Topic 1.10 — Safeguarding in Digital Services

In health and care, a digital service that reveals where a woman lives, lets a controlling partner read her messages, or gives an abuser access to a child's record has caused harm as real as a clinical error — so safeguarding must be designed in, not bolted on.

Why this matters in health and care#

Safeguarding is the set of statutory duties to protect children and adults at risk from abuse, harm and neglect. In England these duties flow from the Children Act 2004, the Care Act 2014 and multi-agency guidance such as Working Together to Safeguard Children. They are not optional add-ons to a digital programme; they are legal obligations that follow your service wherever it touches a vulnerable person.

Digital services change the safeguarding picture in two directions at once. They create new opportunities — a young person may disclose self-harm through a messaging channel they would never raise face-to-face, and a shared record can surface a pattern of missed appointments that flags neglect. They also create new risks. An appointment reminder text, a repeat-prescription notification, or a proxy-access grant can leak a person's location, diagnosis or whereabouts to exactly the person they are hiding from.

The people most exposed to these risks are often the same people who are hardest to reach. Victims of domestic abuse, children in care, adults who lack capacity, and people experiencing coercion tend to have less control over their own devices, accounts and post. When you design a patient app or a shared care record, you are quietly making decisions about who can see what — and for someone living with an abuser, that decision can be a matter of physical safety. This is why safeguarding sits alongside clinical safety (see Topic 1.6 — Clinical Safety & Risk Management) and information governance (see Topic 1.7 — Information Governance, Data Protection & Cyber Security) as a core condition of a service being safe to run at all.

Core concepts#

Safeguarding is the umbrella term for protecting people's health, wellbeing and human rights so they live free from abuse, harm and neglect. It splits into two related but distinct regimes: child protection for anyone under 18, and adult safeguarding for adults with care and support needs who cannot protect themselves — the latter grounded in the Care Act 2014. Both operate through multi-agency working: health, social care, police, education and the voluntary sector share information and act together, because no single organization sees the whole picture.

The Mental Capacity Act 2005 governs decisions made for adults who lack the capacity to make a particular decision themselves. It matters intensely for digital access: capacity is decision-specific and can fluctuate, so "granting a carer full access to the app" is rarely a single, permanent choice. Proxy and delegated access — a parent acting for a young child, a carer for an older adult, an attorney under a lasting power of attorney — must be justified, proportionate, and reviewed, especially as a child approaches the age at which they gain their own confidentiality rights.

Several forms of harm are amplified by digital design. Domestic violence and controlling behavior in relationships — coercive control — turn ordinary features into weapons: a shared login becomes surveillance, a location-revealing notification becomes a tracking beacon. Stalking exploits any data point that discloses routine or whereabouts. "Safeguarding by design" is the discipline of anticipating these harms and building in the ability to hide, redact, suppress or delay information for people at risk.

Two more concepts complete the picture. Authentication and identity verification determine whether the person accessing a service is who they claim to be — the front line against impersonation, and the mechanism through which a strong digital identity either protects or endangers. Where a service hosts peer support, forums or messaging, content moderation and the duties under the Online Safety Act 2023 govern how you keep people safe from harmful content and from each other.

Best practices#

1. Treat safeguarding as a design requirement, not a policy document. Write safeguarding scenarios into your discovery and user research from the first sprint, alongside clinical and accessibility needs (see Topic 1.9 — Digital Inclusion & Accessibility). Ask, for every feature that shows or sends information: "What if the wrong person sees this?" A safeguarding-by-design review should be a named gate in your delivery lifecycle, with a clinician or safeguarding lead signing it off, not a box ticked at go-live.

2. Make sensitive data hideable, suppressible and redactable by default capability. Every notification, reminder, letter and shared-record view should have a documented way to be suppressed, made generic, or redirected for a person at risk. A woman fleeing an abuser may need appointment reminders switched off, her address flagged as sensitive, and specific record entries hidden from proxy viewers. Build these controls once, centrally, so a frontline worker can apply them in minutes rather than filing a change request that takes weeks.

3. Design proxy and delegated access to be granular, time-bound and reviewable. Proxy access is a genuine good — carers and parents need it — but "all or nothing, forever" is dangerous. Support partial access (e.g. bookings but not clinical notes), automatic review points (notably when a child turns 11 and again at the age they gain confidentiality rights, commonly 16), and one-click revocation. Anchor every grant in a capacity or best-interests judgement consistent with the Mental Capacity Act, and record who authorized it and why.

4. Verify identity proportionately, and defend against impersonation. Weak verification lets an abuser register as, or link to, their victim; heavy verification excludes the very people who most need care. Match assurance to risk: booking a routine appointment needs less than granting proxy access to a teenager's mental-health record. Use recognized identity assurance approaches (NHS login, GOV.UK One Login patterns) and watch for the tell-tales of coercion — the same phone number or device linked to many accounts, or a "carer" who resists any direct contact with the patient.

5. Build clear escalation and referral into the service, not around it. When a member of staff — or an automated signal — spots a safeguarding concern through a digital channel, the path to a referral must be obvious, fast and logged. Integrate with local authority multi-agency safeguarding hubs (MASH) and named safeguarding leads, and make sure a concern raised at 2am through a messaging service reaches a human who can act. Never let a digital service become a place where disclosures are received but not routed.

6. Moderate hosted spaces actively and lawfully. If your service hosts peer support, forums or user-to-user messaging, you have both a duty of care and, under the Online Safety Act 2023, legal duties around illegal and harmful content. Combine automated filtering with trained human moderators, clear reporting tools, and escalation routes for disclosures of abuse, self-harm or suicidal intent. Publish the rules, respond to reports within a stated time, and preserve evidence appropriately when you refer on.

7. Train staff to recognize and respond to risk through digital channels. Recognizing abuse over chat, video or a portal message is a different skill from recognizing it in a clinic. Give frontline and contact-centre staff scenario-based training on digital disclosure, coercion signs, and the mechanics of applying record redaction and notification suppression. Safeguarding leads should understand the system's controls well enough to direct their use under pressure.

8. Remember that digital exclusion concentrates among people at risk. The groups most likely to be excluded — people experiencing abuse, those with cognitive impairment, care leavers, people in poverty — overlap heavily with those the service most needs to protect. A "digital by default" channel can cut them off from help, or force them onto a device an abuser controls. Always keep a safe non-digital route, and treat exclusion itself as a safeguarding risk (see Topic 1.9 — Digital Inclusion & Accessibility and Topic 3.3 — Patient & Citizen-Facing Digital Services).

9. Log, audit and review access to catch misuse. Maintain tamper-evident access logs, run proactive audits for anomalous access (a proxy viewing far more than expected, staff looking up records without a care relationship), and give patients transparency over who has seen their data. Auditability both deters insider abuse and provides evidence when a concern is investigated. Feed patterns back into design so recurring risks are engineered out.

Questions to discuss with your team#

1. For every piece of information our service shows or sends, who could be harmed if the wrong person saw it — and can a frontline worker stop that within minutes? This question forces you past the "happy path" user and onto the person living with an abuser, the teenager whose parent still holds proxy access, the adult whose whereabouts must stay hidden. The tension is between convenience for the majority and safety for a vulnerable minority: default-on reminders and rich shared records help most people and endanger a few. Walk through concrete flows — an appointment SMS, a repeat-prescription notification, a proxy view of clinical notes — and ask who holds the device and the account in each case. A good answer names the specific controls (suppression, redaction, sensitive-address flagging), confirms a non-technical worker can apply them quickly, and admits honestly where today the only option is a slow manual workaround that leaves people exposed in the meantime.

2. How do we handle proxy and delegated access as capacity, age and relationships change over time? Proxy access is rarely wrong at the moment it is granted and often wrong later — the child grows up, the carer relationship breaks down, capacity fluctuates. The debate should surface how you detect and act on these transitions rather than leaving stale access in place. Consider the eleven-year-old whose parent still sees everything, the adult whose attorney's interests have diverged from their own, the person whose capacity returns after a crisis. Ground the discussion in the Mental Capacity Act's principle that capacity is decision-specific and presumed. A strong answer describes automatic review triggers, granular access levels, easy revocation, and a clear record of who authorized each grant and on what basis — and is honest about how much of this is currently manual or missing.

3. When someone discloses harm or abuse through a digital channel, what exactly happens next — and how do we know it worked? Digital channels invite disclosures that never surface in a clinic, which is a genuine opportunity, but only if the disclosure reaches someone who can act. The discussion should trace the full path from a chat message at 2am, a portal note, or an automated risk flag, through to a logged referral to a multi-agency safeguarding hub or named lead. Debate the hard edges: out-of-hours cover, the boundary between the service's duty and statutory services, and what happens when a moderated forum surfaces a suicidal post. Look at your own incident and referral data — are disclosures being received but not routed? A good answer shows a tested, logged, human-backed escalation route, names who owns it, and can point to evidence that referrals actually complete rather than assuming they do.

4. How would we know if our own service were being used to abuse, stalk or coerce someone — and who is watching for it? The dangerous cases rarely announce themselves; the abuser looks like a legitimate proxy, a caring relative, or the account holder themselves. This question shifts the team from designing controls to actively detecting misuse: the shared device linked to a dozen accounts, the proxy who reads far more than the child's care requires, the "carer" who blocks every direct contact with the patient. Debate what signals you could surface from access logs and registration data, who is accountable for reviewing them, and how a suspicion becomes a safeguarding action rather than a note nobody reads. Weigh the privacy cost of proactive monitoring against the harm of staying blind. An honest answer names the anomalies you would look for, says who owns the audit, and admits where today misuse would simply go unnoticed until someone is hurt.

5. When safety and privacy pull in opposite directions, how do we decide — and who is in the room? Safeguarding is not a clean win for data protection: hiding a record from a proxy, sharing a concern with the police, or overriding a person's stated wishes can all sit in tension with confidentiality and the person's own autonomy. This question forces the team to name the trade-offs explicitly rather than letting whichever discipline shouts loudest decide by default. Consider the adult with fluctuating capacity who asks you to grant access their best interests may not support, or the multi-agency share that protects a child but breaches an adult's expectation of privacy. Ground the debate in the Mental Capacity Act, the Caldicott principles and the lawful bases for sharing to prevent serious harm. A good answer describes who adjudicates these calls — safeguarding, clinical-safety and information-governance leads together — how the reasoning is recorded, and how you avoid both reflexive over-sharing and paralysed under-sharing.

6. How do we keep safeguarding working as the service, its suppliers and the threats around it change? Safeguarding controls decay: a new release quietly re-enables a default notification, a third-party messaging supplier changes its moderation, a platform update breaks a suppression rule, and a new coercion tactic emerges that nobody designed for. This question makes the team treat safeguarding as a living property of the running service, not a one-time gate passed at go-live. Discuss how change control, supplier assurance and post-incident learning feed back into the controls, and who re-tests the at-risk configuration after each significant change. Look at whether regression testing covers safeguarding scenarios at all. An honest answer points to a named owner, a review cadence, evidence that controls are re-checked after changes, and a mechanism for folding new threats and near-misses back into design rather than rediscovering them through harm.

In practice: a health & care example#

An integrated care system (ICS) rolls out a shared care record and a companion patient app across its acute, community, mental-health and social-care partners. Early adoption is strong, and proxy access is enabled so parents can manage children's care and carers can support older relatives.

Three months in, a community midwife raises a concern. A pregnant woman has quietly asked whether her partner, who has proxy access to their toddler's record, can see her appointments and address. He can: the proxy relationship was set up at registration and grants broad visibility, and her antenatal appointment reminders are sent by default SMS to a phone he sometimes checks. The woman is being controlled and is planning to leave; the service, as configured, is helping her abuser track her.

The safeguarding lead convenes the digital, clinical-safety and information-governance leads. In the short term they apply a sensitive-address flag, suppress her SMS reminders in favour of a phone call to a safe number, and revoke the partner's ability to see her records while preserving his legitimate access to the child's. They discover this took a day of manual effort across three systems — far too slow to be safe at scale.

The lasting fix is a design change. The ICS builds a single "at-risk" configuration a frontline worker can apply in minutes: it suppresses or genericizes notifications, hides the sensitive record from named proxies, and routes future correspondence to a safe channel. They add an eleven-and-sixteen review trigger to all child proxy grants, tighten identity checks on new proxy links, and train contact-centre staff to recognize coercion signals. The change is logged as a clinical-safety and safeguarding improvement, reviewed at the ICS assurance board, and shared with neighbouring systems using the same platform.

Sector lenses#

Startup#

A small digital-health company building, say, a teen mental-health app carries safeguarding risk that far outweighs its headcount — its users are minors disclosing self-harm and abuse. With limited resources, the temptation is to defer moderation and escalation to "later", but a single unhandled disclosure of suicidal intent is an existential and ethical failure. Prioritize a lean but real safeguarding stack from day one: a trained on-call responder or a contracted crisis-escalation partner, clear content rules, and identity checks proportionate to risk. Bake safeguarding acceptance criteria into your definition of done, and be ready to evidence them for buyers under DTAC and for the Online Safety Act 2023.

Small business#

An established small provider — a GP practice, a community pharmacy, a care home or a domiciliary-care agency — carries the same safeguarding duties as a large trust but has no dedicated digital or IT team to apply them. It typically runs supplier-provided systems it cannot reconfigure, so the practical task is knowing which safeguarding controls those systems already offer and how to use them fast: suppressing an appointment reminder, flagging a sensitive address, hiding a record from a proxy. Nominate a named safeguarding lead and make sure at least one person knows how to apply notification suppression and proxy revocation without waiting on the supplier. Because cash and time are tight, lean on shared resources — CQC expectations, local authority MASH contacts, and NHS England proxy-access guidance — rather than building your own, and press suppliers to make at-risk controls quick and obvious. Keep a safe non-digital route open, since your patients cannot fall back on an internal helpdesk you do not have.

Enterprise#

An NHS trust or ICS runs many systems, many proxies and millions of records, so the challenge is consistency and speed at scale. The risk is fragmentation — each system with its own, slow, inconsistent way to hide data — which leaves gaps an abuser can exploit and workers who cannot act fast enough. Invest in centralized, reusable safeguarding controls (sensitive flags, notification suppression, proxy governance) that apply across the estate, backed by named safeguarding leads, MASH integration, and proactive access audits. Governance and assurance boards (see Topic 6.4 — Governance & Assurance) should treat safeguarding-by-design as a standing gate, not a one-off.

Government#

A national body — NHS England, DHSC, or a devolved government — sets the standards, platforms and identity infrastructure that everyone else builds on, so its design decisions ripple across the whole system. Choices about NHS login, GOV.UK One Login, proxy-access rules and record-sharing defaults determine what safeguarding controls are even possible downstream. The accountability is to Parliament and the public, and the failure mode is a national default that quietly exposes at-risk citizens at scale. Government should mandate safeguarding-by-design in service standards, fund shared components (safe-address handling, sensitive-record suppression), and legislate and regulate — via the Online Safety Act 2023 and Ofcom — with vulnerable users explicitly in scope.

Common failure modes#

• Bolt-on safeguarding. Treating safeguarding as a policy PDF rather than a design requirement, so controls are missing when the risk arrives and workers improvise slow manual fixes.
• Default-on, no way off. Sending reminders, letters and notifications by default with no fast, worker-applied route to suppress or genericize them for people at risk.
• All-or-nothing proxy access. Granting broad, permanent proxy access with no granularity, no review at key ages, and no easy revocation — leaving stale access to exploit.
• Weak or blind identity checks. Verification too weak to stop impersonation, or too heavy so it excludes at-risk users, with no watch for coercion signals like shared devices.
• Disclosures received but not routed. Offering messaging or moderated forums with no tested, logged, human-backed escalation to safeguarding services, especially out of hours.
• Excluding the people you must protect. "Digital by default" with no safe non-digital route, cutting off or endangering the abused, the confused and the poor.
• No audit, no learning. Failing to log and audit access, so insider misuse goes undetected and recurring risks are never engineered out.

Maturity model#

Checklist#

• Every information-revealing feature has a documented "what if the wrong person sees this?" review with clinical/safeguarding sign-off.
• A frontline worker can suppress or genericize notifications and flag a sensitive address within minutes, across all channels.
• Specific record entries can be hidden or redacted from named proxies without removing legitimate access.
• Proxy access is granular, time-bound, and auto-reviewed at key ages (commonly 11 and 16) and on capacity change.
• Identity verification is proportionate to risk, defends against impersonation, and watches for coercion signals.
• A tested, logged, human-backed escalation route runs from every digital channel to MASH and named safeguarding leads, including out of hours.
• Hosted peer support and messaging have active moderation, reporting tools, and Online Safety Act compliance.
• Frontline and contact-centre staff are trained to recognize and respond to risk through digital channels.
• A safe non-digital route exists for everyone who cannot or dare not use the digital one.
• Access is logged, proactively audited for misuse, and patterns feed back into design.

Key sources#

• Care Act 2014 and statutory Care and Support Guidance — the legal basis for adult safeguarding in England (Department of Health and Social Care).
• Working Together to Safeguard Children — multi-agency statutory guidance on child protection (HM Government / Department for Education).
• Mental Capacity Act 2005 and its Code of Practice — the framework for decisions and proxy access where capacity is in question.
• NHS England guidance on safeguarding and on online consultations / patient online access, including proxy access and coercion risks in GP online services.
• Domestic abuse and "safe surgeries"/safeguarding-by-design resources — e.g. SafeLives, Refuge and the Domestic Abuse Act 2021 statutory guidance.
• Online Safety Act 2023 and Ofcom's codes of practice — duties for user-to-user and content-hosting services.
• NHS Digital Technology Assessment Criteria (DTAC) and the NHS Service Standard — safeguarding and safety expectations for digital health products.
• Digital identity: NHS login and GOV.UK One Login identity assurance guidance.

References#

1. Safeguarding — Wikipedia — https://en.wikipedia.org/wiki/Safeguarding
2. Child protection — Wikipedia — https://en.wikipedia.org/wiki/Child_protection
3. Care Act 2014 — Wikipedia — https://en.wikipedia.org/wiki/Care_Act_2014
4. Mental Capacity Act 2005 — Wikipedia — https://en.wikipedia.org/wiki/Mental_Capacity_Act_2005
5. Domestic violence — Wikipedia — https://en.wikipedia.org/wiki/Domestic_violence
6. Controlling behavior in relationships (coercive control) — Wikipedia — https://en.wikipedia.org/wiki/Controlling_behavior_in_relationships
7. Stalking — Wikipedia — https://en.wikipedia.org/wiki/Stalking
8. Authentication — Wikipedia — https://en.wikipedia.org/wiki/Authentication
9. Identity verification service — Wikipedia — https://en.wikipedia.org/wiki/Identity_verification_service
10. Digital identity — Wikipedia — https://en.wikipedia.org/wiki/Digital_identity
11. Content moderation — Wikipedia — https://en.wikipedia.org/wiki/Content_moderation
12. Online Safety Act 2023 — Wikipedia — https://en.wikipedia.org/wiki/Online_Safety_Act_2023
13. Care Act 2014 and Care and Support Statutory Guidance — Department of Health and Social Care / GOV.UK — https://www.gov.uk/government/publications/care-act-statutory-guidance
14. Working Together to Safeguard Children — HM Government / Department for Education — https://www.gov.uk/government/publications/working-together-to-safeguard-children--2
15. Mental Capacity Act Code of Practice — Ministry of Justice / GOV.UK — https://www.gov.uk/government/publications/mental-capacity-act-code-of-practice
16. Patient online access and proxy access guidance — NHS England — https://www.england.nhs.uk/long-read/patient-online-access-to-general-practice/
17. Online Safety Act 2023: guidance and codes — Ofcom — https://www.ofcom.org.uk/online-safety
18. Digital Technology Assessment Criteria (DTAC) — NHS England — https://www.nhs.uk/digital-technology-assessment-criteria-dtac/
19. NHS login — NHS England — https://www.nhs.uk/nhs-services/online-services/nhs-login/