Information Governance in Hong Kong Care Services: Privacy, Data Sharing and Accountability Across Integrated Support

An older person leaves hospital and returns to a residential care home. Their medication has changed, mobility has deteriorated and follow-up appointments have been arranged. Safe continuity depends on the right information reaching the right people quickly. Yet the same information may reveal diagnoses, disability, family circumstances, financial details and other highly personal aspects of the person’s life. Sharing too little can compromise care; sharing too much, too widely or for the wrong purpose can compromise privacy.

This tension now runs through much of Hong Kong’s health, rehabilitation and long-term-care system. Care increasingly crosses organisational boundaries involving the Hospital Authority, Department of Health, Social Welfare Department, residential homes, non-governmental organisations, community services, healthcare professionals and families. The wider Hong Kong Ageing, Long-Term Care & Community Support Knowledge Hub examines how these interfaces affect service quality, workforce and governance.

Information governance is therefore not simply an administrative obligation or cybersecurity function. It determines whether people experience continuity, whether workers can make safe decisions, whether privacy remains meaningful and whether organisations can explain who knew what, who accessed it, why it was shared and how inaccurate information was corrected.

Hong Kong’s Personal Data (Privacy) Ordinance provides the general legal framework, while sector-specific requirements add further controls. Social welfare standards address confidentiality and privacy. Residential-care Codes of Practice govern records and disclosure. The Electronic Health System Ordinance provides a distinct framework for sharing electronic health information. Together they create an increasingly interconnected environment in which care organisations need to understand both the value and the boundaries of information sharing.

The starting point is purpose, not data collection

The Personal Data (Privacy) Ordinance is built around six Data Protection Principles covering collection, accuracy and retention, use, security, openness, and access and correction. For care organisations, their importance lies in the discipline they impose across the entire information lifecycle.

Personal information should be collected for a lawful purpose connected with the organisation’s functions. Collection should be necessary and adequate without becoming excessive. People should understand why information is being collected, whether providing it is obligatory or voluntary where relevant, how it may be used and the classes of people to whom it may be transferred.

That creates an important operational test. Care records frequently expand because a field is available rather than because the information is necessary. Staff may record family conflict, personal history, behavioural observations or health details that have little relevance to the service being provided. Once recorded, that information can be copied into later assessments and shared with additional teams.

Strong digital records and information governance therefore begins before information enters a system. Organisations need to ask what they genuinely need to know and why.

Integrated care does not mean unrestricted information flows

Integration creates a powerful argument for better information exchange. A community-care worker needs to know about relevant mobility risks. A residential home may need an accurate medication record after hospital discharge. A physiotherapist needs information about changes affecting rehabilitation. Emergency services may need critical health information quickly.

But integration should not be interpreted as permission for every organisation involved with a person to access every piece of information held about them.

The principle of relevance remains important. Information sharing should support a defined care, treatment, safeguarding, statutory or operational purpose. The information required by a nurse may differ from that required by a transport worker, administrator or community volunteer.

Good information architecture therefore combines continuity with role-based access. The objective is not to create the largest possible shared record. It is to make relevant and accurate information available to appropriately authorised people when it is needed.

This distinction becomes particularly important as Hong Kong develops more connected health systems and digital service models.

Hong Kong’s eHealth system is changing the information environment

Hong Kong’s electronic health infrastructure has developed substantially from the original Electronic Health Record Sharing System. Amendments effective from 1 December 2025 renamed the governing legislation as the Electronic Health System Ordinance and expanded the framework supporting electronic health information.

The system allows registered individuals to build electronic health records that can support continuity between participating healthcare providers and professionals. The framework distinguishes joining the system from the sharing arrangements that allow healthcare providers to access information, while maintaining consent controls and defined circumstances for access.

The evolving model also broadens the professional groups able to participate in appropriate circumstances and strengthens the potential for important clinical information to accompany people between different parts of the health system.

For care services, the strategic significance is substantial even where a social-care provider itself is not operating as an eHealth healthcare provider.

More complete electronic health information can affect:

• medication reconciliation following hospital treatment;
• awareness of allergies and adverse drug reactions;
• rehabilitation and therapy planning;
• continuity between health professionals;
• follow-up after discharge; and
• coordination where health and long-term support overlap.

However, improved availability of information also increases the importance of deciding who legitimately needs access. Digital integration creates value only when access governance develops at the same pace.

Consent should be understandable rather than merely recorded

Consent appears across several parts of Hong Kong’s information landscape, but simply obtaining a signature does not guarantee meaningful understanding.

People may be asked to agree to information sharing at a point when they are entering a service, managing illness or depending heavily on relatives. Forms can contain broad language covering several potential uses. Older people and people with cognitive or communication difficulties may find complex privacy explanations particularly difficult.

Care organisations therefore need to make information-sharing choices understandable in practice.

This connects with accessible information and communication. Privacy information should be explained in a way the individual can reasonably understand, with opportunities to ask questions and clarify who will receive information.

Where another person is authorised to act for someone who cannot make the relevant decision themselves, the organisation still needs clarity about the scope of that authority and the person’s own involvement wherever possible.

Consent should also be capable of change. A person may later object to information being shared with a particular provider or family member. Information governance therefore requires processes that can respond when preferences change rather than assuming that a historic consent decision remains appropriate indefinitely in every context.

Scenario: hospital discharge creates an information gap

An older woman returns to a residential care home after an unplanned hospital admission. Her discharge information indicates medication changes and a new mobility concern, but the documentation received by the home is incomplete. Her daughter also tells staff that the hospital discussed follow-up investigations that do not appear in the paperwork.

The immediate pressure is operational. Staff need reliable information before the next medication round and before deciding how much assistance she requires when mobilising.

The home should not solve the uncertainty by copying every piece of historic information it can obtain into the care record. It needs to identify the information required for safe continuity, confirm its accuracy through appropriate health channels and update the resident’s current care documentation.

The manager also needs to know whether the problem is isolated or recurrent. If several hospital returns arrive with incomplete information, the issue becomes a pathway-governance concern rather than an individual administrative inconvenience.

Relevant evidence can include the time taken to reconcile information, medication discrepancies identified, clarification requests, incidents associated with incomplete transfers and recurring interfaces where information quality is weak.

The scenario illustrates why information governance is inseparable from service quality. Privacy and continuity are not competing objectives: the stronger system shares the information genuinely required for safe care while avoiding indiscriminate transfer of unrelated personal data.

Accuracy is a safety requirement

Privacy debates often focus on whether information should be shared. Equally important is whether the information being shared is correct.

Out-of-date medication details, an incorrect mobility status, a duplicated allergy entry or a historical behavioural description presented as current can directly alter care decisions.

Under Hong Kong’s data-protection framework, reasonable steps should be taken to maintain accuracy. Care organisations therefore need clear ownership of record updates when circumstances change.

Electronic systems can make inaccurate information especially persistent because data may be copied rapidly between screens, assessments and services.

A well-designed record should distinguish observation from verified fact, current needs from history and professional assessment from family or staff opinion. Dates matter. Sources matter. Changes need to be traceable.

The Quality Dashboard Builder can help organisations bring record-quality indicators alongside incidents, complaints and service outcomes, allowing leaders to see whether information weaknesses are beginning to affect operational quality.

Privacy is wider than confidentiality

Hong Kong’s Social Welfare Department Service Quality Standard 14 makes an important distinction between privacy and confidentiality.

Confidentiality concerns how information about a service user is communicated and protected. Privacy also concerns freedom from unnecessary intrusion: whether conversations can be overheard, whether personal care is delivered discreetly and whether people have spaces and interactions that are not unnecessarily observed.

This means information governance cannot be solved through password protection alone.

A digital record may be technically secure while workers discuss a resident’s health in a public corridor. A paper file may be locked away while a computer screen remains visible to visitors. A video consultation may be encrypted but conducted somewhere where other residents can hear it.

Service Quality Standard 14 now places explicit attention on secure handling of data and cybersecurity alongside privacy and dignity. The operational implication is that organisations need physical, behavioural and digital controls working together.

Need-to-know access should shape workforce practice

Care organisations hold information because employees need it to perform legitimate roles. That does not mean every employee should see the same record.

Role-based access is particularly important in larger NGOs and multi-service organisations where one individual may interact with residential care, day services, rehabilitation, transport and community support.

A care worker may need current mobility and support information. A finance employee may need payment information but not detailed clinical notes. A driver may require essential safety information without access to the entire support history.

This principle should be reinforced through digital skills and workforce adoption. Staff need to understand not only how to operate systems but what they are entitled to access, what they should record and what they should avoid discussing or forwarding.

Training is particularly important where staff use mobile devices, messaging applications or remote access. Convenience can create informal information channels that sit outside normal organisational controls.

A photograph of a care document sent through an unauthorised messaging account may solve an immediate operational problem while creating a larger privacy and security risk.

Scenario: an informal messaging group becomes part of care delivery

A community-service team uses an instant-messaging group to coordinate visits because it is faster than the organisation’s formal system. Workers begin by sharing rota changes. Gradually, messages include service-user names, health updates, photographs of medication packaging and explanations of behavioural incidents.

The group is operationally useful, and no worker intends to misuse information. The problem is that the organisation has lost control over where personal data is stored, who retains copies, what happens when employees leave and whether information can be deleted or corrected reliably.

A proportionate response is not simply to discipline the team for trying to communicate efficiently. Management needs to understand why employees created the workaround. If the authorised system cannot support timely community coordination, the technology problem itself requires attention.

The organisation introduces a secure workflow that allows relevant updates to be shared through approved accounts with access linked to employment roles. It also reviews what information community staff genuinely need when working remotely.

The lesson reaches beyond cybersecurity. Poorly designed systems encourage staff to create unofficial processes. Information governance therefore depends partly on usability: the approved route needs to work well enough for frontline teams to use it under real service pressure.

Organisations examining this balance can use the Digital Transformation Readiness Assessment to test technology governance, workforce adoption and information-security readiness before digital systems are expanded.

Family involvement creates complex information boundaries

Families play an important role throughout Hong Kong’s care landscape. They may arrange services, attend reviews, support healthcare decisions, manage finances and provide substantial unpaid care.

Their involvement does not automatically mean that every piece of information about an adult service user should be disclosed to them.

A resident may want a daughter involved in medication discussions but not want personal relationship information shared. Another person may rely on a sibling for practical support while wanting mental-health information kept private. A family member may request access to records because they believe they are entitled to see everything.

Providers therefore need to distinguish family involvement from unrestricted family access.

Clear family and advocate involvement should establish what information can be discussed, the person’s wishes, any relevant authority held by another person and circumstances in which safety or statutory responsibilities require different action.

These boundaries become particularly important when family relationships are strained. Staff should not assume that the most involved relative is automatically the appropriate recipient of confidential information.

Information sharing for safeguarding requires judgement

Privacy should protect people from unnecessary disclosure. It should not prevent appropriate action where serious safety or safeguarding concerns require information to be considered or shared within the applicable legal framework.

The challenge for frontline staff is that confidentiality can sometimes be understood too rigidly. A worker may hesitate to escalate a concern because the service user asked them not to tell anyone. Another may disclose information much more widely than necessary because the word “safeguarding” has been used.

Strong governance requires proportionate escalation.

The organisation needs clear arrangements for identifying who should receive the concern, what information is relevant and how decisions are recorded. Where disclosure relies on a statutory duty, legal requirement or another permitted basis rather than ordinary consent, that reasoning should be clear.

This is closely connected with safeguarding information sharing. The objective is neither automatic secrecy nor uncontrolled disclosure, but information exchange that is necessary for protection and accountable afterwards.

Third-party technology does not transfer accountability away from the provider

Care organisations increasingly rely on external suppliers for digital care records, cloud hosting, scheduling, remote monitoring, payroll, communications and analytics.

Using a specialist supplier may improve security and system capability, but it does not remove the organisation’s responsibilities for personal data.

Providers need to understand what information suppliers process, where responsibilities sit, how access is controlled, how long data is retained, what happens when contracts end and what mechanisms exist when incidents occur.

Contractual arrangements therefore form part of information governance rather than being solely a procurement issue.

For high-risk systems, leaders should also understand supplier dependencies. If a cloud platform becomes unavailable, can staff still reach essential care information? If an integration fails, which version of a record becomes authoritative?

This links information governance with IT and systems resilience. Confidentiality, availability and integrity all matter. A perfectly private record that cannot be accessed during an urgent care episode is not a successful information system.

Cybersecurity is now a care-quality issue

The growing digitisation of care makes cybersecurity directly relevant to continuity and safety.

A compromised account could expose sensitive information. Ransomware could make records unavailable. Poor password practice could allow unauthorised access. A phishing message could expose both staff credentials and service-user information.

The consequences can extend beyond privacy. If employees cannot access medication information, emergency contacts or support plans, cyber disruption can become a service-delivery event.

That is why cybersecurity and digital resilience should appear within care governance rather than being left solely to technical specialists.

Leaders need assurance that staff understand basic controls, access is reviewed when roles change, backups and continuity arrangements exist, incidents can be escalated and critical systems can be recovered.

Retention needs a purpose as well as a period

Care organisations naturally accumulate information. Historical records can be important for clinical context, safeguarding, regulatory evidence, complaints and continuity.

Keeping everything indefinitely, however, is not a neutral choice.

Hong Kong’s data-protection framework expects information not to be retained longer than necessary for the relevant purpose, subject to other applicable legal and operational requirements.

Organisations therefore need retention arrangements that distinguish different record types rather than simply retaining all information because storage is inexpensive.

Digital systems make indefinite retention technically easy. Governance needs to determine when that convenience ceases to be justified.

Scenario: an old behavioural description follows a person for years

A man with an intellectual disability transfers between services operated by the same organisation. Several years earlier, during a period of significant distress, his records described him as aggressive and requiring close supervision.

His circumstances have since changed substantially. He has developed stronger communication skills, moved into a more suitable environment and has experienced no comparable incidents for a long period. Yet the historic description continues to appear prominently in referral summaries because staff copy information from previous assessments.

At the new service, employees approach him cautiously and initially restrict some activities because they believe serious aggression remains likely.

A review identifies that historical information has been presented without sufficient context. The organisation does not erase legitimate history simply because it is inconvenient, but it changes how current records distinguish past events from present needs. The support plan identifies what has changed, what triggers remain relevant and which former controls are no longer required.

The scenario demonstrates the connection between data accuracy and person-centred care. Information can be technically true yet operationally misleading when time and context are removed.

This is why evidencing person-centred care requires records that describe the person as they are now rather than allowing old risk narratives to define them indefinitely.

Access and correction create an important accountability mechanism

Hong Kong’s privacy framework gives individuals rights relating to access and correction of personal data. Those rights reinforce a broader governance principle: records are not simply organisational property.

For care services, this has cultural implications.

Staff may write records primarily for colleagues, regulators or organisational protection. Yet those records concern the life of the individual and may affect future decisions about their care.

Organisations should therefore encourage professional, factual and respectful recording. Opinions should be identified as such. Unsupported labels should be avoided. Corrections should be managed transparently rather than silently overwriting significant history.

Allowing people to understand information held about them can also identify errors that professionals have missed.

Interoperability creates governance questions before technical ones

Hong Kong’s increasing digital-health connectivity creates pressure for systems to exchange information more smoothly. The technical ambition is understandable: repeated data entry wastes time, fragmented records create risk and people should not need to repeat the same information continually.

But interoperability is not simply about connecting databases.

Before systems exchange information, organisations need agreement on purpose, meaning and responsibility. The same term may be defined differently across services. One system may record a risk as current while another treats it as historical. A discharge record and long-term support plan may update at different speeds.

This makes interoperability and system integration a governance question.

Important tests include:

• which organisation remains responsible for each dataset;
• what information is authoritative when records conflict;
• how updates propagate between systems;
• which users can view or alter information;
• how people understand the sharing arrangement; and
• how incorrect information is corrected across connected records.

Connecting weak records simply allows poor-quality information to travel faster.

Scenario: two records give different medication information

A person receiving both community support and specialist healthcare has medication information recorded in two systems. Following a clinical review, one medicine is stopped. The healthcare record is updated, but the community-service record continues to show the previous prescription.

A support worker notices the discrepancy while preparing for a home visit. Rather than deciding which record “looks newer”, they follow the organisation’s escalation process and seek clarification from the appropriate healthcare source.

The immediate issue is resolved safely, but management treats the event as evidence of an interface weakness.

The organisation reviews how medication changes reach community teams, which system should be treated as authoritative for different purposes and whether staff receive clear prompts when information is awaiting verification.

If similar discrepancies recur, the issue should become visible at governance level. Frequency, source, resolution time and associated near misses can show whether the pathway is improving.

This type of evidence can be structured through the Commissioner Evidence Builder, used here as a general evidence-structuring tool rather than a Hong Kong regulatory instrument. It can help organisations connect operational evidence, assurance and improvement actions around cross-service information quality.

Audit trails should create accountability, not surveillance

Digital systems make it possible to record who accessed information, when they accessed it and sometimes what actions followed. Hong Kong’s eHealth environment similarly uses access controls, logging and audit mechanisms to protect electronic health information.

These controls are valuable because sensitive information should not be accessed casually.

However, audit capability should be used intelligently. The objective is not to create an environment where staff believe every legitimate record access will be treated with suspicion. It is to identify inappropriate access, unusual patterns and failures in role-based controls.

Good governance distinguishes oversight from surveillance.

Access auditing should support clear rules, proportionate investigation and workforce learning. Repeated inappropriate access may require disciplinary action. A pattern of staff accessing broader records because the system makes essential information difficult to find may instead reveal a design problem.

Data breaches need a care response as well as a privacy response

When information is disclosed incorrectly, lost or accessed without authority, immediate questions concern containment and privacy risk. In care organisations, leaders should also ask whether the event affects ongoing support.

If a device containing current care plans is lost, does the service still have safe access to those plans? If inaccurate information was sent to another organisation, has it influenced care decisions? If a cyber incident requires systems to be taken offline, how will medication and emergency information remain available?

Incident management should therefore consider both harm from disclosure and harm from disruption.

Recurring issues then need to connect with organisational learning and continuous improvement rather than ending once the immediate technical problem is fixed.

Senior governance needs a smaller number of meaningful indicators

Information governance can produce enormous quantities of assurance data: access logs, security alerts, training completion, retention reviews, system downtime, data breaches, correction requests and audit findings.

Governing bodies do not need every measure. They need a coherent view of whether information is supporting safe care while remaining appropriately protected.

A balanced governance picture might bring together:

• material privacy and cybersecurity incidents;
• recurring record-quality or transfer failures;
• unauthorised-access concerns;
• critical-system availability and recovery;
• overdue corrective actions; and
• evidence from service users about privacy and confidence in information handling.

The purpose is to connect information risk with operational outcomes. A month with no reportable data breach is not necessarily evidence of strong information governance if care records are consistently inaccurate or staff rely on unapproved communication channels.

Organisations can use the Governance Maturity Assessment to test whether information risks, accountabilities and escalation routes are visible at the right organisational level.

Artificial intelligence raises the next information-governance challenge

Artificial intelligence is likely to increase the value organisations can extract from care information. Systems may eventually identify deteriorating health, changing support needs, workforce patterns or service risks earlier than manual review alone.

Those possibilities are emerging rather than a reason to treat unrestricted AI processing as established good practice.

AI introduces additional questions about what information enters a model, whether the purpose is compatible with the original collection, how outputs are validated, whether bias affects decisions, who remains accountable and whether sensitive information leaves organisational control.

Care providers should therefore avoid treating AI as merely another software feature. AI and automation in care require governance proportional to the sensitivity and consequence of the decision being supported.

Human responsibility remains essential. An algorithm may identify a pattern, but it should not make an unexplained decision about someone’s care, independence or risk.

International learning: information sharing needs both infrastructure and restraint

Many countries are attempting to connect health, long-term care and community support through shared digital information. Institutional structures differ, so Hong Kong’s eHealth arrangements cannot simply be transplanted elsewhere.

The transferable lesson is that connectivity alone does not create integration.

Effective information sharing requires legal authority, meaningful consent where applicable, relevant access, accurate records, professional judgement, cybersecurity and clear responsibility when information crosses organisational boundaries.

There is also a useful parallel with physical care. Just as good support should avoid unnecessary restriction of the person, good information governance should avoid unnecessary accumulation and circulation of their personal data.

The objective is sufficient information for safe, coordinated support without turning integration into unlimited visibility into someone’s life.

Conclusion

Hong Kong’s increasingly connected care environment makes information governance a core component of service quality. The Personal Data (Privacy) Ordinance establishes principles covering lawful collection, purpose, accuracy, retention, security, openness and individual access. Social welfare standards translate privacy and confidentiality into service practice, while the evolving Electronic Health System creates greater potential for continuity across healthcare providers and professionals.

The operational challenge is to make these frameworks work together around the person. Services need enough reliable information to manage medication, rehabilitation, risk, discharge and changing support needs, while ensuring that access remains relevant and proportionate. Families may be essential partners without automatically being entitled to every detail. Digital suppliers can support care without transferring accountability away from the provider. Cybersecurity protects both confidentiality and continuity.

The strongest direction for Hong Kong is therefore neither fragmented secrecy nor unrestricted data sharing. It is purposeful information governance: collect what is needed, explain why, maintain accuracy, share proportionately, secure access, correct errors and learn when information systems fail.

As digital health, connected care and artificial intelligence develop further, that discipline will become more important rather than less. Better information can support safer and more personalised care, but only when organisations remain accountable for how information moves, who can see it and whether the person whose life it describes remains visible within the system.