The right information, not all information: why secure information sharing matters for WorkWell

WorkWell is asking organisations that have traditionally operated in different parts of the system to work together to support people.

WorkWell is the UK Government programme aimed at helping people with health conditions or disabilities to stay in work, return to work or find employment through joined-up health and employment support.

A person might be referred to WorkWell by their GP, Jobcentre Plus, an employer, a Local Authority service, a VCSE organisation or through self-referral. Their support might then involve a Work and Health Coach, healthcare professional, employment service, community organisation or several of these at different points.

For that experience to feel joined up, information has to move with the person. But that does not mean every organisation needs access to everything.

As Integrated Care Boards (ICBs) and their local WorkWell delivery partners design or expand their WorkWell services, getting that distinction right will be fundamental.

Information sharing is becoming a delivery issue

The latest WorkWell guidance makes the importance of information sharing particularly clear.

The guidance recommends beginning work on local data-sharing agreements at the earliest opportunity because they can take a long time to agree with partners. Before go-live, ICBs will also be required to provide details of their WorkWell design approach, including governance and data protection arrangements and whether data-sharing agreements or memoranda of understanding are in place where required.

That makes secure information sharing much more than an information governance exercise. It is part of designing how WorkWell will actually operate.

It is also a productivity issue. 

If staff have to spend time chasing referral updates, checking whether another organisation has acted or asking people to repeat information, that creates avoidable administration across the partnership. Designing information flows well from the outset can help WorkWell teams use their capacity more effectively as services scale.

If organisations cannot access the information they need, referrals may require follow-up emails, telephone calls or manual checking. Partners can be left unclear about what has happened elsewhere or what they need to do next.

Creating a large, shared record and making it widely available is also not the right answer. WorkWell brings together organisations with very different responsibilities. The information relevant to a healthcare professional may be very different from what an employment adviser or community organisation needs to deliver their part of someone's support.

The challenge is therefore not simply to share more information.

It is to make the right information available to the right people at the right point in the person's journey. 

A shared view does not mean sharing everything

A Work and Health Coach might need to know that somebody has been referred to a mental health service, whether that referral has been accepted and whether there are actions that affect the person's return-to-work plan.

They may not need access to the person's full clinical record.

Similarly, a VCSE partner providing debt, housing or wellbeing support may need enough information to understand the referral, the person's circumstances and the outcome expected from their service. They do not necessarily need visibility of everything being held elsewhere in the pathway.

This is where well-designed role-based access becomes important.

Instead of thinking about secure information sharing as a choice between isolated systems and completely open records, WorkWell partnerships can design access around the roles different partners play.

That allows information to support joint working while maintaining appropriate boundaries.

It is also consistent with the wider principle of data minimisation. Organisations should only collect and use personal information that is adequate, relevant and limited to what is necessary for the purpose for which it is being processed. 

For WorkWell, that principle should become part of the operating model rather than simply a compliance requirement.

What information needs to follow the person?

This raises a useful question for WorkWell partnerships designing their service:

What does each partner need to know to take the next action?

That could include:

• reason for referral and relevant information about the person's needs and circumstances
• which organisations are already supporting them
• agreed actions, outcomes and progress.

The answer will vary between services and local WorkWell delivery models, but defining it is important.

WorkWell's success will depend on multiple organisations being able to contribute to a person's journey without every handover effectively starting that journey again.

Secure sharing should also create accountability

There is another part of information sharing that receives less attention: knowing who has added or changed information and what actions have been taken

When several organisations contribute to the same pathway, accountability becomes more complex.

• Who received and reviewed the referral?
• What information or actions have been added or changed?
• Has another organisation accepted the referral?
• Who is responsible for the next action?

A secure multi-agency digital environment should make those actions visible and auditable.

This matters for information governance and day-to-day delivery. Without that visibility, people can still fall between services even if information has technically been “shared”.

The aim should therefore be more than moving data between organisations. It should be creating a clear auditable record of how different partners are working around the person.

Technology cannot replace good information governance

Of course, technology alone does not solve information sharing.

WorkWell partnerships still need to agree why information is being shared, what information is necessary, which organisations are responsible for it and what legal and governance arrangements apply.

The Information Commissioner’s Office is clear that organisations need to identify a lawful basis before sharing personal information and be able to demonstrate that they have considered this before sharing began.  Because health information is special category data, organisations must also identify an appropriate condition for processing it.

That means governance, operational design and technology need to develop together.

A digital platform cannot decide the purpose of information sharing for a partnership.

What it can do is help turn the agreed model into something that works in day-to-day delivery.

How RIVIAM supports secure multi-agency working

This is an area RIVIAM understands well.

Our care co-ordination platform has been designed to connect referrals, workflows and information across NHS, Local Authority, VCSE and other partner organisations while maintaining appropriate controls around access.

RIVIAM supports role-based access, which can be configured so users only see information relevant to their role and organisation. Activity can be audited, consent can be managed where required, and RIVIAM can connect with existing NHS and Local Authority systems so information flows between services. This approach is already supporting multi-agency working in Bath and North East Somerset.

While the Community Wellbeing Hub is not a WorkWell service, it demonstrates how these principles can operate in a multi-agency environment. Through the Community Wellbeing Hub, organisations across health, social care and the voluntary sector use RIVIAM to co-ordinate support through a shared digital environment. Partners can work around the same person while role-based security controls what information they can access, with an auditable record of activity.

RIVIAM is also ISO 27001 certified, providing independent assurance that information security risks, responsibilities and controls are managed systematically.

For WorkWell, the same principles can help ICBs and their local partners create delivery models where information flows without removing the boundaries needed to keep it safe.

Design information sharing around the journey, not the organisations

The opportunity with WorkWell is not simply to connect another collection of services.

It is to make health, employment and community support feel like one joined-up journey for the person receiving it.

Achieving that requires WorkWell partnerships to think beyond whether data-sharing agreements exist and ask how information will work operationally once referrals begin moving between partners.

• What information should follow the person?
• Who needs to see it—and who should not?
• How will partners know what has already happened?
• How will responsibility for the next action remain clear?

For the person receiving support, the difference should be tangible: fewer repeated conversations, greater confidence that the person they are speaking to understands what has already happened, and clearer expectations about who is supporting them and what happens next.

Getting those questions right early will make it easier to build WorkWell services that are both joined up and trusted.

Effective information sharing is not about giving everyone access to everything. It is about making sure every partner has the information they need to do their part well.

To learn how RIVIAM could support your local WorkWell delivery model, visit our WorkWell page or email [email protected].