The laws that health and care organisations rely on when using your information

Requires that health and care staff share information with the Chief Medical Officer about abortion treatment they have provided.

Allows access the health records of deceased people, for example to personal representatives or those who have a claim following the deceased person’s death.

Defines how NHS organisations and local authorities must provide care and support to individuals, including for the management of safeguarding issues. This includes using information to assess any person who appears to require care and support.

Sets out the duties of local authorities in relation to improving the wellbeing of children, facilitating access to, improving and joining up early childhood services.

Sets out the duties of local authorities, health and care and voluntary organisations to work cooperatively with police and schools in relation to the protection and care of children. It requires organisations that come into contact with children to cooperate and share information to safeguard children at risk of significant harm.

Requires local authorities to cooperate with education, health and social care services to improve wellbeing of children who have special educational needs or a disability. This includes creating and delivering education, health and care plans.

Allows information to be shared for specific reasons in relation to health and care, such as for the detection and prevention of cancer, to manage infectious diseases, such measles or COVID-19. It also allows for information to be shared where support has been given for research or by the Secretary of State for Health and Social Care.

Sets out that health and care organisations must pass on information to coroners in England.

Places a duty on local authorities and health and care organisations to prevent, identify and refer individuals at risk of being drawn into terrorism.

Places a duty on local authorities and health and care organisations to work with the police to assess and manage risk of individuals causing serious harm to the public.

Requires local authorities and health organisations to conduct, participate in and share information for domestic homicide reviews when someone dies due to violence, abuse or neglect from a relative, partner or household member. It also requires local authorities and health organisations to cooperate with police and probation services to support victims and prevent harm.

Sets out requirements for employers in relation to their employees. This includes keeping records of staff when working for them.

Protects people from discrimination based on their age, disability, gender reassignment, pregnancy or maternity, race, religion or belief, sex, sexual orientation. Organisations may need to use this information to ensure that they are complying with their responsibilities under this Act.

Requires health and care professionals to report known cases of female genital mutilation to the police.

Defines fraudulent activities and how information may be shared, for example with the police, to prevent and detect fraud.

Sets out the structure of the health and social care system and describes the roles of different types of organisations. It sets out what they can and can’t do and how they can or can’t use information. It includes a duty for health and care staff to share information for individual care, unless health and organisations have a reasonable belief that you would object. In addition, health and care organisations may need to provide information to:

• The Secretary of State for Health and Social Care
• NHS England, which leads the NHS in England and provides information, data and IT systems for health and social care
• The Care Quality Commission, which inspects health and care services
• The National Institute for Health and Care Excellence (NICE), which provides national guidance and advice to improve health and care

Allows those responsible for planning health and care services to investigate complaints about health and care organisations they have a contract with.

Requires health professionals to help manage the outbreaks of infection by reporting certain contagious diseases to local authorities and to the UK Health Security Agency. The UK Health Security Agency is responsible for protecting people from the impact of infectious diseases.

Requires health organisations to report information about assisted reproduction and fertility treatments to the Human Fertilisation and Embryology Authority.

Requires health organisations to report information about transplants, including adverse reactions to the Human Tissue Authority.

Sets out requirements in relation to public inquiries, such as the UK COVID-19 Inquiry. Public inquiries can request information from organisations to help them to complete their inquiry.

Sets out the responsibilities of local authorities in relation to social care including managing care records appropriately. For example, it lays out how they should be created, stored and how long they should be kept for.

Sets out what NHS organisations can and can’t do and how they can or can’t use information. It allows confidential patient information to be used in specific circumstances for purposes beyond individual care. These include a limited number of approved research and planning purposes (see Control of Patient Information Regulations 2002 (COPI) above). Information can only be used where it is not possible to use information which doesn’t identify you, or where seeking your explicit consent to use the information is not practical. The Act also sets out that information must be shared for the prevention and detection of fraud in the NHS.

Defines all records created by the NHS or local authorities as public records. This includes where organisations create records on behalf of the NHS or local authorities These records therefore need to be kept for certain periods of time, including permanently in some cases.

Requires employers to report deaths, major injuries and accidents to the Health and Safety Executive, the national regulator for workplace health and safety.

Requires any person to provide information to the police when requested to help identify a driver alleged to have committed a traffic offence.

Sets out requirements for organisations who work with vulnerable to share information and to perform pre-employment checks with the Disclosure and Barring Service (DBS), which is responsible for helping employers make safer recruitment decisions.

Allows health organisations that plan services and local authorities to receive and disclose health and care information to the Office for National Statistics (ONS). The ONS is the UK’s largest independent producer of official statistics.

Requires any person to share information with the police for the prevention and detection of terrorism related crimes.

Created the Infected Blood Compensation Authority, which needs information from those impacted by the infected blood scandal to be able to assess claims and issue payments.