Sharing mental health information

The UK’s information watchdog has published guidance for employers on when they can share information about their workers in the event of a mental health emergency, whilst simultaneously emphasising the importance of planning ahead.

An emergency is defined by the Information Commissioner’s Office (ICO) as a situation in which an employer believes that a worker is at risk of serious harm to themselves or others because of their mental health.

Although data protection rules do not stop employers from sharing necessary and proportionate information in an emergency situation, they still have to ensure they are doing so with the right people to protect the person involved.

Hence the emphasis on planning ahead as it can help employers to make timely decisions if and when they need to. This can include putting in place internal policies and processes for information sharing in these situations and setting out the approach they intend to take.

However, when thinking about what response they are likely to adopt in a mental health emergency, the ICO points out that employers must identify a lawful basis for doing so. And as health information is special category data, they must also identify a special category condition.

In addition, as part of their transparency obligations, employers must let workers know that they may share their information in a health emergency. They must also ensure that workers are aware of any policy they have for sharing personal information in these situations. Importantly, they must provide it to existing workers as soon as possible and to new workers within one month of obtaining their information.

The ICO recommends that employers carry out a data protection impact assessment (DPIA) as part of their general processes for the everyday handling of their workers’ health information. However, even if they have not carried out a DPIA in advance, it is worth noting that this does not stop them from sharing information in a mental health emergency.

The watchdog also recommends that employers:

• Develop a policy on sharing personal information in a mental health emergency.
• Train staff on how to handle the information.
• Ensure that workers keep the details of their next of kin and emergency/mental health emergency contacts up to date through regular review.

To read the guidance in more detail, click here.