Executive summary

i) In the light of the requirements in The Protection and Use of Patient Information and taking into account work undertaken by a joint Department of Health (DH) and British Medical Association (BMA) Working Group which has been considering NHS Information Management and Technology (IM&T) security and confidentiality, the Chief Medical Officer established the Caldicott Committee to review all patient-identifiable information which passes from National Health Service (NHS) organisations in England to other NHS or non-NHS bodies for purposes other than direct care, medical research, or where there is a statutory requirement for information.

ii) The purpose was to ensure that patient identifiable information is only transferred for justified purposes and that only the minimum necessary information is transferred in each case. Where appropriate, the Committee was asked to advise whether action to minimise risks of breach of confidentiality would be desirable.

iii) The work of the Committee was carried out in an open and consultative manner. Written submissions were sought from many organisations to identify existing concerns, and members of the Committee have met with representatives of a number of key bodies. Working groups containing a wide range of health professionals and managers were established to consider related groups of information flows and to take soundings on emerging findings.

iv) Some 86 flows of patient-identifiable information were mapped relating to a wide range of planning, operational or monitoring purposes. Some of these flows were exemplars, representing locally diverse information flows with broadly similar characteristics and purposes.