Protection concerns: child and adult worked examples
Protection concerns can arise at any point in care. The fictional cases below use hospital discharge as one worked setting. The general protection account covers the relevant sharing duties and digital routes beyond that setting.
A discharge summary, a protection referral and a safeguarding-system update are separate exchanges. The responsible organisation must identify each applicable duty and send the information to its proper recipient. A shared-record flag does not replace an urgent referral or prove that the receiving team has acted. 181, 311, 360, 388
These fictional cases show how to apply the four-nation protection map. They supplement the ordinary discharge example and capacity/representative-authority map. Their facts are illustrative; they do not establish an actual person's capacity, risk or legal authority.
Example 1: a child needs care and protection
A 14-year-old attends hospital with injuries and information suggesting abuse at home. Discharge is being considered. Community healthcare and social care are involved; the school has relevant observations. A parent who may pose the risk has access to an online account.
Act on the concern and identify the recipients
The hospital first provides necessary care and immediate protection. Its safeguarding team identifies the relevant social-care service and, where justified by danger or crime, police. It records observed injuries, the child's account, relevant context, identity/location, immediate safety needs and who needs to act. The school receives information justified for its role, rather than an automatic copy of the whole clinical file. GMC child-protection guidance requires prompt appropriate disclosure with limited, documented exceptions; legislation and local arrangements provide additional duties. 393
| Nation | Apply the protection duty and route | Keep the digital requirement precise |
|---|---|---|
| England | A qualifying hospital body applies section 16LA's conditions to necessary child-welfare sharing, including relevant connected-adult information. Requested section 47 assistance is a separate route. Check the school's current designation or other authority. 313, 314, 326 | If the provider's contract/service is within SC32.8, authorised staff use CP-IS appropriately. A missing indicator does not cancel the new concern; checking an indicator does not itself make the referral. 181, 311 |
| Wales | A relevant health partner with reasonable suspicion meeting section 130 informs the appropriate local authority. Guidance supports prompt reporting and written confirmation of a phone report within 24 hours. 320, 321, 322 | Use the agreed secure route. The law does not require every report through WCCIS or an English CP-IS interface. Written confirmation is not by itself a digital-only duty. |
| Scotland | Health, social work and police use the protection referral/inter-agency referral discussion process, involving education as relevant. Health Board cooperation and local-authority/constable Reporter duties have their own statutory tests. 353, 354, 360 | Secure electronic records can carry agreed decisions and actions. The national guidance also permits discussion by telephone, video or in person; a universal hospital-to-register API is not established. 358, 360 |
| Northern Ireland | Refer to Children's Gateway or the out-of-hours service; use police where protection/crime requires. Article 66 assistance and SBNI requested information have separate conditions. 370, 371, 388 | The receiving referral is entered on computer the same day; professional verbal referrals receive written follow-up within 24 hours. Authorised register enquiries are logged on the regional electronic system. These are regional procedures, not an all-provider EPR-integration statute. 388, 376 |
Send the continuing-care handover as well
The hospital agrees who will deliver healthcare, social care and protection actions after discharge. It sends each receiving service the information needed for its task, identifies action owners and records the handover. In England, the applicable SC11.5 contract requires its scoped discharge summary within 24 hours, with different methods for GP and other recipients. That deadline does not authorise waiting 24 hours to act on an immediate protection concern. Other nations' applicable local handover terms remain separately checked. 181, 182
The hospital also checks whether a separate regulated-service incident notification is triggered. For a registered Scottish children's care service, applicable Care Inspectorate guidance calls for immediate protection notification and a later update. This is a regulator report by the covered service, not a substitute for the hospital's protection referral. 362, 365
Control the parent's online access separately
The team assesses the child's competence, confidentiality, safety and the actual parent's authority. It reviews online release, attachments, messages and proxy permissions so that an unsafe disclosure is not made automatically. The outcome might be selective disclosure, restricted material or a reasoned refusal under an applicable provision; it is not blanket deletion of the protection record.
Data Protection Act Schedule 3 paragraph 4 concerns specified parental/appointed-person requests for health data and confidential expectations. Paragraph 21 restricts certain child-abuse access where disclosure would conflict with best interests, and expressly does not apply in Scotland. Scottish health/social-work restrictions and capacity rules must therefore be applied on their own terms. An inter-agency protection disclosure and a representative's access request are different decisions. 391, 257, 254
Example 2: an adult may be harmed by a carer
An older adult needs community nursing and social care after discharge. Staff suspect neglect and financial abuse by a relative who asks for the entire digital record. The adult's ability to decide about disclosure must be assessed; age or suspected abuse alone does not prove incapacity.
Identify the duty before choosing the channel
| Nation | Required or permitted protection information | Digital route and provider boundary |
|---|---|---|
| England | The council's section 42 enquiry duty, qualifying cooperation requests and section 45 Board information requests are distinct. A valid Board request can require a qualifying private body to supply specified information. 315, 316, 146 | Use the applicable secure local pathway and contract. Section 42 does not itself impose a hospital digital-referral format; CP-IS is not a general adult-protection service. |
| Wales | A relevant health partner reports reasonable suspicion meeting the adult-at-risk test under section 128. Apply the guidance's urgency and recorded follow-up, including police involvement where justified. 320, 321, 323 | Phone, email and writing are recognised routes. Relevant-partner scope is not every private provider; a Board request or other actual duty may have wider reach. |
| Scotland | A Health Board reports qualifying adult-risk facts to the council under section 5. A defined independent/private healthcare service has section 5A permission. Any relevant record holder can receive a valid section 10 production requirement. Beyond establishing whether they are health records, only health professionals may inspect them. 350, 351, 352 | The Act does not require one electronic channel. Covered registered care services have separate Care Inspectorate digital notification within 24 hours; HIS has its own covered independent-service notification. 364, 368, 369 |
| Northern Ireland | Apply current adult-protection policy/protocol and any qualifying-crime disclosure duty. The proposed Adult Protection Bill supplies no operative powers at this baseline. 373, 377, 379 | HSC Trust–PSNI joint referrals use completed AJP1 through CJSM secure email under the August 2026 protocol. This inter-agency route is not an automatic permission for every private care home to access CJSM or encompass. 380 |
Decide what to share and what the relative may see
Staff distinguish a legally required disclosure from a disclosure requiring another justification. For doctors, GMC guidance treats an adult's capacity and refusal as material where disclosure is not legally required. It requires prompt appropriate information about serious harm where capacity is lacking, subject to the stated overall-benefit qualification. Record the legal/professional basis, information, recipient and reasons. 392
A valid welfare power, court order or other national authority may justify relevant information for its actual function. “Next of kin” alone does not establish that authority. The adult's own access rights and any applicable restrictions also need separate assessment. The hospital sends necessary continuing-care information to the receiving teams, while controlling the relative's portal access independently. 244, 258, 391
Make the remaining system actions explicit
Record the referral, recipient, decisions and outstanding actions. Maintain the relevant local flag or protection record under its actual rules. Make a separate regulator notification if triggered. Confirm the agreed recipient and action owner for the continuing-care handover. These are practical checks for this example; each binding requirement comes from its cited law, contract or procedure.
The result is a documented set of justified exchanges and controlled access. It does not depend on assuming every system shares every record or that one upload completes the protection process.
Protection law and digital detail · Exact requirements · Hospital discharge · Capacity and representation · Home answer