Child and adult protection: what must be shared digitally?

Protection law can require organisations to share information even when it does not prescribe an electronic channel. Specific digital requirements then arise through applicable contracts, standards, procedures and regulatory notification arrangements. The clearest examples in this review are England's Child Protection Information Sharing service (CP-IS), Northern Ireland's adult-protection secure-email protocol, and electronic register or referral recording. Their different authority and coverage matter. ^{181, 310, 380, 388}

The glossary explains the organisations and abbreviations used below.

Protection concerns can arise at any point in care. Keep the necessary protection disclosure, any required digital-system action, any continuing-care handover, and patient or representative access separate. Completing one task does not prove the others are complete. The worked examples use hospital discharge as one setting involving healthcare, social care, police and education.

Start with the national reporting duty

“Vulnerable person” is not one UK-wide legal category. Child, adult-at-risk and care/support thresholds differ. Scotland's adult-protection framework starts at 16; the Data Protection Act's paragraph 18 adult condition starts at 18. A person aged 16 or 17 can therefore need analysis under more than one framework. ^{350, 390}

England: CP-IS is a defined digital service

Under the adopted full-length NHS Standard Contract 2026/27, SC32.8 requires providers in the applicable service categories to comply with the defined CP-IS guidance, give relevant staff access and ensure appropriate full use, and cooperate with local partners. The category codes cover accident and emergency, acute, ambulance, community, mental-health and urgent-treatment services (A+E, A, AM, CS, MH and U). Independent providers are covered where their actual NHS contract and service fall within that scope; the clause does not bind every private service or GP merely because it provides healthcare. ^{181, 182}

DAPB1609 version 3.0 describes a limited indicator and contact exchange. It covers child-protection-plan and looked-after status, relevant dates, responsible authority/contact details and access-event information. It is not a transfer of the complete safeguarding case file. An unborn-child plan can use the mother's record; retained ended indicators have technical rules beyond age 18. These service rules do not extend the new child-sharing statute to unborn children or general adult protection. ^{310, 311, 317}

The 2024 release sits within the saved older section 250 framework, while contractual compliance has its own basis. Its notice contains inconsistent local-authority/supplier date wording, recorded in the source register. MESH, HL7v3 and Patient Flag FHIR APIs support different roles. Their availability does not make one API compulsory for every organisation. ^{192, 310, 312}

Section 16LA applies where a qualifying holder considers information about a child, or related information about another individual, relevant to safeguarding or promoting that child's welfare. The holder must disclose to a qualifying recipient if, and only so far as, it considers disclosure may facilitate the recipient's relevant functions or arranged services. The duty does not apply if the holder considers disclosure more detrimental to the child than withholding it. The duty concerns children from birth to under 18, includes qualifying requests, and has a specific confidence provision. Data protection and the stated investigatory-powers restriction still apply. Section 16LB enables standards and requires regard to any applicable published standard. Commencement of that power does not prove a particular new standard exists. Section 16LC's consistent-identifier scheme remains otherwise prospective beyond regulation-making powers. Education/childcare designation must be verified; broad guidance references alone do not prove every school is already a direct section 16LA addressee. ^{313, 317, 318, 326, 327}

Wales and Scotland: sharing law and shared systems have separate roles

In Wales, Local Health Boards, NHS Trusts, police and the other defined relevant partners have statutory reporting duties. Independent providers are not automatically relevant partners. Board requests and applicable professional, contractual or regulatory duties can have a different reach. Guidance says child reports must be made as soon as possible; adult reports as soon as possible/within one working day. Telephone reports should receive written confirmation within 24 hours. Preserve that guidance wording and its have-regard framework. ^{320, 321, 322, 323}

WCCIS and the Connecting Care programme support health/social-care records. The reviewed programme evidence and reference-data standard do not establish a universal statutory safeguarding-message interface. Actual participation and access agreements remain relevant. ^{325, 202, 200}

Scotland's Child Protection Registers, inter-agency referral discussions and police vulnerability information have defined operational roles. National child-protection guidance is non-statutory; local implementation and secure recording should be identified. The former named-person and child's-plan Parts 4 and 5 of the 2014 Act were repealed on 5 May 2025. They cannot support a current universal information-sharing duty. ^{357, 358, 360, 355, 356}

Regulatory incident notification is another exchange. A care service's notice to the Care Inspectorate, or an independent healthcare service's notice to Healthcare Improvement Scotland, does not replace the protection report to a council or police. The current portal/form instructions and the legal notification provision must both be identified. ^{362, 364, 365, 368, 369}

Northern Ireland: explicit digital procedures without a universal EPR feed

The current SBNI referral procedure requires a receiving Gateway referral to be entered on computer the same day. A verbal professional referral receives written follow-up within 24 hours, without delaying immediate protection. The Child Protection Register procedure requires enquiries to be logged on the regional electronic system, with authorised enquiry and verification arrangements. It retains legacy organisational wording, so the actual platform and migration state need local confirmation. ^{388, 376}

The August 2026 joint adult-protection protocol requires completed AJP1 referrals between HSC Trusts and the PSNI Central Referral Unit through Criminal Justice Secure Mail (CJSM). Where no joint investigation is required, the outcome is returned to the Designated Adult Protection Officer within two working days through CJSM. Immediate danger still needs emergency action. These are current regional protocol instructions, rather than a statute prescribing email or proof that every private provider can use that channel. ³⁸⁰

RQIA notification is a separate regulator exchange. For example, nursing-home regulation 30 requires specified event notices without delay and written confirmation within three days after an oral notice. Current RQIA guidance specifies its portal workflow. The statute and procedural digital route retain distinct force. ^{381, 382}

NIECR can expose defined social-care information to authorised users; encompass and EpicCare Link provide other record routes. The reviewed evidence does not prove every protection flag or case record is automatically propagated between them. Operation Encompass, the police-to-school domestic-abuse notification scheme, is distinct from encompass, the healthcare EPR. ^{389, 220, 387}

Police, education and private-provider boundaries

Send information to the agency that needs it for the justified protection task. A police investigation, social-care protection assessment and school safety plan have different purposes and information needs. Inclusion in a partnership or shared system does not entitle every participant to the whole clinical record. English section 16LA, Welsh relevant-partner reporting and NI qualifying-crime reporting each have their own addressees and tests. ^{313, 320, 373}

Private ownership does not remove all duties, but public-body legislation does not automatically cover every private service. Check the particular law, NHS contract, regulated-service status, information request and employer role. A Safeguarding Adults Board or SBNI request can reach qualifying independent organisations; Scottish section 5A is expressly permissive; regulated-provider notices have service-specific scope. ^{316, 371, 350, 382}

Specialist reporting has its own trigger and channel

The protection catalogue keeps these actors, triggers, methods, timings and limits together. This selected comparison is not a complete map of every trafficking, domestic-abuse, mental-health or other specialist notice.

Necessary information and protected access

A safeguarding disclosure still needs a documented lawful basis and confidentiality analysis. Data Protection Act Schedule 1 paragraph 18 can supply a substantial-public-interest processing condition when all its tests are met. It does not itself require a report or override confidence. Its consent provisions concern that processing condition; they do not decide every professional confidentiality or representative-access question. ^{390, 001, 002}

For doctors, GMC guidance distinguishes child concerns, adult capacity, legally required disclosure and exceptional public-interest disclosure. Record the decision and appropriate recipients. A capacitous adult's refusal usually matters where disclosure is not legally required; lack of capacity does not justify indiscriminate circulation. ^{392, 393}

Assess portal release and representative requests separately. Schedule 3 provides conditional health, social-work and child-abuse access restrictions. Paragraph 21's child-abuse restriction does not apply in Scotland; Scotland still has applicable health/social-work restrictions and its own capacity framework. Neither a parent label nor the word safeguarding justifies automatic full access or blanket withholding. ^{391, 257}

Scope of this review

This is a source-backed protection map at 3 November 2026, not an exhaustive list of every specialist statutory notice. Actual local contracts, deployment completeness, access permissions and case decisions remain unverified. The validation record retains those boundaries and future-law triggers. The catalogue records assessed duties; the evidence matrix preserves their different legal force.

Protection worked examples · Capacity and representation · Hospital discharge · Home answer