The misuse of practice funds or sensitive information by staff is an ongoing concern for many practices. Any instances of misconduct in this respect can affect the reputation of a practice with patients as well as in the wider healthcare profession. What precautions, from an employment law perspective, can a practice take to avoid such situations occurring and when incidents do occur how should a practice deal with them?
Recruitment and pre-employment checks
Implementing a fair and robust recruitment procedure followed by effective pre-employment checks when recruiting new staff is a first level precaution against the misuse of funds and sensitive information.
Ensuring that the best possible staff are recruited on the basis of their merits, abilities and suitability for the position will ensure that the practice recruits the highest calibre of staff who are responsible and share the practice’s values and commitment.
Generally a recruitment and selection procedure should include the requirement to complete an application form containing questions about candidates’ academic and employment history and their suitability for the role. Applicants should receive a job description and person specification for the role applied for and any shortlisted candidates should be invited to attend a formal interview at which his/her relevant skills, experience and suitability for the role should be discussed in more detail.
If you decide to make an offer to any candidates, any such offer should generally be conditional on the following:
The signing of a contract incorporating the practice’s standard terms and conditions of employment and verification of the applicant’s identity and right to work in the UK.
The receipt of one or two written references which the practice considers satisfactory. It is often advisable to request that one of the references is from the applicant’s most recent employer. Previous employers are not legally obliged to provide a reference for an ex-employee. If the previous employer does decide to provide a reference it would then have a duty towards both its ex-employee and the practice as the new employer to take reasonable care to ensure the information the reference contains is true, accurate and fair. Making an offer of employment conditional on satisfactory references would allow the practice to withdraw the offer of employment and also protect its position in the case of an unsatisfactory reference. It is important for the practice to make clear that it will only accept references directly from the referee and that it will not rely on references or testimonials received only from the applicant.
The receipt of an enhanced disclosure from the Disclosure and Barring Service (DBS) (formerly Criminal Records Bureau) which the practice considers to be satisfactory. This is important to safeguard against any potential misuse of practice funds. Due to the nature of work in the sector practices should apply for enhanced disclosures from the DBS. If a potential employee has previous convictions for theft or fraud this may put the practice at risk. It is important to be aware however that since 29 May 2013 the DBS commenced the filtering and removal of certain specified information relating to old and minor criminal offences from all criminal records disclosures.
Confirmation that the applicant is not on the barred list relating to work with children or vulnerable adults, where appropriate.
Verification of the applicant’s medical fitness for the role. Medical information should be reviewed against the job description for the particular role, together with details of any other physical or mental requirements of the role. Practices should not request medical information (save for that which is required to facilitate the application process) prior to a conditional offer being made to avoid allegations of disability discrimination.
Clear contractual provisions, policies and procedures
Once staff have been recruited it is important for the practice to continue to take action to guard against any risk of staff misusing practice funds and sensitive information. Relevant provisions should therefore be included in contracts of employment. Creating, implementing and maintaining clear policies and procedures as part of the practice’s staff handbook will also help to ensure that all staff understand their obligations to behave honestly and responsibly when dealing with practice finances and sensitive information.
General duties can be set out in contracts of employment and it is sensible to include a duty to report any wrongdoing, requiring practice staff to report their own wrong doing as well as the wrongdoing of other employees. This is part of ensuring that all staff are encouraged to raise concerns through the appropriate channels.
Staff contracts of employment should also include obligations regarding confidential and sensitive information including an obligation to treat information about patients or service users as confidential. Confidential information should generally include all information about people who use the practice for health and care services and any information on the business, products, affairs and finances of the practice. To ensure enforceability it is usual to exclude any information which is already in or comes in to the public domain.
Contracts of employment should also include termination provisions which cover cases of misconduct. It is useful to confirm in contracts of employment the circumstances in which the practice can terminate the contract without the requirement to give notice including where staff are guilty of gross misconduct. Contracts of employment should also refer to the practice’s disciplinary policy and procedure in which it is sensible to expand upon examples of gross misconduct, including theft or misuse of practice funds. Practices should ensure that the staff handbook includes further rules, policies and procedures to prevent against the misuse of funds and sensitive information. The practice will generally want to make its policies and procedures contained in the staff handbook non-contractual as it will then be able to change them without seeking the agreement of the staff to which they apply (which would be the case if they were contractual).
It may be useful for practices to include a code of conduct or a set of disciplinary rules in the staff handbook to confirm and reinforce the professional responsibilities of staff in respect of practice funds and sensitive information. The code or rules should set out the consequences of a breach of the policy, which may be treated as misconduct potentially leading to disciplinary action that could result in dismissal in serious cases.
In relation to sensitive information it is important for the practice to include appropriate provisions relating to data protection. Practices should also have a disciplinary procedure in place, which should provide a framework within which managers can work with employees to maintain satisfactory standards of conduct. It is advisable for the practice to have a disciplinary procedure that complies with the provisions of the Advisory, Conciliation and Arbitration Service (ACAS) Code of Practice on Disciplinary and Grievance Procedures (or the ACAS Code).
There are other policies and procedures which may be helpful, such as IT and communications policies and anti-corruption and bribery policies, so practices may wish to consider these also.
Training and monitoring
There is little point in having clear contracts, policies and procedures in place if they are not readily accessible, effectively implemented and maintained. It would be sensible for practices to consider providing training for staff to ensure that practice funds are dealt with appropriately and confidential information is held and shared securely. Practices could also consider implementing robust IT systems and security practices to protect against misuse from both within and outside the practice. Policies and procedures should be kept under review in order to take account of changes to law and practice and changes to the circumstances of the practice in particular.
What to do when things go wrong
If concerns are identified the first point to consider is whether there is a duty to report it. There will of course be circumstances where allegations are so serious that the practice may need to consider reporting matters to the police. In those situations it is sometimes advisable to await a decision from the police before deciding what next steps (including a decision about suspension) to take. It is also important to consider whether there is a need to notify any regulatory body or, where the concern relates to disclosure of confidential information, make a report to the Information Commissioner.
Practices should then follow the processes set out in their disciplinary procedure. As concerns are likely to be very serious, and to facilitate a proper investigation, consideration should be given to exercising the power to suspend the individual(s) concerned. Suspension should usually be on full pay and it is important to ensure that it is made clear that suspension is a neutral act and does not imply guilt; and that the period of suspension is not allowed to continue for too long.
When investigating concerns it is sensible to appoint someone to conduct a thorough investigation to establish the facts of the case. The amount of investigation required will depend on the circumstances and may need to involve interviewing and taking statements from the employee involved and any witnesses and reviewing any relevant documents.
If the employee’s conduct is also subject to a criminal investigation, charge or conviction in the case of theft of practice funds for example, the practice should investigate the facts itself before deciding whether to take any formal disciplinary action. As above, there may be circumstances in which it would be advisable to await the outcome of any criminal proceedings before pursuing an internal disciplinary process, and it is always sensible to obtain advice before proceeding in these circumstances.
Above all, if things do go wrong, that provides an opportunity to ensure that they do not happen again. Misuse of funds or information could reveal gaps in security, training or the necessity to implement more restrictive access to individuals within the practice. This will all assist in avoiding problems recurring.
Protecting your position
The potential damage which misuse of funds or confidential information could do to a practice is significant. To both guard against, and be best placed to react to such misuse practices should consider the following:
Establish and follow a robust recruitment procedure including making any offers of employment subject to certain pre-employment checks.
Put in place key employment contract provisions including confidentiality and termination clauses.
Implement and maintain a comprehensive set of disciplinary rules and other relevant policies and procedures including a data protection policy and disciplinary procedure within the practice staff handbook.
Conduct staff training in relation to sensitive information and IT and security systems and policies, as well as training for managers on monitoring the use of funds and sensitive information.
In the case of any allegations of misusing practice funds or sensitive information, considering any reporting obligations and follow a clear disciplinary procedure which complies with the ACAS code.
