners will have more discretion about what information can be shared without consent. However, professional guidance will always make it clear that the reasons for doing so must be adequate. We would therefore suggest that practitioners read this statement alongside their own professional guidance.

The Zero Suicide Alliance, on behalf of DHSC, has also published guidance for frontline staff on how to use the consensus statement, which aims to support staff regarding when and how to share information about patients where this may help prevent suicide.

The statement applies to adults in England. The situation for children and young people under the age of 18 differs, although the same duties of confidentiality apply when using, sharing or disclosing information about children and young people as about adults. Information can be shared about a child or young person for the purposes of keeping them safe. In practice, this means that practitioners should disclose information to an appropriate person or authority if this is necessary to protect the child or young person from risk of death or serious harm. A decision can be made to share such information with the family and friends where necessary. More detail on information sharing in respect of children and young people for safeguarding purposes can be found in Department for Education statutory guidance on working together to safeguard children.

For brevity, ‘family and friends’ is used throughout this document to include the person or people with whom the individual has a close emotional relationship, which could include carers.

Context

There are clearly times in dealing with a person at risk of suicide when practitioners will need to consider informing the family and friends about aspects of risk and may need to create a channel of communication for both giving and receiving information that will help keep the person safe.

In line with good practice, practitioners should routinely confirm with people whether and how they wish their family and friends to be involved in their care generally, and when looking at information sharing and risk in particular. In order to assist practitioners to respect people’s wishes, wherever possible, the person’s view on who they would wish to be involved – and potentially, who they would wish not to be involved – if there is serious concern over suicide risk, should have been discussed and recorded.

Disclosing information where a duty of confidentiality applies

Capacity to consent

In cases where these discussions have not happened in advance, a practitioner may need to assess whether the person, at least at that time, lacks the capacity to consent to information about their suicide risk being shared. Assessments of mental capacity should be time and decision-specific. The Mental Capacity Act makes it clear that a person must be assumed to have capacity unless it is established that they lack capacity, and that a person is not to be treated as unable to make a decision merely because they make a decision that others consider unwise. However, if a person is at imminent risk of suicide there may well be sufficient doubts about their mental capacity at that time.

In these circumstances, a professional judgement will need to be made, based on an understanding of the person and what would be in their best interests, in accordance with section 4 of the Mental Capacity Act 2005. The practitioner should take into account the person’s previously expressed and current wishes and views in relation to sharing information with their family and/or friends, and, where practicable and appropriate, consult with colleagues. The judgement may be that it is in the person’s best interests to share critical information. If so, care must be taken to disclose only the minimum amount of relevant information that is necessary. If the purpose of the disclosure is to protect a person who lacks the relevant capacity from serious harm, practitioners must disclose relevant confidential information, if it is considered to be in the person’s best interest to do so.

Public interest

Disclosure of confidential information may also be in the public interest because of the far-reaching impact that a suicide can have on others. For example the method of suicide could cause potential serious harm to others. The practitioner will need to make a judgement about whether the benefits to an individual or society in disclosing information without consent outweigh both the individual’s and the public interest in keeping it confidential. Determining where to draw the line is a matter for professional judgement in each individual case.

Disclosing information under data protection law

In addition to any duties of confidentiality, all disclosures of personal information must be fair and lawful under data protection law.

Lawful basis for disclosing

If you decide to share you will need to ensure that, in addition to legal power to share information, and a justification for breaching confidentiality where that applies (see above), there is also a lawful basis for sharing under the UK GDPR. At least one of these must apply whenever you process personal data:

• consent
• contract
• legal obligation
• vital interests (the disclosure of data is necessary to protect someone’s life)
• public task
• legitimate interests

Further information on these lawful bases can be found on the lawful basis for processing information page on the Information Commissioner’s Office (ICO) website.

It should also be noted that any health data being shared would be classed as special category data, which means you will also need to identify a condition for processing special category data under Article 9 of the UK GDPR. Some of these conditions also require you to meet additional conditions and safeguards set out in Schedule 1 of the Data Protection Act (DPA) 2018. This includes the condition of substantial public interest.

Substantial public interest – safeguarding of individuals at risk

An important category of substantial public interest as referred to above allows for disclosure of special category data in limited circumstances without the consent of a person, if that person is considered to be at risk of neglect, or physical, mental or emotional harm.

In order to meet this condition, one of the following must be met:

• consent cannot be given

• there must be a reason why the practitioner cannot be reasonably expected to obtain consent

• obtaining the consent would prejudice the provision of protection from neglect or harm

In addition to the above you need to be able to demonstrate that your specific processing is ‘necessary for reasons of substantial public interest’, on a case-by-case basis. The term ‘substantial public interest’ is not defined in the DPA 2018 or the UK GDPR. However, as the public interest lies in protecting the lives of individuals, particularly in circumstances where they are unable to protect themselves, it is likely that there would be a substantial public interest in sharing data concerning the suicide risk of an individual. If a disclosure can be justified under confidentiality law (see above) it is also likely to meet the ‘substantial public interest test’ under data protection law. Any information shared must be kept to a minimum and limited to only what is necessary.

To rely on this condition, there must be an appropriate policy document in place that outlines compliance measures, procedures and retention policies with respect to any data considered to be special category data, such as health data. This relies on appropriate planning taking place ahead of time.

Further information on this and the other special category conditions can be found on the special category data page on the ICO website.

Information must be shared securely, safely and sensibly. Ensure you are giving accurate, up-to-date and relevant information to the right person and that it is limited to only what is necessary.

Emergency situation

Data protection law does not prevent sharing personal data in an emergency situation, including to protect a person from serious harm, or to prevent the loss of human life. In an emergency, you should share data as is necessary and proportionate. In these situations, it might be more harmful not to share data than to share it. You should factor in the risks involved in not sharing data to your service. The immediacy of the suicide risk will be affected by the degree of planning a person has done, the type of suicide method planned or already attempted, and circumstances such as being left alone, refusing treatment, drinking heavily or drug use. As part of your duty to adhere to the accountability principle in the UK GDPR, you should document the action you took after the event, if you cannot do so at the time.

Views of others

It is also clear that the duty of confidentiality is not a justification for not listening to the views of family members and friends, who may offer insight into the individual’s state of mind or predisposing conditions which can aid care and treatment. Good practice will also include providing families with non-person specific information in their own right, such as how to access services in a crisis, and support services for carers.

Sharing information within and between agencies can also help to manage suicide risk. It is therefore important for practitioners to consider discussing cases with colleagues or seeking advice from legal teams, a professional association or regulatory body if they are unsure whether information should be shared, rather than simply withholding it.

In addition to data protection obligations, practitioners must continue to adhere to any duty they may already have not to reveal a person’s identity. Even when they do not have such a duty in a particular case, if possible, sharing information should be done without revealing a person’s identity. It should be noted that the UK GDPR, the DPA 2018 and the DPA code of Practice only apply to the sharing of information that constitutes personal data. You may continue to share information that does not involve personal data; for example, if an organisation is sharing information that cannot identify anyone (anonymous information; please refer to the ICO website for guidance on anonymisation). Practitioners also need to consider in the particular circumstances whether anonymisation (or not identifying the individual) is an appropriate step to take.

The General Medical Council, Nursing and Midwifery Council, Health and Care Professions Council, and Social Work England have confirmed that the advice and policies set out in this statement are consistent with their regulatory standards and guidance on confidentiality and consent. The ICO has confirmed the content is consistent with the data sharing code of practice.

Consensus statement

We strongly support working closely with families. Obtaining information from and listening to the concerns of families are key factors in determining risk. We recognise however that some people do not wish to share information about themselves or their care. Practitioners should therefore discuss with people how they wish information to be shared, and with whom.

Wherever possible, this should include what should happen if there is serious concern over suicide risk.

We want to emphasise to practitioners that, in dealing with a suicidal person, if they are satisfied that the person lacks capacity to make a decision whether to share information about their suicide risk, they should use their professional judgement to determine what is in the person’s best interests in accordance with section 4 of the Mental Capacity Act 2005.

We also wish to remind practitioners that for the purpose of data protection law, if consent cannot be given, or reasonably expected to be obtained, from an individual considered to be at risk of neglect or harm, or obtaining consent would prejudice the provision of protection from neglect or harm, disclosure without consent may also be made where there is a legal power to share and it is necessary for reasons of substantial public interest.

It is important that the practitioner records their decision about sharing information on each occasion they do so and also the justification for this decision.

Even where a person wishes particular information not to be shared, this does not prevent practitioners from listening to the views of family members, or prevent them from providing general information such as how to access services in a crisis.