Workplace scenarios

These scenarios are drawn from the kinds of situations care staff meet every week. For each one, decide what you would do before reading on.

Scenario 1: The lift conversation

Two support workers travel between floors in a hospital lift, talking about a person we support. No name is used, but her street, her dog and her recent diagnosis all come up. A visitor sharing the lift lives two doors away from her.

What good looks like: the conversation never happens in the lift. Handover and debrief belong in a private space, because in a local community, detail identifies people without a name. A colleague who overhears something like this says so at the time, kindly, and mentions it to the manager so the whole team is reminded. That is not about getting anyone into trouble: near misses are how weak habits get fixed before they become breaches.

Scenario 2: The daughter on the phone

The daughter of a resident who has full capacity phones the home, upset, asking why her mother saw the GP yesterday. She is next of kin and insists she has a right to know.

What good looks like: the staff member stays warm but discloses nothing. Being next of kin creates no right to information; the resident decides what her family is told. The staff member checks the care plan for what has been agreed, offers to ask the resident what she is happy to have passed on, and records the call. If the daughter remains unhappy, the manager follows up with her rather than the rules being bent on the phone.

Scenario 3: The photo on a personal phone

A new care worker takes a lovely photo of a resident during a baking activity on her own phone, intending to print it for the resident's memory book. The photo automatically uploads to her personal cloud account.

What good looks like: photos are only ever taken on the organisation's device, with consent or a best-interests decision, for a clear purpose. When the worker realises her mistake, she tells her manager the same day instead of quietly deleting the photo. It is handled as an incident: the image is removed from the phone and the cloud account, the resident's consent position is checked, and induction is improved so the next new starter knows the rule before their first shift.

Scenario 4: The misdirected discharge summary

An administrator emails a discharge summary to a community team, but autocomplete selects a similarly named contact at a different organisation. She notices ten minutes later.

What good looks like: she reports it to her manager or data protection lead immediately, the same day. The organisation contacts the unintended recipient to request deletion and confirmation, assesses the risk to the person, and decides whether the ICO must be notified within 72 hours. The administrator is thanked for reporting quickly, and the team changes how recipients are selected, because the aim is fixing the process, not blaming the person.