The eight Caldicott Principles and Caldicott Guardians

In 1997 Dame Fiona Caldicott led a review of how patient information moved around the NHS. The result was a set of principles for handling confidential care information that have been updated since and are now maintained by the National Data Guardian. There are eight, and they apply across health and adult social care. Here they are in plain English.

• 1. Justify the purpose. Every use or sharing of confidential information should have a clear, legitimate reason that is regularly reviewed.
• 2. Only use it when you need to. If the purpose can be achieved without confidential information, achieve it without.
• 3. Use the minimum necessary. Share the least information that does the job, not the whole record.
• 4. Access on a need-to-know basis. Only the people who need the information to do their role should be able to see it.
• 5. Everyone is responsible. All staff who handle confidential information must understand their duties, not just managers or IT.
• 6. Comply with the law. Handling must meet every legal requirement, including data protection law and the duty of confidentiality.
• 7. The duty to share can be as important as the duty to protect. Information should be shared when it is needed for someone's care. Withholding it can cause real harm.
• 8. Inform expectations. Take steps to make sure patients and people we support are not surprised by how their information is used. Tell people what happens to their data, and there should be no surprises.

Principle 8 was added in 2020 and matters more than it might sound. If a person would be shocked to learn how their information was used, something has probably gone wrong, even if a lawyer could defend it.

Caldicott Guardians

A Caldicott Guardian is a senior person in a health or care organisation responsible for protecting the confidentiality of people's information and for making sure it is shared appropriately. They advise on difficult judgement calls, for example an unusual request from an outside agency. NHS bodies and local authorities with social care duties are expected to have one, and many care providers appoint one too. Know who yours is, or who fills that role, before you need them.