Confidentiality and Data Protection
- Summary
1.1 Your record with us
1.2 Your right to confidentiality - Introduction
2.1 Your confidential record part 1: A record on paper
2.2 The record on paper might contain
2.3 Your confidential record part 2: A record on computer - Why do we keep records?
3.1 Will we see you without keeping a record?
3.2 To what standard do we keep records?
3.3 Can you see your own record? - Confidentiality
- Duty of care to the community
5.1 Attendance - Will you tell anyone I attend the Counselling Service?
5.2 Attendance - Will you tell anyone I do not attend the Counselling Service?
5.3 Compensation claims - Will you provide Reports for the purpose of Compensation Claims, etc.?
5.4 Data Disposal
5.5 Questions?
1. Summary
Both confidentiality and data protection are complex issues. This leaflet addresses them both in some detail. In addition, any counsellor can discuss matters further with you. However most people want no more than a quick overview of our professional practice. This page provides just that.
1.1 Your record with us
Part I is a handwritten brief note of each visit to us. Part II is a computer database containing statistics for management purposes.
Paper records are kept for 6 years and then destroyed. All computer data is erased within 6 years - most within 3 years.
You are entitled to see your records.
1.2 Your right to Confidentiality
We will not normally disclose any information about you to anyone without your consent.
We may do so in exceptional circumstances:
- Where not to do so would break the law
- Where you have put yourself or others in serious danger
If we have to disclose information we will strive to disclose the least information necessary in the circumstances.
2. Introduction
We want you to get the best service possible from the University Counselling Service. The more you know about how we operate, the more informed your choices will be in how you use us. Underlying such choices is the trust you have in your Counsellor and the Counselling Service systems. This leaflet aims to make as explicit as we can what happens to the personal information you give us.
We keep a confidential record of all our transactions with you. The record is kept in two parts.
2.1 Your Confidential Record Part 1 - A record on paper.
This contains:
Your signed consent for us to keep your records under the conditions specified.
The' intake data' form you fill in on your first visit in which you tell us your name, address, subject of study, year of study, etc.
A list of dates on which you consulted, and codes, such as A 632, which tell us what category of problem you discussed with us. These codes help us provide resources appropriately.
Also in your record are sheets of paper on which your counsellor makes notes. These notes will often be no more than a few lines per consultation, but could exceptionally run to several pages, especially for an initial assessment of the problem.
Security arrangements differ from site to site but generally files are encased in an A4 transparent plastic file binder and held in a locked filing cabinet behind a double locked door with the whole area in addition being security protected when unattended within a multi-locked building which is itself protected by University Security patrols.
2.2 Your record might also contain material such as:
A letter from your GP, tutor, etc., where you have asked them to supply us with information, or refer you to us.
A copy letter from us to you, or to your tutor, a university committee, etc., where you have requested this and signed your consent for us to write to them.
Any additional form or survey we might ask you to complete.
2.3 Your Confidential Record Part 2 - A record on computer
This is a coded summary record made for the purpose of statistical analysis. It tells us what we are doing and helps us manage the service. Your name and address are not held on this record. The 'key' (a number) which links it to you is held separately. The computer record is firewall protected. The data derived from these records is published every year in an appendix to our annual report. No one can be identified from this data.
3. Why do we keep records?
To protect you: To treat you professionally requires us to identify problems, record what we do to help you alleviate them, and monitor effectiveness.
To protect us: In the event of query we need facts - whom we have seen, what we have done, etc. [See later references to confidentiality]
To protect the University: You might want us to write to someone such as a Local Authority to justify financing you to repeat a year of your course, or to an Examinations Board considering your appeal. We are unlikely to remember precise details without a record.
To protect the public: We are accountable to both the University and the Higher Education Funding Council for ensuring money is spent in a professional way.
3.1 Will we see you without keeping a record?
No, unless you simply want to clarify your understanding of confidentiality etc., before deciding whether or not to proceed with counselling. If as a consequence you wish to go elsewhere for counselling we will on request offer you information on local counselling resources.
3.2 To what standards do we keep records?
We are registered under the Data Protection Act, and the Service operates under the Ethics of the British Association for Counselling and Psychotherapy with regard to records. A copy of the complete 'Code of Ethics and Practice' will be found on the notice board. However, normally, no information about you will be given to anyone without your signed consent. Paper records are kept for 6 years, and then destroyed. All computer data is erased within 3 years.
3.3 Can you see your own record?
Yes; we have operated an open access policy since 1980. Make your request in writing to the Head of Service. Before anyone is allowed to see any record the Head of Service must fulfil a legal duty of care to:
a. Ensure the person making the request for access is entitled to access.
b. Review the record itself to ensure anyone else's right to confidentiality will not be compromised by such access.
c. Ensure access is granted in a professional manner.
You may view the record but not alter it, so normally a counsellor will accompany you while you view, as witness. You may request alterations to correct any factual inaccuracy on our part. You may make notes if you wish. You may not remove the file from the room in which access is provided.
A Professional Manner - What does "to ensure access is granted in a professional manner," mean?
Exercising a duty of care means ensuring that seeing any information in the file is not likely to traumatise the client. An example:1
Fred consults about a phobia, and tells his Mum he has done so. She writes to the counsellor saying he had an older brother who died as a baby but he doesn't know this and could it be relevant? It is not. However, Fred asks to see his record. The letter from his Mum cannot be destroyed; it is part of the record. The counsellor delays access, explains the situation to Mum, and ensures Fred has heard about his brother direct from his Mum and Dad before granting access.
Our duty of care also means ensuring your counsellor or in default another counsellor, is on hand to clarify the record should you wish.
Duty to Third Parties. What does "to ensure anyone else's right to confidentiality will not be compromised by such access" mean?
The same duty of care applies to information about third parties. Any data about third parties within the record will be withheld to preserve the confidentiality of the third party unless the consent of the third party has been obtained for you to see this. The example below illustrates how this applies:
Susan asks her home GP to refer her to the Counselling Service. He does so but not only does he write appropriate and helpful information about Susan's problems and medication but, unfortunately, mentions the affairs of another mutual patient/client in the same letter. Susan asks for access to her record. The counsellor, realising Susan could thereby be given inappropriate access to sensitive personal information about a third party, delays while consulting the home GP. The original letter is removed from the file and a photocopy substituted with the paragraphs not relating to Susan blanked out. A letter from the counsellor is attached explaining what has been done. Susan ends up with access to all her own information, but not to that of anyone else.
But what about when the issue is not information about third parties but information written by third parties which is about or refers to you? Usually there is no problem to you having access to this. However, we must exercise the same duty of care in such a situation.
Where we are unsure whether access to a letter or report written by a third party might cause serious harm to the physical or mental health of the client, or that of any other person, we will write to the original sender of the letter or report, and often current psychiatrist/GP, seeking confirmation that access through us will not do harm. The original writer of a letter might anyway quite legitimately request that they show (and explain) the letter in question to the client. In such cases delay is inevitable.
4. Confidentiality
The written information you give us and what you discuss with your counsellor is confidential to the Counselling Service. Within the Counselling Service your file may be seen by our Secretary/Receptionist and counsellors may sometimes discuss a case with another counsellor. The Duty Counsellor needs access to all files when clients arrive in an emergency. We also require counsellors to discuss a sample of their caseload with an external expert consultant as a matter of good practice in quality assurance, but this is done anonymously. Other than this your counsellor will not normally contact anyone about you without your written consent. We will not respond to questions from friends, family or tutors concerning you or indicate that you are attending the Counselling Service.
However, confidentiality is a qualified right, not an absolute one and there are certain circumstances in which a counsellor may break confidentiality without the client's express permission. No counsellor will do this without a great deal of reflection, assuming time is available for that. To break confidentiality a counsellor must act within the law and have a legitimate objective, such as the protection of life and health, or the prevention of a serious crime. A counsellor will normally consult a colleague and may also take independent professional advice before proceeding. Every effort is made to ensure the action is both reasonable and proportional. Professional codes (e.g. the BACP or BPsS Code of Ethics and Practice) help to inform such actions, as does being informed by legal advice. In almost all cases of disclosure the client is aware of it immediately, but should that not be the case we will seek to inform the client in a manner appropriate to the particular situation.
The circumstances in which a counsellor would make such a disclosure include:
Where the counsellor would be subject to civil or criminal legal proceedings if the information were not disclosed to a court (i.e. a counsellor cannot be required by an employment contract to break the law for you).
Where the counsellor believes the client or a third party is in serious danger. The most common cause for our disclosure is when in our view a client is in serious danger of suicide or death from self-harm. Considering whether life is worth living, and despairing that it may not be, is a common and important task of late adolescence. In a University Counselling Service clients often have suicidal thoughts or intentions. We seek to persuade people to engage in treatment which reduces the risk to them and others but we cannot enforce treatment or the seeking of it nor insist that our clients inform others about their state of mind.2 We have particular concern in these circumstances when a client, due perhaps to misuse of drugs or alcohol, may act in an unstable or impulsive way and therefore be at additional risk of temporarily losing the ability to take responsibility for their actions. If we believe someone to be in imminent danger or particularly unstable we will seek to persuade them to see their GP immediately, or as soon as possible if we believe the danger not to be so acute. We will also normally write to or otherwise contact a client's GP in these circumstances to flag up our concern. Our principles of disclosure are to disclose the least information necessary in the circumstances, to the person most likely to be professionally helpful, whether as an individual or as a gateway to further resources, but someone who is also bound by professional ethics which safeguard the client's interests. We do not normally tell the partner, or parent, of a student where we perceive there to be a suicide risk. The consent of the client to disclose information will not be sought where it is thought that informing them of the intention to disclose would increase the risk to the client or others.
Where otherwise justice would not prevail. This might be a situation where the client is likely to give permission to disclose were they able to do so.
Mary is in hospital undergoing serious treatment. Her parents do not wish to distress her further with letters from the University regarding her case going to Failures Committee. We agree to give evidence without her personal request or knowledge so she can be permitted to repeat a year when well again.
To prevent serious crime: It may be mandatory to report if a client is currently abusing a child and it may also be mandatory to report where a client tells us that someone else is abusing a child.
Signed Consent. When we say, "Normally no information will be given to anyone without your signed consent" do we guarantee no disclosure without your signature ?
No. It has to be accepted that for justice to prevail each circumstance must be looked at in its own right. An example:
Anna telephones her counsellor in a panic: she has just realised she will be thrown out of University tomorrow as her case goes to The Senate Committee on Failures in Examinations3 without any mitigating circumstances. Will the counsellor provide a report to the Committee outlining the huge impact her depression had on her concentration? Yes, we will. But there is not time for her to sign the normal form agreeing to such disclosure. We decide to act on her word and without her signed consent.
Normally, of course, we would not disclose without a signature.
5. Duty of care to the community
It is perhaps obvious by now that it is not always easy to make decisions about breaking confidentiality. However, some of the most complex decisions relate to a counsellor's duty of care to the community, as well as the immediate client. The cases which follow help to illustrate the point:
Hacking
Daniel has seen the counsellor four times about volatile moods and obsessive thinking. He suddenly discloses that he has been running departmental computers day and night to break passwords and is able to read the e-mails of fellow students who he believes are gossiping about him, and regularly does so. He is almost at the end of his BSc course and the counsellor (and later consultant psychiatrist) judge him as highly likely to continue hacking when he takes up a job. He refuses to report himself. Following much reflection and discussion it is decided to inform computer services of the password breach so a new username and password can be issued to those affected but not to disclose Daniel's name, on condition he continues treatment. It is judged it is better to get his continued co-operation in treatment (so preventing probable more serious hacking) rather than "break faith" with him. The latter would ensure he was so angry at this that he might become more dangerous and would never enter treatment again. In other words, one is concerned for future third parties too.
Arson
George confesses to the counsellor that he is the person regularly setting fire to waste paper in an academic department - a person the police, fire brigade, campus security, and all members of the department concerned are desperate to find before serious damage is done and people are killed. George refuses to give himself up. He is terrified by his own actions but even more terrified of loss of control to others. Eventually, after hours of working with his counsellor he agrees his parents should know the facts and look after him. They are told by the counsellor. His parents immediately call the Head of Department and subsequently arrange hospital treatment. No further action is taken by University or police. The counsellor had actually decided to disclose without George's consent if no other way forward could be found. In the event, this was avoided.
5.1 Attendance - Will you tell anyone I attend the Counselling Service?
No, not normally. However, disclosing attendance, and attendance only, may be an example of the kind of low-level proportionate response to community issues referred to earlier.
David is the subject of many complaints from other students in a hall of residence. He is causing them severe distress and disrupting their attempts to study. They want him out, now. The warden would normally require David to leave the hall in such circumstances but David will not even talk to him nor, temporarily, anyone else either (part of his problem). The counsellor decides that to confirm to the warden that David attends the Counselling Service is very much in his interest rather than immediate ejection from hall. The counsellor does so. The warden neither requests nor gets any additional information. This information is sufficient to turn a disciplinary offence into a welfare issue, and greater discretion for the warden. Within a few weeks all has settled down again, and David is grateful for what was done on his behalf while he was acting irrationally.
5.2 Attendance - Will you tell anyone I do not attend the Counselling Service?
No, not normally. We do not follow up non-attendances as a matter of routine. However, disclosing to a referrer (such as a GP, tutor, or warden) the non-attendance of a client may be appropriate risk management in certain circumstances.
Over several months Tom's tutor has noted his loss of motivation and at an end of term interview enquires about it only to be told Tom frequently feels suicidal. They agree Tom will attend for counselling and the tutor makes the referral call while Tom is with him, Tom speaks to the service reception to agree the time - two hours later to see the Duty Counsellor. Tom does not turn up and makes no contact. The Duty Counsellor has never met Tom but has picked up enough to feel it important he or some other professional gets to do a risk assessment with Tom sooner rather than later. He calls the tutor who made the referral to say Tom did not turn up.
The tutor calls Tom's warden who finds him in his room in despair that anyone could help him and drunk. When Tom is sober, the warden brings him to see the Duty Counsellor, who diagnoses severe clinical depression. A combination of medication from the Duty Doctor and therapy from the Duty Counsellor over a period of weeks remove Tom from the risk list, and in a few months he is back to his old self. Tom thanks everyone for ensuring his passive despair did not permit him to 'fall through the University welfare net.'
5.3 Compensation Claims - Will you provide Reports for the purpose of Compensation Claims, etc.?
No, not normally. If you consult us about, say, post-traumatic stress disorder, or depression, or something similar following a trauma (say, a car accident) we will do a routine clinical assessment for the purpose of treatment. This is not intended for the purpose of any claim, which you may eventually decide to make against others for financial compensation. Assessment for compensation requires a different and time-consuming approach. Should you wish the latter, numerous outside psychologists and psychiatrists specialise in providing evidence for compensation. You should consult them. We will not therefore normally supply your solicitor or representative or claims organisation with such information, nor enter into correspondence with them.
5.4 Data Disposal
Paper records are burnt or shredded as confidential waste. Should a computer reach the end of its life, hard drives are 'overwritten' by an authorised member of IT Services prior to disposal, rather than data just being 'deleted'. This ensures the data is really destroyed.
5.5 Questions?
If you have any questions, any counsellor will be pleased to clarify the issues for you.
Your assurance of the highest possible quality of professional care is that every case is dealt with on an individual basis, informed by the factors outlined. This leaflet is revised periodically to take account of changes in the law and recommendations on 'good practice' by professional bodies. We reserve the right to make minor updates to practice in between updates to this leaflet.