Do You Need Consent to Use Technology in Care? CQC Guidance on Sensors, Cameras and Wearables

Do You Need Consent to Use Technology in Care? CQC Guidance on Sensors, Cameras and Wearables

Falls sensors, door alarms, cameras and wearables all raise the same questions: whose consent, what must they be told and what if they lack capacity?

You may need two separate consents to use technology in someone’s care: consent to the care or treatment itself, and consent, or another lawful basis, to handle their personal data. For data, consent must be freely given, specific, informed and unambiguous, recorded, and as easy to withdraw as to give. If a person lacks capacity, follow the best interests principle and find a different lawful basis for the data if no one can consent on their behalf.

Technology is spreading through social care: bed and chair sensors, door and bed-exit alarms, motion monitoring, wearables, tablets, voice assistants and cameras. CQC’s guidance (CQC: find out if you need consent to use technology as part of someone’s care) helps providers decide when consent is needed and what it must look like.

This article extends our guides to consent in care (Regulation 11) and CCTV in care homes. It is not legal advice, and CQC recommends legal advice where you monitor people without explicit consent.

Two Different Kinds of Consent

1. Consent to the care or treatment

People must usually give consent before care or treatment, with or without technology. They must understand the benefits and risks and decide freely, without pressure. Consent might be as simple as saying yes. If someone lacks the mental capacity to consent, you must follow the best interests principle of the Mental Capacity Act. See MCA and DoLS in practice.

2. Consent to handling personal information

Technology usually collects or records information, so UK GDPR applies. You need a lawful basis for handling personal data. Consent is one lawful basis, but there are others. Consent to process data is different from consent to care, and follows different rules.

What Makes Data Consent Valid?

CQC’s guidance says consent must be “freely given, specific, informed and unambiguous”. In practice:

• Separate it clearly from other matters. You cannot hide the request in small print.
• Tell the person who you are, how you will collect their information, what type of information, why, how you will use and access it, who you will share it with, how long you will keep it, their data rights including withdrawal, and whether refusing means you cannot provide a particular service. A written privacy notice is the usual route, though you can say it aloud when more appropriate.
• Clear affirmative action. They need not sign, but they must opt in, and you must keep records showing they consented.
• Free choice. No pressure, coercion or threat. Consent is not freely given where there is a significant imbalance of power, for example if the person would feel disadvantaged by refusing.
• Easy withdrawal. People can change their minds, withdrawing must be as easy as giving consent, and you must respect refusal or withdrawal.

Health Data and Special Category Data

Information about health, race, religion, sexual orientation and similar is special category data and needs extra conditions. CQC’s example is a hospital wearable that monitors heartbeat, skin temperature and blood sugar. Because it is health data, the hospital asks for the patient’s explicit consent, with clear, complete information about collection, use and any sharing, brought to the patient’s attention rather than hidden. If the person lacks capacity and no one is appointed to decide for them, a different lawful basis is needed, and a best interests decision may be needed before the device is used at all.

What If the Person Lacks Capacity?

• Carry out and record a capacity assessment for the specific decision.
• If someone is appointed to make decisions for them, such as under a lasting power of attorney, you may be able to obtain consent from them for data handling.
• Otherwise you must find a different lawful basis for handling the personal data, and follow a best interests process for the care decision. Take legal advice.
• Consider the least restrictive option, and whether the technology amounts to a restriction. See restrictive practice.

Think About Everyone Else

CQC asks you to consider who else the technology might affect. A camera or microphone can capture other residents, staff and visitors unintentionally. Have you told them? Have they given informed consent where it is needed? CQC’s example of a person with a CCTV system in her own home, which she can switch on during carer visits, notes the carers should be told about the cameras, though they are unlikely to need to consent themselves.

A Practical Consent Checklist

1. Describe the technology, its purpose and what data it collects.
2. Decide the lawful basis for the data, and whether consent is the right one.
3. Complete a data protection impact assessment where there is high risk. See GDPR for care home records.
4. Assess capacity, and record best interests decisions where needed.
5. Give a clear privacy notice in an accessible format.
6. Record consent or the alternative lawful basis, and review it when circumstances change.
7. Make withdrawal easy, and agree what happens to existing data.
8. Consider others affected and tell them.
9. Train staff on what the technology does and does not do.

Keeping the Records

CQCLogic’s DoLS/MCA tracker and mental capacity log hold capacity assessments and review dates, the policy library keeps your technology and privacy policies with review dates, and task tracking assigns DPIA reviews and consent re-checks. Consent forms themselves should be filed in the person’s care record.