Start with the minimum information needed.

A referral should not begin by emailing a person's entire medical or personal history. First establish the purpose, authority to share, programme fit and a secure route for any information that is genuinely required.

Self-referral

A person can start with a short enquiry about what they want to change. Detailed health information should only be requested later where it is necessary for safety, suitability or the agreed service and there is an appropriate lawful basis.

Family enquiries

A family member may ask about options without disclosing unnecessary private information about another person. Contact from a family member does not itself authorise access to, or disclosure of, the other person's programme information.

Professional and organisational referrals

Before identifiable sensitive information is transferred, the referring organisation and Stop Dependencies should understand the purpose, legal basis, relevant consent or other authority, minimum dataset, recipient, security method and respective responsibilities.

Commissioning

Commissioned programmes should document referral criteria, exclusions/escalation, information-sharing, reporting, outcome measures and data-controller/processor roles in the contract or supporting schedules.