Based on preliminary engagement undertaken by the National Data Guardian prior to issuing this consultation, she believes that the existing Caldicott Principles still remain useful and relevant but may benefit from some amendments to ensure they are clear and accessible.

 The NDG is also proposing to introduce a new principle, which emphasises the importance of there being no surprises for patients and service users with regard to the use of their confidential information. The new proposed principle is listed below as principle 8.  

These principles apply to the use of and access to confidential information within health and social care organisations, from health and social care organisations to other organisations and between individuals.  Where a novel and/or difficult judgement or decision is required, you should involve your Caldicott Guardian.

Where the term ‘confidential information’ is used in these principles, this means all information collected for the provision of health and social care services where patients and service users would expect that it will be kept private.  This may include for instance, details about symptoms, diagnosis, treatment, names and addresses. In some instances the principles should also be applied to the processing of staff information.                              
                     
 Principle 1 - Justify the purpose(s) for using confidential information. Every proposed use or transfer of confidential information must be clearly defined, scrutinised and documented, with continuing uses regularly reviewed, and decided upon by an appropriate guardian.                      
                         
 Principle 2 - Use confidential information only when it is necessary. Confidential information should not be included unless it is necessary for the specified purpose(s) of the use and access to that information. The need for patients and service users to be identified should be considered at each stage of satisfying the purpose(s).                              
           
Principle 3 - Use the minimum necessary confidential information. Where use of confidential information is considered to be necessary, each individual item of information must be considered and justified so that only the minimum amount of confidential information is included as is necessary for a given function to be carried out.                    
                                           
Principle 4 - Access to confidential information should be on a strict need-to-know basis. Only those individuals who need access to confidential information should have access to it, and they should only have access to the information items that they need to see. This may mean introducing access controls or splitting information flows where one information flow is used for several purposes.  

Principle 5 - Everyone with access to confidential information should be aware of their responsibilities. Action should be taken by organisations and individuals to ensure that all those handling confidential information are aware of their responsibilities and obligations to respect the confidentiality of patients and service users.    

Principle 6 - Comply with the law. Every use of confidential information must be lawful. All those handling confidential information are responsible for ensuring that the use of, and access to, that information complies with legal requirements set out in statute and under the common law.                  

Principle 7 - The duty to share information for direct care is as important as the duty to protect patient confidentiality. Health and social care professionals should have the confidence to share information in the best interests of patients and service users within the framework set out by these principles. They should be supported by the policies of their employers, regulators and professional bodies.                        

Principle 8 - Inform the expectations of patients and service users about how their confidential information is to be used. A range of steps should be taken to ensure ‘no surprises’ for patients and service users about how their confidential information is to be used - these steps will vary depending on the use. As a minimum, this should include providing relevant and appropriate information - in some cases, greater engagement will be required to promote understanding and acceptance of uses of information. Patients and service users should be given an accessible way to opt out.