What process do organisations follow when responding to requests?
Our conversations with organisations revealed a consistent process for handling SARs for social care records, but also highlighted just how complex and demanding the process can be in practice.
Key findings:
- Most organisations followed a similar process, validating a request, collating information and then redacting information which they considered exempt.
- Participants felt that processes were changing and improving.
- Organisations varied in how they communicated with requesters. Some preferred face-to-face or telephone contact but found this was not always possible.
- Organisations used different techniques to stay in touch with requesters, with much of this based on how experienced the staff were in the role.
- Organisations generally viewed applying exemptions and redacting information as safer than disclosing information inappropriately.
Internal process
Organisations would either have a coordination role or requests would come into a main team. The most common first step was an identification check, with some checks to understand the relationship with the requester. This could include whether the requester had a current relationship with a social worker. Often, collating the information was undertaken by social work staff rather than information governance teams, although this did vary. Redactions might be started by social workers closer to the original information, but often it was passed to a senior staff member or information governance team for further and final checks.
Some participants pointed to Local Authority Designated Officers as a useful sounding board when social workers weren’t available.
Communication
There was a lot of variety in when and how organisations communicated with requesters. The majority of participants recognised the value of verbal communication, although some recognised email requests as providing a useful audit trail.
One organisation highlighted that all people leaving care were assigned a personal assistant who specifically checked whether they wanted a copy of their records. Some organisations contacted requesters when they made a request, which helped explain more about the process, manage expectations and discuss dates for delivery of the information. Most noted that while they often explored whether requesters wanted some specific information, most requesters wanted their whole file.
Other organisations waited until they’d gathered all the records and were ready to provide them before contacting the requester, and they explained the process at that stage.
Releasing information
While most organisations provided information directly to the requester, those with an allocated social worker sometimes provided the information via their social worker.
Documents were generally sent using a secure email system (eg Egress). There was concern about sending hard copies. Organisations typically warned responders when they were sending copies and sometimes delivered papers by hand or sent them by recorded mail.
Redaction and exemptions
Participants generally felt that applying an exemption was ‘safer’ than disclosing something they shouldn’t. They typically described taking a risk-averse approach to disclosure.
One participant told us:
“I err on the side of caution. I’d rather get it wrong and be told, ‘you should have given it’, by the ICO than have given it and be told that’s wrong”.
Views on exemptions varied, with some thinking the third-party exemption was the most straightforward and others thinking it was applied too frequently. There was a desire for more clarity on the serious harm exemption, particularly for requests where the person had left care and did not have an assigned support worker.
The most frequent reasons for information being redacted or not released were:
- third-party information;
- serious harm exemption;
- not personal information (eg corporate information);
- social care exemption; or
- legal privilege exemptions.
Changes
A number of organisations reported recent changes in their processes. More than one organisation had secured new resource after hitting ‘crisis’ points in their handling of requests. One participant reported a new seven-strong team dealing only with requests for social care information. A number of participants saw increases in their use of overtime as a way to increase their responsiveness to requests.
Some organisations were beginning to put in place trauma-informed and person-centred approaches. This included having mental health support available or pointing requesters to support organisations. Some authorities didn’t take this approach or didn’t know where to refer people. Some organisations pointed to their desire to take approaches such as sitting down one-on-one with requesters, but felt that they did not have time to do so.