Little Things - Paediatric Occupational Therapy
Confidentiality and Information Security Policy
Version: 1.0
Date: October 2026
Review date: October 2027
Policy owner: Little Things - Paediatric Occupational Therapy
1. Purpose
Little Things - Paediatric Occupational Therapy is committed to protecting the confidentiality, privacy and security of all personal information entrusted to the service.
This policy explains how confidential information is accessed, used, stored, shared and protected when providing paediatric occupational therapy services.
It applies to all personal information relating to children, parents, carers, schools, referrers and other professionals.
2. Confidentiality principles
Little Things will:
Treat personal and clinical information as confidential.
Access and use information only where necessary for a legitimate professional or business purpose.
Collect and retain only information necessary for the service provided.
Ensure information is accurate, relevant and handled securely.
Explain confidentiality arrangements to parents and, where appropriate, children.
Respect children’s privacy, rights and developing understanding.
Share information only when authorised, necessary and supported by an appropriate lawful basis.
Follow applicable data protection legislation and professional confidentiality obligations.
3. Access to information
As a sole-practitioner service, access to clinical records and business information will be restricted to the practitioner, except where access by an authorised service provider or other person is necessary and appropriately controlled.
Information will not be accessed, discussed or disclosed out of curiosity or for personal reasons.
Where external professionals require information, only information relevant to the purpose will be shared.
4. Secure storage of records
Personal and clinical information will be stored using appropriate security measures.
These may include:
Password-protected devices and accounts.
Secure electronic folders or clinical record systems.
Multi-factor authentication where available.
Device encryption and automatic screen locking where supported.
Secure backups and software updates.
Restricted access to electronic and paper records.
Locked storage for paper records.
Secure disposal of documents and electronic information when no longer required.
The practitioner will assess the suitability of any systems used to store children’s clinical records and ensure that appropriate safeguards are in place.
Operational arrangements: The specific devices, storage platforms, backup arrangements and paper-record procedures used by Little Things will be documented and reviewed before clinical services begin.
5. Email and electronic communication
When communicating with parents, carers, schools or other professionals, the practitioner will take reasonable steps to ensure information is sent securely and to the correct recipient.
This includes:
Checking recipient addresses before sending messages or attachments.
Sharing only information necessary for the purpose.
Avoiding unnecessary sensitive details in email subject lines.
Using appropriate secure transfer methods for reports and clinical documents.
Taking care when using shared devices, public Wi-Fi or public spaces.
Avoiding the use of personal messaging or social media accounts for clinical information unless an appropriate, secure arrangement has been assessed and authorised.
Where a message or document is sent to the wrong recipient, the practitioner will assess the incident and take appropriate action.
6. Confidentiality during home and school visits
During visits, the practitioner will take reasonable steps to prevent confidential information being seen, heard or accessed by people who do not need it.
This includes:
Keeping paperwork and devices secure while travelling.
Avoiding clinical discussions where they may be overheard.
Storing notes securely after visits.
Taking care when discussing a child’s needs with family members, school staff or other professionals.
Confirming that the person receiving information is authorised to receive it.
Information will not be discussed with other families or unrelated individuals.
7. Sharing information and consent
Information will normally be shared with relevant people involved in supporting a child where there is an appropriate legal basis and the sharing is necessary for the child’s care.
Where consent is the appropriate basis for sharing, informed consent will be obtained and recorded.
Before sharing information with parents, carers, schools or other professionals, the practitioner will consider:
The purpose and necessity of the disclosure.
The child’s age, understanding, competence and confidentiality rights.
Parental responsibility and any relevant legal arrangements.
The information the recipient genuinely needs.
Applicable legal and professional obligations.
Consent will not be treated as the only possible justification for sharing information. Information may be shared without consent where there is a valid legal basis or another lawful justification, including certain safeguarding situations.
8. Safeguarding and limits to confidentiality
Confidentiality is important but is not absolute.
Where there is a safeguarding concern, risk of serious harm, or a legal requirement to disclose information, the practitioner will follow the Safeguarding and Child Protection Policy and seek appropriate advice where necessary.
Information will be shared proportionately and with relevant people or agencies, in accordance with applicable law and safeguarding procedures.
Where appropriate and safe to do so, the child and/or parent or carer will be informed that information is being shared and why. This may not be possible where doing so could increase risk or compromise a safeguarding response.
9. Confidentiality and professional boundaries
The practitioner will maintain appropriate professional boundaries when communicating with children, families and other professionals.
Confidential information will not be shared through personal social media, informal conversations or other inappropriate channels.
Information will not be used for publicity, case studies, photographs or testimonials in a way that identifies a child without an appropriate lawful basis and any required consent or permissions.
10. Data breaches and security incidents
A data breach may include:
A lost or stolen device or document.
An email or report sent to the wrong recipient.
Unauthorised access to a record or account.
Accidental disclosure of confidential information.
Loss, alteration or destruction of personal information.
If a breach or suspected breach occurs, the practitioner will:
Take immediate reasonable steps to contain the incident and protect affected information.
Establish what information has been affected and who may be at risk.
Record the incident, actions taken and outcome.
Assess the likelihood and severity of harm to affected individuals.
Notify affected individuals and the Information Commissioner’s Office where required by law.
Review the incident and take steps to reduce the risk of recurrence.
Where the UK GDPR requires notification to the ICO, this will be made without undue delay and, where feasible, within 72 hours of becoming aware of the breach.
11. Retention and secure disposal
Information will be retained and disposed of in accordance with the Record Retention and Disposal Policy.
Records will not be kept indefinitely without a valid reason. When information is no longer required, it will be securely deleted, destroyed or otherwise disposed of in a way that prevents unauthorised access.
12. Training and review
The practitioner will maintain appropriate knowledge of confidentiality, information security and data protection obligations and will seek relevant training or professional guidance where necessary.
This policy will be reviewed annually and sooner if there are significant changes to the service, relevant legislation, professional guidance or information-handling arrangements.
13. Related documents
This policy should be read alongside:
Privacy Notice.
Record Retention and Disposal Policy.
Safeguarding and Child Protection Policy.
Consent and Parental Responsibility Policy.
Complaints Policy.
Health and Safety Policy.
Lone Working Policy.
Review date: October 2027, or sooner if required.