# Protection requirements catalogue **This companion to the [core catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) records the exact protection exchanges assessed in the new review.** Begin with the [protection explanation](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) or [worked examples](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md). This page is the reference layer. Protection concerns can arise at any point in care. Hospital discharge is one worked setting; each catalogue row retains its own trigger and provider limits. The entries include statutory duties, permissions, conditional contracts, regulatory specifications and operational procedures. Each row states its force. A row is an assessed exchange, not a claim of a universal digital mandate. Existing core catalogue duties, such as the discharge summary, are linked rather than counted again. Each record keeps the actor, information, recipient, trigger, method, timing, authority and private-provider scope together. Abbreviations are explained in [Terms and abbreviations](https://uk-digital-healthcare-legal-requirements.pages.dev/glossary/index.md). “No digital-only method” means that the cited duty does not independently require digital delivery; the duty to provide information may still be binding. Actual local instruments and system participation can impose further requirements. ## England and Wales | Record and information | Responsible organisation → recipient | Trigger | Method and timing | Authority and force | Provider scope and limits | |---|---|---|---|---|---| | **ENG-P01** — Appropriate CP-IS safeguarding indicators and service use | Provider under adopted full-length 2026/27 NHS Standard Contract → Delivery/administration staff, CP-IS service and relevant local service partners | Delivery of a service within the adopted contract and CP-IS guidance scope. | Give relevant staff access, ensure appropriate full use, comply with the defined guidance and cooperate with local partners. **Timing:** SC 32.8 gives no separate numerical deadline; participant-specific clocks are described in ENG-P02. | SC 32.8.1–.3; defined Guidance. Confirmed conditional contractual digital access/use obligation [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-182](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-182) | Contract categories A+E, A, AM, CS, MH and U cover the listed accident/emergency, acute, ambulance, community, mental-health and urgent-treatment services, within the guidance scope. NHS and independent providers are covered when their adopted contract covers the service; this is not a duty on every GP or private service. | | **ENG-P02** — CP-IS indicators, contacts and events: child-protection-plan/looked-after status, relevant dates, responsible authority/contact details and access-event information | Scoped NHS providers and local-authority children’s social care, in their separate roles → CP-IS, authorised NHS users and responsible local-authority teams | An in-scope case update, query or service notification. Different actors and events have different clocks. The notice’s inconsistent implementation-date wording remains unresolved. | Specified electronic update, query and notification exchange through National Care Records Service viewing or approved integration. **Timing:** Local-authority case-conference/major-change data no more than two working days behind; local updates uploaded within 24 hours; failed NHS-number uploads addressed within 48 hours. Central processing/acknowledgement of validated uploads within 60 minutes; central notifications within 24 hours; receiving allocation real-time/within eight hours under the relevant requirements. See the [CP-IS detail](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md#england-cp-is-is-a-defined-digital-service) for the separate roles and limits. | DAPB 1609 Amd 33/2024; SC 32.8 where adopted; saved s 250 framework. Standard with qualified statutory/legal route; separate contractual obligation where applicable [SRC-310](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-310), [SRC-311](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-311), [SRC-312](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-312), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181), [SRC-192](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-192) | The notice identifies NHS-service scope and expressly acknowledges the 2012 Act scope limitation for local-authority children’s social care. It does not establish coverage of all private services or general adult protection. | | **ENG-P03** — Relevant child welfare information, including connected-individual information | s 16LA(4) relevant person → Another s 16LA(4) person/requestor | Holder considers disclosure may facilitate recipient functions/services; also qualifying requests | Disclose qualifying information; no specified digital medium. **Timing:** No numerical statutory deadline in the cited provision. | Children Act 2004 s 16LA(1)–(9). Operative conditional statutory sharing duty; medium neutral [SRC-313](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-313), [SRC-317](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-317), [SRC-318](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-318) | s 11 bodies and covered arranged-service providers; birth–under 18; detriment exception; confidence override does not remove data-protection requirements | | **EW-P04** — Relevant information/advice assisting child-protection enquiries | Listed s 47(11) bodies, including specified NHS bodies/LHBs → Enquiring local authority | s 47 enquiry/request; unreasonable-in-all-circumstances exception | Assist when called upon; no exclusive electronic route. **Timing:** Assistance is required when called upon; no separate numerical sending deadline is identified here. | Children Act 1989 s 47(9)–(11). Statutory requested assistance; medium neutral [SRC-314](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-314) | Defined actors, not every private provider automatically | | **ENG-P05** — Adult-risk enquiries and resulting action decision | Local authority → Relevant enquiry/action process | Care/support needs plus abuse/neglect risk plus resulting inability to protect | No digital message imposed by s 42 itself. **Timing:** The statutory enquiry trigger applies; this row identifies no separate electronic sending deadline. | Care Act 2014 s 42. Statutory enquiry context, not universal healthcare reporting/digital duty [SRC-315](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-315), [SRC-145](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-145), [SRC-146](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-146) | Does not turn every private/public care provider into a digital reporting addressee | | **ENG-P06** — Specified information relevant to SAB functions | Person receiving qualifying SAB request → SAB or person it specifies | Conditions 1 and 2 and either condition 3 or condition 4 | Supply; medium not prescribed. **Timing:** Section 45 gives no numerical response deadline. | Care Act 2014 s 45(1)–(6). Conditional statutory information duty; medium neutral [SRC-316](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-316) | Qualifying private organisations can be included; purpose-limited subsequent use | | **ENG-P07** — Safeguarding/welfare information processing standards | Persons specified by a published applicable standard → Relevant processing/service systems | If a standard is published and applies | Have regard to applicable standard; not an automatic universal interface. **Timing:** The applicable published standard would determine its own dates; no new specific standard is identified here. | Children Act 2004 s 16LB. Operative enabling power/conditional have-regard duty; no new specific standard identified [SRC-313](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-313), [SRC-318](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-318) | Only s 16LA(4) persons may be covered; section 16LC consistent-identifier duties not treated as operative | | **WAL-P01** — Fact that person is suspected to be an adult at risk | Relevant partner → Local authority where person appears to be, including another area | Reasonable cause to suspect s 126 adult-risk test | Inform; no digital-only method prescribed. **Timing:** Related guidance expectations are in WAL-P05. | 2014 Act s 128(1)–(2), s 126(1), s 162(4). Statutory report duty; medium neutral [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320), [SRC-321](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-321) | LHBs/NHS Trusts/police and defined partners; not all independent providers automatically | | **WAL-P02** — Fact that child is suspected to be at risk | Relevant partner, including youth offending team as defined → Local authority where child appears to be | Reasonable cause to suspect abuse/neglect/other harm AND care/support needs | Inform; no digital-only method prescribed. **Timing:** Related guidance expectations are in WAL-P05. | 2014 Act s 130(1)–(6). Statutory report duty; medium neutral [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320), [SRC-321](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-321) | Defined partner scope; not a universal all-private or all-child-data upload duty | | **WAL-P03** — Suspected at-risk child/adult moving or proposing to move | Local authority → Other Welsh local authority or local authority in England | Relevant risk suspicion and living/proposed residence in other area | Inform other authority; no platform prescribed. **Timing:** The statutory movement/residence trigger applies; no separate electronic deadline is identified. | 2014 Act ss 128(3), 130(3). Statutory cross-area notification; medium neutral [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320) | Duty is on local authority | | **WAL-P04** — Specified information relevant to Safeguarding Board functions | Qualifying person/body requested by Board → Board or specified person/body | Qualifying request | Supply unless duties incompatibility/adverse-function exception; refusal reasons in writing. **Timing:** No universal numerical or digital deadline is identified. | 2014 Act s 137(1)–(7). Conditional statutory information duty; medium neutral [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320) | Function/activity-based qualifying persons can include independent organisations; use purpose limited | | **WAL-P05** — Child/adult safeguarding report and supporting record | Practitioner/reporter and local services under guidance → Social services; police for relevant danger/crime | A child or adult safeguarding concern requiring a report under the guidance. | Phone, email and written routes are recognised. **Timing:** Child reports as soon as possible; adult reports as soon as possible and within one working day. Telephone reports **should** receive written confirmation within 24 hours. Written confirmation is not necessarily electronic. | s 131 guidance; Volume 5 paras 89–95, Volume 6 paras 69, 71–78. Statutory guidance have-regard framework; guidance instructions and advice retain their respective force [SRC-322](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-322), [SRC-323](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-323), [SRC-320](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-320) | Broad guidance relevance does not make everyone a statutory s 128/s 130 relevant partner | | **WAL-P06** — Shared health/social-care records and reference-data compatibility | Participating organisations/system owners → Authorised professionals and connected systems | Programme/participation and applicable standard, not universal case-report timing | Existing/transitioning record routes; scoped reference-data standard. **Timing:** Actual programme participation and applicable standards govern the route; no universal case-report clock is established. | Connecting Care programme; DSCN 2022/16; Control Standard version 5. Operational programme plus separately classified standard/access conditions [SRC-325](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-325), [SRC-202](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-202), [SRC-200](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-200) | Actual participant/contracts and data purpose determine scope; no universal CP-IS-equivalent mandate proved | ## Scotland | Record and information | Responsible organisation → recipient | Trigger | Method and timing | Authority and force | Provider scope and limits | |---|---|---|---|---|---| | **SC-PROT-01** — Public-body adult-risk report and cooperation: Facts/circumstances of adult-risk case; cooperation likely to assist section 4 inquiry | Relevant Health Board/Special Health Board, councils, Police Scotland chief constable, Care Inspectorate, HIS, Mental Welfare Commission, Public Guardian and any specified body → Council for area where adult is considered to be; council and other listed bodies for inquiry cooperation | s 5(3): knows/believes adult at risk and protective action needed. Adult is 16+ and s 3 three-limb test applies. s 5(2) cooperation subject to proper exercise of functions. | Act does not prescribe electronic transmission or fixed dataset/interface. Use lawful secure agreed referral channel. **Timing:** No fixed clock in s 5; urgency/professional/local procedure governs action. Section 5 sets no national 24-hour deadline. | Statutory disclosure/cooperation duty; no digital-only method in these provisions [SRC-350](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-350), [SRC-361](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-361) | s 5 does not attach to all independent contractors/private care providers merely because publicly funded. Their s 5A/s 10/regulatory duties require separate analysis. Risk is not synonymous with lack of mental capacity. The reporting and cooperation conditions apply separately. | | **SC-PROT-02** — Defined healthcare services may report/cooperate on adult risk: Case facts/circumstances to council; information assisting s 4 inquiry to listed bodies; reciprocal information from listed bodies | Relevant healthcare undertaking containing services by one of s 5A(4) listed professions, including independent GP/private services → Council where person considered to be; s 5(1) bodies; relevant healthcare service on reciprocal limb | s 5A(1) adult-risk/protective-action belief; s 5A(2)/(3) enabling/assisting council inquiries | No compulsory electronic channel or universal record feed prescribed. **Timing:** No prescribed clock in s 5A. | Statutory permission, in force 7 January 2026 [SRC-065](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-065), [SRC-064](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-064), [SRC-350](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-350) | Includes independent/private undertakings within listed-profession definition. Does not turn all private social-care providers into s 5 duty holders. “May” remains permissive. UK GDPR, confidentiality safeguards and purpose limits remain applicable; this is not a blanket override. | | **SC-PROT-03** — Produce records required by a council officer: Requested records or copies relating to person officer knows/believes adult at risk | Any holder of relevant health/financial/other records, including NHS, independent/private clinicians and care providers → Council officer; inspection/use restricted by s 10 purpose and health-professional safeguard | Valid s 10(1) requirement, during visit or at another time | Off-visit requirement in writing; electronic request treated as written if received legibly/retainably. No digital-only supply requirement. **Timing:** No universal statutory response period in s 10; request/urgency must be managed. | Conditional statutory records requirement; non-compliance without reasonable excuse is an offence [SRC-351](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-351), [SRC-352](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-352) | Any person holding relevant records is covered; s 49(4) protects the adult whose wellbeing/property is being investigated. Only health professionals may inspect health records beyond determining their classification. The reasonable-excuse safeguard and the adult’s section 49(4) exception remain applicable. | | **SC-PROT-04** — Health Board help requested for child-welfare functions: Help/things specified by local authority to assist its Part II functions; relevant information where within lawful request | Health Board/other appropriate person specified in s 21 responding to local-authority request → Requesting local authority | Specified request; compatible with own duties/obligations and no undue prejudice to body functions | No electronic channel, message format or system integration specified in s 21. **Timing:** No fixed time in s 21; risk/valid request and procedures matter. | Qualified statutory cooperation duty [SRC-353](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-353) | Private providers not automatically listed appropriate persons; funding alone does not create this duty. Not a freestanding rule that all child records may be shared with any agency. | | **SC-PROT-05** — Information to the Principal Reporter: Local authority: information held about the child when the section 60 test is met; police: all relevant discovered information; other persons: relevant information they may supply; local-authority report: the scope required by the Reporter | Local authority under s 60; constable under s 61; other person, including a health professional/provider, under s 64; local authority responding to a Reporter requirement under s 66(4) → Principal Reporter | Child in need of protection/guidance/treatment/control and compulsory supervision might be necessary; each actor’s statutory test applies | No digital-only method established in these sections. Operational electronic referrals need their own source. **Timing:** No fixed submission clock in these sections; emergency powers/operational routes may have separate rules. | Statutory duties for LA/police; permission for other persons [SRC-354](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-354) | Health/private referrer uses s 64 permission; public funding does not convert s 64 into s 60/61 duty. A Reporter referral does not replace immediate child-protection action. | | **SC-PROT-06** — Child protection concern, IRD and cross-agency planning: Necessary risk facts, existing system information, assessment, decisions/reasons, safety actions, responsible people and plan | Health/social work/police as core IRD agencies; education/ELC/other relevant services based on involvement → Social work or police for immediate risk; IRD core agencies and relevant participants | Concern about abuse/neglect; IRD without undue delay; immediate protective action takes priority | Discussion can be in person, telephone or video. Secure electronic IRD record sharing is promoted. Specific electronic IRD systems depend on locally adopted arrangements. **Timing:** Report without delay; full IRD normally next working day where begun out of hours; CPPM decisions one day, plan five working days are guidance expectations. | Non-statutory national guidance; professional/local arrangements may add obligations [SRC-357](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-357), [SRC-359](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-359), [SRC-360](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-360) | Guidance includes statutory/non-government agencies; no identical national statutory integration duty inferred for independent services. The guidance’s mandatory wording does not itself create a statutory duty. Any stronger local policy or contract needs its own applicability evidence. | | **SC-PROT-07** — CPR access and police child-protection flag: Child name/details and concerns, registration/plan status, lead local-authority contact; not full health/social-care record | Local-authority social-work register owner; authorised practitioners; Police Scotland iVPD users → Authorised protection practitioners; police call handlers/officers via flag | Child Protection Plan/registration decision, relevant register enquiry, move/de-registration | Maintain a secure, accurate and distinct register, with appropriate 24-hour access; the guidance also describes the iVPD flag. No universal NHS feed, API or automated access notification is established. **Timing:** The 24-hour register-access expectation is guidance; registration changes and cross-boundary notifications follow the protection procedures. | Administrative/operational national guidance [SRC-358](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-358) | Relevant private practitioners may participate through authorised local route; no blanket entitlement to register/system access. Guidance expressly says register has no legal status; that does not remove underlying child-protection duties. | | **SC-PROT-08** — Care Inspectorate protection-concern notification: adult services: Occurrence, identifying details (specific protection exception to initials-only default), safety action, lead-agency/police referrals, placing-authority notification; later current form confirmation fields | Registered adult care service/provider within relevant registration scope → Care Inspectorate; council/police referral remains separate | Protection concern, including where referral to lead agency made | eForms protection-concern notification under current linked sector guidance; follow current portal/form instruction. Manage my Service is still described as future launch on current page. **Timing:** Within 24 hours; update within one month of incident. | Regulatory/registration notification requirement with digital form specified by regulator [SRC-362](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-362), [SRC-363](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-363), [SRC-364](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-364), [SRC-366](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-366), [SRC-367](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-367) | Registered public/private/voluntary care services in adult-sector scope; not every NHS healthcare provider. The provider’s operative registration notice and conditions determine applicability. Current 2026 form update says no photos/referral-form attachment without request; regulator notification does not discharge council referral. | | **SC-PROT-09** — Care Inspectorate protection-concern notification: children/young-person services: Concern/people/identifiers, safety action, referrals, placing-authority notification and later outcome | Registered children/young-person care service/provider covered by sector guidance → Care Inspectorate; lead protection agency separately | Any protection concern within service-guidance scope | Protection-concern eForm/current designated regulator system; the current source describes Manage my Service as a future replacement, so a scheduled launch date is not rollout evidence. **Timing:** Immediately; update within one month of incident. | Regulatory/registration notification requirement with digital form specified by regulator [SRC-362](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-362), [SRC-363](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-363), [SRC-365](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-365), [SRC-366](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-366), [SRC-367](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-367) | All ownership/funding types of registered covered care service. ELC/childminding has separate guidance, not assumed identical. Provider registration scope matters. Full referrals and photographs are not attached by default. Regulator notification does not replace an urgent protection referral. | | **SC-PROT-10** — HIS public-protection concern notification: Public-protection concern concerning service user or service-user/visitor interaction; initial personal details not required | HIS-registered independent healthcare provider → Healthcare Improvement Scotland; relevant council/police referral separate | Actual/potential child/young-person/vulnerable-adult abuse within defined service context | HIS portal Quality Assurance Dashboard; notification 15 in v 3.1 June 2024 guidance **Timing:** Within 24 hours; regulator response target one working day is not provider submission deadline. | Regulatory notification under written registration-notification regime; portal specification in current guidance [SRC-368](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-368), [SRC-369](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-369) | Specifically registered independent healthcare services including private/voluntary funding as within regulated definition; does not apply to all NHS Boards by this registration route. The current site still links the guidance after its June 2026 review date. The provider’s actual written notification and registration requirements determine applicability. | ## Northern Ireland | Record and information | Responsible organisation → recipient | Trigger | Method and timing | Authority and force | Provider scope and limits | |---|---|---|---|---|---| | **NI-PROT-01** — Child investigation: Relevant information and advice for child-protection inquiries | HSC authority; requested persons within Article 66(11) → Investigating HSC authority | Child in area subject to emergency order/police protection, or reasonable cause to suspect significant harm; assistance called for | Article 66 does not specify electronic transmission **Timing:** As inquiry requires; no numerical sending deadline in Article 66(9) | Article 66(1),(9)–(12). Statutory duty; paragraph 10 excludes assistance unreasonable in all circumstances [SRC-370](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-370) | A private provider is not automatically within the enumerated assistance list; check departmental direction and other applicable duties. Required information assistance, not a statutory all-provider digital feed | | **NI-PROT-02** — Board information request: Information specified by SBNI and meeting section 11 conditions | Any requested person/body satisfying statutory conditions → Board/committee or person/body named by Board | Valid purpose/relevance and relationship/derived-information conditions | No digital-only method prescribed **Timing:** As soon as reasonably practicable after request | Sections 10–12; general safeguarding-arrangements duties and a particular disclosure request have separate effects. Statutory conditional disclosure duty; use restricted to Board functions [SRC-371](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-371) | Section 11 is not limited to publicly funded providers; statutory conditions apply. The response requirement supplies no blanket upload or interoperability specification | | **NI-PROT-03** — Initial child safeguarding referral: Identity/location, risk facts, concerns, carers, wishes and involved services; distinguish observation/opinion | Healthcare/social-care staff; receiving Gateway manager/social worker → HSC Children’s Gateway/RESWS; relevant partners as justified | Concern requiring assessment/protection | Urgent verbal referral allowed; staff written follow-up; Gateway computer entry **Timing:** Written follow-up within 24 hours; computer referral entry the same day; immediate protection action is not delayed for writing | Referrals sections 3–6.2. SBNI regional procedural requirements, supported by national policy; employer/commissioning adoption affects operational enforceability [SRC-375](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-375), [SRC-388](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-388) | Framework covers private/independent staff; Gateway entry duty concerns receiving HSC service. Explicit computer recording; written referral does not itself prove digital-only transfer | | **NI-PROT-04** — Child Protection Register access/update: Registration/enquiry and case-coordinator details; relevant changed child circumstances | Register custodian, Case Co-ordinator and authorised enquiring professionals → Authorised verified enquirer; custodian/coordinator | Professional concern/enquiry or changed registered-child details | Verified ring-back; enquiries logged on regional electronic system; changes notified in writing **Timing:** Specified changes immediately; coordinator updates within 1 working day; out-of-hours enquiry notification next working day | Register chapter sections 5–6. SBNI procedure; not primary legislation naming a platform [SRC-376](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-376) | Access depends on authorised role; private ownership alone grants no register/system access. A specific electronic logging requirement; no verified universal encompass/NIECR integration duty | | **NI-PROT-05** — Registered child moves between areas: Family/risk summary, protection plan and complete case file including electronic records | Transferring/receiving Trust managers and coordinators → Receiving Trust and relevant involved professionals | Registered child moves, including cross-jurisdiction move | Written summary/acceptance and transfer of file/electronic records; no prescribed API **Timing:** Immediate notifications; summary within 5 working days; receiving conference within 15 working days | Register section 8. Regional procedure; transferring Trust retains responsibility until formal acceptance [SRC-376](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-376) | Relevant private staff participate via authorised roles and actual care arrangements. Explicit electronic-record inclusion; transport/schema not specified | | **NI-PROT-06** — Long-stay child notice: Accommodation and later cessation notice | Hospital Trust under Article 174; person carrying on relevant home/private hospital under Article 175 → Responsible/local HSC authority as specified | Child accommodated 3 consecutive months or intention for that duration; subsequent departure | No digital-only route prescribed by these articles **Timing:** On statutory trigger; no separate electronic deadline stated | Articles 174–175. Statutory notification; Article 175 failure without reasonable excuse is an offence [SRC-383](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-383) | Article 175 expressly covers residential/nursing homes and private hospitals; Article 174 exception where Trust is responsible authority. Required notice and private comparison; not mandatory EPR integration | | **NI-PROT-07** — Reporting relevant crime: Information likely to assist apprehension/prosecution/conviction | Every person with requisite knowledge/belief and materially useful information → Constable/PSNI | Another person committed a relevant offence; section 5 knowledge/information tests | Section 5 does not require digital reporting **Timing:** Within reasonable time | Sections 4(1A), 5. Statutory duty with reasonable-excuse element and other section 5 provisions [SRC-373](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-373) | Public/private setting does not remove duty. A relevant offence generally fixed sentence or five-year maximum; Article 20 Sexual Offences (NI) Order 2008 excluded from section 5 definition; confidentiality/sexual-offence exceptions require specific assessment, not automatic blanket reporting | | **NI-PROT-08** — Adult protection joint referral: AJP 1: adult/contact/incident/risk/protection details, relevant wishes/capacity and alleged perpetrator information | HSC DAPO ↔ PSNI Central Referral Unit → Other joint-protocol partner | Adult 18+ at risk/in need of protection and suspected criminal harm meeting protocol route | Completed AJP 1 via CJSM secure email only; urgent emergency call remains available **Timing:** Without undue delay; initial risk assessment starts on referral day; CRU outcome where no joint case within 2 working days | Sections 2.2–2.5, 3.4; Appendix 1. August 2026 operational protocol; underlying section 5 law assessed separately [SRC-377](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-377), [SRC-378](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-378), [SRC-380](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-380) | Private services refer through appropriate safeguarding route; CJSM membership is not established for every provider. A concrete required secure-digital workflow for participants, not universal EPR/API integration statute | | **NI-PROT-09** — Regulated-service safeguarding event notice: Notifiable adverse safety event/serious injury/misconduct etc; event details and service-user unique identifier under guidance | Registered nursing-home provider/manager → RQIA | Regulation 30 event occurs | RQIA portal guidance; statute permits oral report followed by writing **Timing:** Without delay; oral report confirmed in writing within 3 days | Nursing Homes Regulations 30; RQIA guidance pages 3–6. Statutory event notice and separate regulator portal procedure [SRC-381](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-381), [SRC-382](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-382) | Registered providers covered including private/self-funded settings; public funding is not the trigger. The statute does not mandate the portal exclusively; guidance excludes names/personal details in portal narrative and requires traceable unique identifiers | | **NI-PROT-10** — Unsuitable-worker DBS referral: Held prescribed information about person/risk and supporting material | Regulated-activity provider/personnel supplier → DBS | Withdrawal/would-or-might withdrawal plus relevant conduct, harm test or barring-offence criteria; separate requested-information duties | Online preferred/current DBS service; paper referral can be requested if online unusable **Timing:** When statutory conditions met; guidance says refer once sufficient evidence, not merely routine suspension | Order 2007 Articles 37–42; 2026 commencement section 140. Statutory referral/information duties; online route guidance [SRC-384](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-384), [SRC-385](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-385), [SRC-386](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-386) | Public/private and paid/volunteer regulated activity within statutory scope; the 1 September 2026 removal of the supervision exemption is relevant. Mandatory disclosure with digital service and paper alternative; not exclusively digital statute | | **NI-PROT-11** — Domestic abuse school notification: Relevant attended domestic-abuse incident information affecting child | PSNI under Operation Encompass partnership → Child’s school safeguarding team/designated teacher | Police domestic-abuse attendance with children present | Official page describes contact/call, not mandated EPR feed or digital-only medium **Timing:** Before 9 am following morning | PSNI public scheme description. Operational partnership scheme; separate legal authority/protection duties [SRC-387](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-387) | Programme includes independent schools; not a new healthcare-provider upload duty. Operation Encompass is separate from encompass healthcare record | | **NI-PROT-12** — Safeguarding record availability: Care/social-care information including Child Protection Register information in the 2023 NIECR notice | NIECR controllers/authorised care staff; encompass participants → Authorised professionals for justified care purpose | Need-to-know access | Existing systems/permissions; specific feed completeness not established **Timing:** No universal provider upload interval established | NIECR privacy notice page 3; existing encompass, EpicCare Link and My Care descriptions. System capability/privacy information, not new disclosure obligation [SRC-389](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-389), [SRC-087](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-087), [SRC-220](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-220), [SRC-225](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-225), [SRC-226](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-226) | Independent access must be specifically authorised; private/community services are not presumed fully integrated. A displayed flag does not prove recipient notification, current register check, acknowledged referral or statutory compliance | ## Specialist regimes | Record and information | Responsible organisation → recipient | Trigger | Method and timing | Authority and force | Provider scope and limits | |---|---|---|---|---|---| | **SP-FGM** — Identify girl and explain apparent FGM discovery | Defined regulated healthcare professional/teacher or Welsh social-care worker who discovers the case in professional work → Chief officer of police for area where girl resides | Girl currently under 18 directly discloses FGM, or professional observes qualifying physical signs; not merely suspected/at-risk case | Statute expressly allows oral or written notification; guidance recommends telephone 101; emergency 999 where appropriate **Timing:** Statutory outer limit one month from discovery; guidance expects prompt report, usually next working day | Female Genital Mutilation Act 2003 section 5B; procedural guidance sections 2.1–2.3. Section 5B statutory personal duty; same-profession previous-report exception; lawful report overrides confidentiality restrictions [SRC-330](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-330), [SRC-331](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-331) | England and Wales. Professional role/work is the trigger, not NHS ownership/funding; applies in relevant private practice too. Mandatory disclosure, explicitly not digital-only. Safeguarding referrals and Welsh local-authority reports remain separate. | | **SP-PREVENT** — Purpose-specific concern/risk/support information necessary for lawful referral or panel cooperation | Schedule 6 specified authorities; Schedule 7 panel partners for section 38 → Relevant police Prevent contact; local-authority Prevent lead/panel under national arrangements | Section 26 applies to functions generally; case referral follows assessed radicalisation concern; section 38 cooperation is conditional on appropriateness/practicability/compatibility | England healthcare guidance recommends national form through secure nhs.net/equivalent email to agreed police/LA contacts; E+W/Scottish statutory guidance says national form should be used **Timing:** No universal numerical digital-send deadline in reviewed provisions; prompt proportionate action based on concern | Counter-Terrorism and Security Act 2015 sections 26, 29, 38; Schedules 6–7; national statutory guidance; actual NHS contract SC 32. Due-regard statutory duty under 26; regard-to-guidance under 29; section 38 includes giving information with express legal/data-protection limits. The guidance recommendation does not create an unconditional statutory patient-disclosure order. [SRC-332](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-332), [SRC-333](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-333), [SRC-334](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-334), [SRC-335](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-335), [SRC-181](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-181) | England, Wales and Scotland, within the specified-authority and partner provisions. Schedule 6 names NHS Trusts/foundation Trusts/Welsh LHBs and Scottish Boards/Special Boards/HIS. Ordinary private healthcare registration alone does not make every provider a specified authority. Actual commissioned contracts may add duties. Defined secure digital referral guidance, not mandatory universal EPR flag/API exchange. The English healthcare email guidance does not automatically bind Welsh or Scottish services. | | **SP-DBS** — Held prescribed information about person, conduct/risk and relevant evidence | Regulated-activity provider/personnel supplier meeting statutory conditions → Disclosure and Barring Service | Permission withdrawn, or would/might have been withdrawn but person ceased; relevant conduct/harm-test/barring criteria. Separate requested-information duty applies in specified cases. | Current DBS guidance says online Barring Referral Service; paper form can be requested if online service cannot be used **Timing:** When statutory conditions met; no fixed electronic-send deadline identified in section 35 | Safeguarding Vulnerable Groups Act 2006 sections 35–38; DBS current operational guidance. Mandatory statutory disclosure with online service guidance; reporting to another safeguarding body does not replace DBS duty [SRC-336](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-336), [SRC-385](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-385) | England and Wales. Public/private employers and relevant volunteer managers/personnel suppliers; not dependent on public funding. A legal duty to refer with a digital route and retained paper alternative; online submission is not an exclusive statutory method. | | **SP-PVG** — Held prescribed information on identity/role/harm and investigation/decision; victim identity coded in form guidance | Organisation responsible for regulated role; qualifying employment agency/business; distinct regulatory-body routes → Scottish Ministers through Disclosure Scotland | Relevant harmful conduct plus dismissal/permanent move, or qualifying would/might removal after departure; statutory agency tests differ | Current guidance directs completed form to assured.systems.gov.scot email, with printed/postal alternative **Timing:** Failure without reasonable excuse to discharge sections 3–5 duty within 3 months of duty arising is an offence under section 9 | Protection of Vulnerable Groups (Scotland) Act 2007 sections 2–5, 9, 20; current Disclosure Scotland referral guidance. Statutory referral with three-month offence threshold; digital method is operational guidance [SRC-337](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-337), [SRC-338](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-338) | Scotland. Public/private/voluntary organisations within regulated-role definition; applies regardless of individual PVG membership. Email/form submission exists; reviewed current guidance does not establish an exclusive online portal or digital-only legal duty. | | **SP-MAPPA** — Information for assessing/managing statutory offender/public-protection risk | Responsible authority plus section 325(6) listed bodies, including relevant NHS bodies; other contributing persons under 4A(c) → Other qualifying MAPPA participants | Establishing MAPPA arrangements; purpose-specific disclosure under 325(4) | Section 325 prescribes no electronic-only channel or healthcare upload interface **Timing:** No universal numerical digital-send deadline in section 325; actual arrangements/MOU may specify process | Criminal Justice Act 2003 section 325. Cooperation and memorandum duties are statutory. Section 325(4) is a permission to disclose, with confidentiality override and legal limits, not a universal duty to disclose every record. [SRC-339](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md#src-339) | England and Wales. Nonlisted private provider can be a contributing participant under 4A(c); that does not automatically make it a listed cooperation-duty body. No universal direct healthcare-provider ViSOR upload duty established by the reviewed provision. Section 325(4D)–(4E) can treat persons as competent authorities for DPA 2018 Part 3 processing under this power. The ordinary Article 6/9 care-sharing analysis is therefore not necessarily the applicable data-protection regime. | ## Count and evidence boundary This review records **40 protection exchanges and contexts**, separately from the core catalogue's 56 assessed records. Permissions and context rows remain explicit. They are not added to the core catalogue's count of confirmed digital obligations. The [evidence matrix](https://uk-digital-healthcare-legal-requirements.pages.dev/evidence-matrix/index.md) groups the legal findings; source cards record dates, versions and access limits. The baseline is **3 November 2026**. The review does not prove every local contract, installed interface or protected regulator form. Proposed laws and future programme milestones are not current duties. The [validation record](https://uk-digital-healthcare-legal-requirements.pages.dev/validation-queue/index.md) preserves those boundaries. [Protection explanation](https://uk-digital-healthcare-legal-requirements.pages.dev/topics/protection-and-safeguarding/index.md) · [Worked examples](https://uk-digital-healthcare-legal-requirements.pages.dev/examples/protection-sharing/index.md) · [Core catalogue](https://uk-digital-healthcare-legal-requirements.pages.dev/digital-requirements/index.md) · [Sources](https://uk-digital-healthcare-legal-requirements.pages.dev/sources/index.md)