Data Protection and counselling implications

1. Lecture 6 Data Protection and
Access to Client records
Module: Law for Counsellors
Kevin Standish

3. LEARNING OUTCOMES
1. Recording therapeutic work
2. Data Protection: Core idea
3. Definition of personal data
4. The eight principles
5. Format of therapy records
6. Handling data
7. Access to therapeutic records
8. Frequently asked questions regarding record keeping

4. 1. RECORDING THERAPEUTIC
WORK
1. Professional aspects of
record keeping
2. Ethical aspects of
record keeping
3. BACP code of practice

5. 1. Issues relating to data protection and access to
records clearly impact on the central concept of
therapeutic confidentiality
2. Both the therapist disclosing information and the client
or other party obtaining such access may infringe
confidentiality, but the processes involved are often
quite distinct.
3. Persons with a statutory right of access to personal
records include clients, solicitors (in certain situations)
and external agencies, such as the police and courts.
4. The legal process of disclosure can involve the
therapist in attending court, and being required to
answer the court’s questions in the witness box.
1.1.PROFESSIONAL ASPECTS OF
RECORD KEEPING

6. The principle of
confidentiality of client
material is NOT a valid
defence on its own against
legal demands for
disclosure on judicial
grounds, or under statute

7. Therapists are engaged in record-keeping for three sets of
reasons:
1. relating to service delivery: record-keeping is useful for the
purposes of management and administration, monitoring client
progress and measuring outcomes via audits
2. therapeutic practice: record-keeping may be essential to
orient the therapist towards the client’s key issues and
relationships, and can also play a role in identifying issues to
take to supervision.
3. professional development: records can be used for personal
reflection, or may be needed for accreditation purposes, and to
contribute towards research and publication
1.1.PROFESSIONAL ASPECTS OF
RECORD KEEPING

8. 1. From an ethical perspective, record-keeping tends to
be framed in terms of professional responsibilities to
maintain confidentiality and to demonstrate respect for
the client.
2. ‘Good quality of care:
Practitioners are encouraged to keep appropriate records
of their work with clients unless there are adequate
reasons for not keeping any records. All records should
be accurate, respectful of clients and colleagues and
protected from unauthorised disclosure. Practitioners
should take into account their responsibilities and their
clients’ rights under data protection legislation and any
other legal requirements.’ (BACP, 2002: 6)
1.2. ETHICAL ASPECTS OF RECORD
KEEPING

9. Respecting privacy and confidentiality
Section 20. Respecting clients’ privacy and
confidentiality are fundamental requirements for
keeping trust and respecting client autonomy.
The professional management of confidentiality
concerns the protection of personally identifiable and
sensitive information from unauthorised disclosure.
Disclosure may be authorised by client consent or the
law. Any disclosures of client confidences should be
undertaken in ways that best protect the client’s trust
and respect client autonomy.
BACP CODE

10. 1.3. BACP CODE OF PRACTICE
‘Confidentiality:
Psychologists shall maintain adequate records, but they shall take
all reasonable steps to preserve the confidentiality of information
acquired through their professional practice or research and to
protect the privacy of individuals or organisations about whom
information is collected or held.’
(BPS, 2000: 4)
BACP advises practitioners to ‘keep
appropriate records of their work with clients
unless there are good and sufficient reasons
for not keeping any records’ (BACP, 2010)

11. Why do we keep notes on clients?

12. 1. Making and keeping notes of
client sessions fulfils a number of
therapeutic and functional
purposes for therapists and
counselling services.
2. When considering what to put in
notes there are two key issues;
what is the purpose of keeping
notes and to whom do the notes
belong?
3. The importance of notes will vary
with the context.
THE PURPOSE OF RECORDS AND
NOTES

13. Here are some of the purposes for making notes:
1. Tracking and liaison record
2. Notes for general assessment or screening
purposes
3. Session content notes
4. Notes for research
5. Notes as part of quality assurance processes
6. Medical or quasi-medical record
7. Notes and artefacts that are made by the client as
part of their treatment
8. Process notes
THE PURPOSE OF RECORDS AND
NOTES

14. 2. DATA PROTECTION
1. Core Idea
2. Personal data
3. 8 principles

16. 2.1. CORE IDEA
1. The ethical justification for record-keeping has
often been unclear. Based on a quasi-medical
model, influenced by agency practice and personal
preferences, therapeutic recordkeeping was quite
varied in its format and content and largely
protected from client access.
2. The Data Protection Act (DPA) 1998, derived from European
Directive 95/46/EC, has attempted to develop a culture of
openness and transparency with regard to personal records
kept on citizens.
3. It has had a profound impact on therapeutic
recording, by challenging the widespread
presumption held by therapists that record-
keeping is a private, professional task, to be
carried out beyond the scrutiny of clients, agency
management or the wider society.

17. According to the Act, personal data is widely
defined to cover almost every kind of
information related to an identifiable living
person, including information recorded
electronically. The Act includes within its
remit manual or handwritten records, as well
as material held on computer, thus capturing
for the first time the bulk of therapeutic
records.
2.1. CORE IDEA

18. The Act makes a distinction between personal
data, and categories of information, such as a
person’s mental, physical and sexual health,
which are termed ‘sensitive personal data’
and accordingly require higher levels of
security, such as the client’s explicit consent
for any processing.
2.2. DEFINITION OF PERSONAL
DATA

22. 2.3. THE EIGHT PRINCIPLES
1. Processed fairly and lawfully.
2. Processing personal data for specified purposes.
3. Adequate, relevant and not excessive.
4. Accurate and up to date.
5. Not kept any longer than necessary.
6. Processed in accordance with the “data subject’s” (the
individual’s) rights.
7. Securely kept.
8. Not transferred to any other country without adequate
protection in situ.

23. In practice, it means that you must:
1. have legitimate grounds for collecting and using the
personal data;
2. not use the data in ways that have unjustified adverse
effects on the individuals concerned;
3. be transparent about how you intend to use the data,
and give individuals appropriate privacy notices when
collecting their personal data;
4. handle people’s personal data only in ways they would
reasonably expect; and
5. make sure you do not do anything unlawful with the
data.
PRINCIPLE 1: PROCESSED FAIRLY AND
LAWFULLY.

24. In practice, the second data protection principle means
that you must:
1. be clear from the outset about why you are collecting
personal data and what you intend to do with it;
2. comply with the Act’s fair processing requirements –
including the duty to give privacy notices to
individuals when collecting their personal data;
3. comply with what the Act says about notifying the
Information Commissioner; and
4. ensure that if you wish to use or disclose the personal
data for any purpose that is additional to or different
from the originally specified purpose, the new use or
disclosure is fair.
PRINCIPLE 2: PROCESSING PERSONAL
DATA FOR SPECIFIED PURPOSES .

25. In practice, it means you should ensure that:
1. you hold personal data about an individual
that is sufficient for the purpose you are
holding it for in relation to that individual; and
2. you do not hold more information than you
need for that purpose.
3. So you should identify the minimum amount of
personal data you need to properly fulfil your
purpose. You should hold that much
information, but no more. This is part of the
practice known as “data minimisation”.
PRINCIPLE 3: ADEQUATE, RELEVANT
AND NOT EXCESSIVE

26. To comply with these provisions you should:
1. take reasonable steps to ensure the accuracy of
any personal data you obtain;
2. ensure that the source of any personal data is
clear;
3. carefully consider any challenges to the accuracy
of information; and
4. consider whether it is necessary to update the
information.
PRINCIPLE 4: ACCURATE AND UP TO
DATE

27. In practice, it means that you will need to:
1. review the length of time you keep personal data;
2. consider the purpose or purposes you hold the
information for in deciding whether (and for how
long) to retain it;
3. securely delete information that is no longer
needed for this purpose or these purposes; and
4. update, archive or securely delete information if it
goes out of date.
PRINCIPLE 5: NOT KEPT ANY
LONGER THAN NECESSARY

28. the rights of individuals that it refers to are:
1. a right of access to a copy of the information
comprised in their personal data;
2. a right to object to processing that is likely to cause or
is causing damage or distress;
3. a right to prevent processing for direct marketing;
4. a right to object to decisions being taken by automated
means;
5. a right in certain circumstances to have inaccurate
personal data rectified, blocked, erased or destroyed;
and
6. a right to claim compensation for damages caused by
a breach of the Act.
PRINCIPLE 6: PROCESSED IN ACCORDANCE WITH THE
“DATA SUBJECT’S” (THE INDIVIDUAL’S) RIGHTS

29. In practice, it means you must have appropriate security to
prevent the personal data you hold being accidentally or
deliberately compromised. In particular, you will need to:
1. design and organise your security to fit the nature of the
personal data you hold and the harm that may result from a
security breach;
2. be clear about who in your organisation is responsible for
ensuring information security;
3. make sure you have the right physical and technical
security, backed up by robust policies and procedures and
reliable, well-trained staff; and
4. be ready to respond to any breach of security swiftly and
effectively.
PRINCIPLE 7: SECURELY KEPT

30. Personal data shall not be transferred to a
country or territory outside the EU unless that
country or territory ensures an adequate level of
protection for the rights and freedoms of data
subjects in relation to the processing of personal
data.
PRINCIPLE 8: NOT TRANSFERRED TO ANY OTHER COUNTRY
WITHOUT ADEQUATE PROTECTION IN SITU.

32. 3. FORMAT OF THERAPY
RECORDS
1. Relevant filing system
2. Process notes
3. Handling Data

33. • the Data Protection Act has presented challenges to therapists
in subjecting to public scrutiny what had previously been a
private professional activity (Jenkins, 2002).
• Therapists tend to define record-keeping in terms of the
purpose of the record. Therapist tend to distinguish between
objective official agency record of client contact and more
personal, subjective records, known as process notes :
• Data protection law however, defines records on a completely
different basis.
• Records are defined firstly in terms of context, so that records
kept in health, education and social work settings have
separate provisions, deriving from the reforms initiated by the
Gaskin case
• Records are further defined by format, rather than by purpose.
Thus records are categorised as electronic or manual.
• Manual, or handwritten, records are further subdivided into
those which are part of ‘a relevant filing system’ and those
which are ‘unstructured’. These distinctions are crucial for
determining issues of client access
3. FORMAT OF THERAPY RECORDS

34. 1. For therapy records more generally, it seems
that the Act has been instrumental in changing
practitioners’ recording practice.
2. It is increasingly based on the presumption of
client access and has become more factual
and less subjective in nature (Jenkins and
Potter, 2007).
3. FORMAT OF THERAPY RECORDS

35. GASKIN CASE

36. 3.1. RELEVANT FILING SYSTEM
it is intended to cover non-automated records that are
structured in a way which allows ready access to information
about individuals.
As a broad rule, a relevant filing system exists where records
relating to individuals (such as personnel records) are held in
a sufficiently systematic, structured way as to allow ready
access to specific information about those individuals.
"Accessible record" means: a health record that consists of
information about the physical or mental health or condition
of an individual, made by or on behalf of a health professional
(another term defined in the Act) in connection with the care
of that individual

38. WOULD PRIVATE PRACTISE FALL UNDER
RELEVANT FILING SYSTEM?

39. FREEDOM OF INFORMATION ACT 2000
However the Freedom of information act
amended the Data Protection Act 1998 to
provide for the right of data subject to have
access to ‘unstructured personal data’ held by
public authorities.

40. • These were defined as including Local Authorities, the
NHS, maintained schools and other educational
institutions, the police and a long list of public bodies,
ranging from the Advisory Committee on NHS Drugs to
the Zoo Forum.
• Agencies not classed as a ‘public authority’, or
practitioners in private practice, whose records are not
held in relevant filing systems, may be exempt from
provisions for client access.
• However, from an ethical and professional perspective,
denying client access on legal grounds alone might be
seen to be contrary to the move within the profession
towards adopting more open and accessible forms of
recording, even where these are not formally required
by the law.
PUBLIC BODIES DEFINED

41. Session content notes usually
form part of a counselling service
record.
1. These notes are made by
therapists to indicate that a
session has taken place and
to give a general overview of
what was covered in a
session and/or any other
matters which the therapist
considers necessary as an
aide mémoire for the therapy,
or made in compliance with
agency policy or legislation.
2. What is important is that
content notes are accurate
and an authentic, usually
brief, summary of what was
discussed
Process notes: there is a long tradition of
keeping process notes in therapy. They may
be optional, handwritten notes, or they may be
held on computer.
Process notes are usually made by therapists
to bring to supervision or to engage in
personal reflection on the therapeutic
relationship.
If process notes identify the client directly by
name, or contain data that could identify the
client (personally identifiable information),
then they are part of the client record, and
subject to the law and duty of confidentiality.
They should be retained with the client
records.
Process notes that are completely anonymous
(i.e. contain no personally identifiable
information and so do not identify the client in
any way) may be treated as separate from the
client records and destroyed when no longer
required.
See Bond, T. and Mitchels, B. (2008: 68–71).
3. 2. SESSION NOTES: CONTENT VS
PROCESS NOTES

42. 3.3. HANDLING DATA
It is equally important NOT to:
a) access personal data that you do not need
for your work
b) use the data for any purpose it was not
explicitly obtained for
c) keep data that would embarrass or damage
you or the client if disclosed
d) transfer personal data outside of the
European Economic Area unless you are certain
you are entitled to or consent from the individual
concerned has been obtained
e) store/process/handle sensitive personal data
not relevant to the purpose.

43. • The law refers to a number of different types of records.
Client access varies according to the nature of the
record, rather than its content
Records may be of several types including:
1. Accessible records: i.e. health, education and social
work records and records held by public Authorities
2. Computerised records, i.e. records held in electronic
form
3. Computerised records held in combination with
manual or handwritten records
4. Manual or handwritten records as the sole form of
recording by an individual or organisation
5. Audio and video recordings, on tape, digital or created
and stored with any other form of technology
3.3. DIFFERENT TYPES OF RECORDS
DETERMINE ACCESS

46. SUMMARY

47. 4. FREQUENTLY ASKED QUESTIONS
REGARDING RECORD KEEPING
1. Therapist obliged to
keep notes?
2. Who owns the notes?
3. Time limits for keeping
records

48. • Therapeutic notes and records may include handwritten
or computer-based notes, audio tape and video tape or
digital recordings, and may include written, visual or
audio material for example drawings, poems, songs and
other artefacts created by the client or created in
connection with the therapeutic work.
• Therapists are not specifically required by law to keep
therapeutic records, although this may be an obligation
imposed by their contract with an agency or employer.
HOWEVER:
• BACP’s Ethical Framework states that :“Practitioners are
encouraged to keep appropriate records of their work
with clients unless there are adequate reasons for not
keeping any records. All records should be accurate,
respectful of clients and colleagues and protected from
unauthorised disclosure, (BACP, 2007: 5.5).
4.1. THERAPIST OBLIGED TO KEEP
NOTES?

49. 1. The client contract should make the ownership of
the records clear.
2. Notes on clients made by a therapist employed by
an organisation or agency in the course of that
work are, generally speaking, the property of the
employing organisation.
3. Notes kept by a therapist in private practice
belong to that therapist.
4. Records kept by a self-employed therapist
providing a service for a referring agency, such as
an Employee Assistance Programme, may be
designated as agency property under the terms of
the contract existing between the agency and
therapist.
4.2. WHO OWNS THE NOTES?

50. 5. In law, unless otherwise agreed with the
client, tape and video recordings are
usually deemed to belong to the owner of
the tape or video,
6. photographs belong to the owner of the
negatives or in the case of digital images,
the owner of the camera.
7. However, ‘ownership’ of records is not a
deciding factor regarding issues of
disclosure or client access
4.2. WHO OWNS THE NOTES?

51. 1. Personal data should not be held any longer than
necessary for its purpose.
2. Certain types of record, e.g. NHS records, are
classed as ‘public records’, with specified periods
for retention. For example, records of patients
defined as ‘mentally disordered’ are kept for 20
years after their last treatment, or 8 years after the
patient’s death.
3. Where there is no set time limit which applies to
therapeutic records, therapists and their
organisations need to decide an appropriate time
limit for keeping records before destruction.
4.3. TIME LIMITS FOR KEEPING
RECORDS

52. 4. These might be set to accord with the relevant
time limits for responding to a complaint
against a therapist or agency under the BACP
or other Professional Conduct Procedures or
to comply with the time limits for legal actions.
5. The normal time limit for legal action by the
client for personal injury is three years from
the incident or three years from the date when
the individual could have reasonably known
the problem had arisen. The time limit on legal
action for breach of contract is six years.
4.3. TIME LIMITS FOR KEEPING
RECORDS

53. Essential reading
• Jenkins (2007) 6 - Data Protection and Access to Client
Records..
• Mitchels, B. & Bond, T (2008):
1. chapter 6 recordkeeping – basic responsibilities
2. chapter 7 how long to keep records?
3. Chapter 9 sharing information between professionals
4. chapter 12 recording confidences practical guidelines
• Bond, T. (2010) chapter 13 record keeping
• Jenkins (2002) Chapter 5 - Transparent Recording:
Therapists and the Data Protection Act 1998
CORE READINGS

54. Essential reading:
• BACP G1 information sheet: Access to records of counselling and
psychotherapy by Tim Bond & Peter Jenkins (2009)
• P12 Information sheet: Making notes and records of counselling
and psychotherapy sessions by Liz Coldridge (2010)
• Please see What is personal data? – A quick reference guide
Data Protection Act 1998 on ICO website:
http://ico.org.uk/for_organisations/data_protection/the_guide/~/media/do
cuments/library/Data_Protection/Detailed_specialist_guides/determining
_what_is_personal_data_quick_reference_guide.ashx
Advanced reading
1. Tribe, R. & Morrissey, J (editors) (2005) chapter 6 client
confidentiality and data protection by Peter Jenkins
2. chapter 9 the ethics and responsibilities of recordkeeping and note
taking by David Purves
3. Jenkins (2002) Appendix 2: Therapy Notes and the Law
READINGS