In the professional world of Arun Dhandayudham, the judicious sharing of service users’ sensitive personal data is frequent and appropriate. Arun is medical director and interim joint CEO of WDP (previously known as the Westminster Drug Partnership), a third sector provider of drug and alcohol treatment and recovery services in London, the south-east and east of England.
The charity has about 20,000 people on its books—some on substance misuse programmes in prison or in the community, others using in-patient detox and rehabilitation facilities. In addition to sharing information with staff caring for an individual in the NHS and social services, WDP must often share appropriate patient identi able data with the prison service, probation and other parts of the criminal justice system.
As Caldicott Guardian, Arun has an important role in deciding when it is appropriate to share. About half of the charity’s service users come via the criminal justice system. On arrival they usually already have an assigned probation officer who is entitled to keep in touch with how treatment is progressing. The charity has its own criminal justice workers, some co-located in probation service offices, with authority to input some information into probation IT systems.
As well as being medical director and interim joint CEO, Arun is also responsible for IT and so all the important decisions about hardware and software also come to him. He regards this combination of responsibilities as one of the great benefits of working in an organisation with a turnover of tens of millions, not hundreds of millions. He says: “It is very different from the NHS where everything operates in silos. Here we can work holistically. For example, I look at the security of patient information from end to end. I am responsible for the location and cyber-security of our servers and hardware as well as for the information governance that regulates the behaviour of our 400 staff and hundreds of volunteers.”
Such matters can be planned, but other questions arise urgently. Sometimes there are cases involving the police asking for information about whether a particular service user was using their facilities at a particular time. “We ask the police why they would want to know. The answer determines the flow of information. The more serious the need for information (such as a homicide investigation), the more likely it is that we will provide the requested information.
Substance misuse services are commonly provided on contracts that are re-tendered after 3-5 years. Issues arise when a new contractor takes over from another. What happens to the service users’ records? In some areas they are owned by the commissioner and the new provider has to make arrangements to gain access. In other areas the records are owned by the previous provider and negotiations to gain access may be more complex. A balance has to be struck between protection of confidentiality and maintaining continuity of care without compromising quality and safety. In such circumstances it is the Caldicott Guardian’s job to oversee the drawing up of information sharing agreements.
Arun does not have a deputy Caldicott Guardian. When he is on leave, urgent questions can be referred to a senior colleague, who is well versed in data protection and Caldicott principles. Advice can also be sought from the legal team. Arun keeps a log of all Caldicott Guardian decisions.