Interoperability, Data Governance and Accountability in Adult Social Care

December 18, 2025

Data governance in adult social care is no longer confined to information held within one organisation. Providers increasingly exchange data with local authorities, NHS organisations, Integrated Care Boards, community health teams, pharmacies, housing partners, commissioners and technology suppliers. As information moves across these connected environments, accountability depends on whether data remains accurate, secure, traceable and appropriately used.

Providers developing digital transformation, interoperable care systems and stronger data governance in adult social care must therefore design assurance around the whole information pathway. Governance should cover not only where information is stored, but how it is created, transferred, interpreted, amended, reported and ultimately deleted.

This sits directly within effective digital records and data and wider developments involving NHS digital, data and interoperability. Commissioners and system partners increasingly expect providers to demonstrate control, transparency and accountability across connected systems rather than relying on policies designed for isolated internal records.

Why interoperability changes data governance expectations

When systems operate independently, responsibility for information may appear relatively clear. The provider creates the record, controls access and maintains the system. Interoperability introduces additional stages, organisations and technologies into that process.

Information may move through an application programming interface, shared-care record, commissioner portal, automated dashboard, secure messaging platform or third-party reporting tool. Each transfer creates questions about ownership, accuracy, access and responsibility.

Providers must be able to explain:

where the original information was created;
which organisation owns the source record;
why the information is being shared;
which lawful basis applies;
who can access or amend the information;
how changes are synchronised across systems;
how errors and failed transfers are identified;
which organisation is responsible for correction;
how long information is retained; and
how inappropriate access or disclosure will be investigated.

Interoperability strengthens care only when accountability travels with the data rather than becoming diluted as information moves between systems.

What strong interoperable data governance looks like

Strong governance begins with a clear understanding of the provider’s information environment. Leaders should know which systems hold personal, operational, workforce, safeguarding and performance data and how those systems interact.

An interoperable governance framework commonly covers:

electronic care records;
medication and MAR systems;
incident and safeguarding platforms;
workforce and training systems;
commissioner reporting portals;
shared health and care records;
quality and performance dashboards;
mobile devices and staff applications;
external suppliers and hosting arrangements; and
data exports, archives and backup systems.

The provider should maintain a current map of what information moves between these platforms, why the transfer is necessary and who is accountable at each stage.

Defining ownership across connected systems

Interoperability can create uncertainty about who owns a record and who is responsible for its accuracy. A provider may create a care observation that is then displayed within a shared record, incorporated into a commissioner dashboard or used by a health professional to inform a decision.

Governance arrangements should distinguish between:

ownership of the original source record;
responsibility for maintaining the receiving system;
authority to amend or annotate information;
responsibility for responding to correction requests;
accountability for automated calculations; and
responsibility for decisions made using shared data.

Sharing information does not automatically transfer professional accountability. Each organisation remains responsible for how its staff interpret and use the information available to them.

Operational example 1: synchronising care-plan changes

Context: A supported living provider uses an electronic care-planning system connected to mobile staff records and a central quality dashboard.

Step 1: A manager updates a person’s moving-and-handling plan following reassessment by an occupational therapist.

Step 2: The revised instructions automatically update the mobile guidance available to authorised support workers.

Step 3: The system records who approved the change, when it became active and which previous version it replaced.

Step 4: Relevant workers receive an alert and confirm that they have reviewed the updated guidance before providing support.

Step 5: The quality dashboard monitors acknowledgement, overdue staff review and any subsequent incidents linked to the change.

This workflow supports continuity while preserving an audit trail. Without clear controls, automatic synchronisation could distribute an unauthorised or incomplete amendment across several systems.

Data quality across integrated platforms

Interoperability can improve consistency by reducing repeated entry, but it can also spread inaccurate information more widely. An error in a source system may be reproduced automatically within dashboards, partner records and commissioner reports.

Providers should maintain controls covering:

mandatory data fields;
consistent terminology and definitions;
duplicate-person records;
validation of identifiers;
timeliness of updates;
conflicting information between systems;
failed or partial transfers;
changes to automated reporting logic;
reconciliation with source records; and
staff competence in digital recording.

Automated information should not be assumed to be correct simply because it has moved successfully between platforms. Providers should validate both the content and the transfer process.

Operational example 2: automated commissioner reporting

Context: A provider submits monthly quality, activity, workforce and safeguarding information through an automated commissioner dashboard.

Step 1: Contract indicators are defined consistently across the provider’s care, incident, workforce and quality systems.

Step 2: Relevant information is drawn into the reporting dashboard through automated data feeds.

Step 3: Managers review exceptions, incomplete records and unusual trends before the reporting period is approved.

Step 4: The provider records who validated the submission, what checks were completed and which limitations remain.

Step 5: Any error identified after submission is corrected through an agreed process, with the commissioner informed where the change is material.

This strengthens confidence because automated reporting remains subject to human review, documented validation and clear accountability.

Access control and minimum necessary information

Connected systems can increase the number of people and organisations able to view information. Providers must ensure that access remains proportionate to role, responsibility and purpose.

Strong access controls should include:

role-based permissions;
unique user accounts;
multi-factor authentication where appropriate;
regular access reviews;
prompt removal of leavers and transferred staff;
controls over exporting and downloading information;
monitoring of unusual access patterns;
restricted access to particularly sensitive records;
clear supplier and administrator permissions; and
audit trails showing who viewed or changed information.

Providers should apply the principle of minimum necessary access. The existence of technical connectivity does not justify unrestricted visibility.

Lawful information sharing and transparency

Interoperability must operate within a clear lawful and ethical framework. Providers should understand the purpose of each information flow and ensure that people receiving support are given appropriate information about how their data is used.

Governance arrangements should address:

lawful bases for processing and sharing;
special-category data requirements;
consent where consent is the appropriate basis;
mental capacity and best-interests considerations;
sharing without consent where legally justified;
privacy information;
data protection impact assessments;
information-sharing agreements; and
documentation of significant decisions.

Transparency should be meaningful rather than limited to lengthy privacy notices. People should be able to understand which organisations may receive relevant information and why.

Commissioner and regulator expectations

Commissioners increasingly expect providers to demonstrate how data governance operates across integrated pathways. They may examine whether information used for contract assurance is accurate, current and traceable to frontline records.

Providers may be expected to evidence:

clear ownership of data quality;
documented information flows;
secure system integration;
validation of automated reports;
role-based access controls;
effective correction processes;
supplier assurance;
incident and breach management;
business continuity arrangements; and
board oversight of information risk.

Regulators may similarly test whether records are current, whether access is appropriate and whether leaders understand the quality and limitations of the information used to manage services.

Accountability and audit readiness

Interoperability can strengthen audit readiness by creating a clear trail between frontline records, management reports and external submissions. However, this depends on systems retaining sufficient evidence about who entered, changed, approved and shared information.

A defensible audit trail should show:

the source of the information;
the date and time it was recorded;
the identity and role of the author;
subsequent amendments;
the reason for significant changes;
approval or review where required;
which systems received the information;
whether the transfer succeeded;
who accessed the record; and
how errors were corrected.

Providers should avoid systems that overwrite previous entries without preserving version history. Auditability depends on being able to reconstruct what information was available at the time a decision was made.

Operational example 3: correcting inaccurate shared information

Context: A provider discovers that an outdated allergy entry has been transferred into a shared care record and repeated in a commissioner-facing summary.

Step 1: The error is identified and immediately assessed for any impact on care or treatment decisions.

Step 2: The provider corrects the source record and records the reason, author and time of the amendment.

Step 3: The receiving systems and relevant partner organisations are notified through the agreed correction pathway.

Step 4: The provider verifies that the inaccurate information has been amended or appropriately annotated across connected systems.

Step 5: The incident is reviewed to identify why the outdated entry remained active and whether wider data-quality controls require improvement.

This demonstrates why responsibility does not end when a source record is corrected. Interoperable governance must address every location where inaccurate information has been reproduced or used.

Safeguarding and critical information

Data governance failures can create direct safeguarding risks. Important concerns may be omitted, inaccurately attributed, delayed or disclosed to people who should not have access.

Interoperable systems should support the secure and accurate sharing of information such as:

current safeguarding concerns;
protective actions;
known perpetrators or alleged sources of risk where appropriate;
communication requirements;
mental capacity and consent considerations;
restrictions and legal authorisations;
multi-agency decisions;
review dates; and
named responsibilities.

Providers must ensure that safeguarding information is factual, clearly attributed and regularly reviewed. Historic concerns should not remain presented as current risk without context or review.

Managing restrictions and human rights information

Connected records may contain information about restrictions, supervision arrangements, consent, capacity or best-interests decisions. Poor governance can result in outdated restrictions being repeated across systems and applied long after the original rationale has changed.

Providers should ensure that restrictive information includes:

the legal and professional basis;
the specific restriction involved;
the person’s views;
less restrictive alternatives considered;
the responsible decision-maker;
the date of authorisation;
the review date; and
evidence of ongoing necessity and proportionality.

Interoperability should support consistent and lawful practice, not allow restrictive wording to become permanently embedded through repeated automated transfer.

Third-party suppliers and processor assurance

Many providers rely on external suppliers for care-planning systems, hosting, mobile applications, reporting tools and system integration. Data governance therefore extends into supplier selection and contract management.

Provider assurance should examine:

data hosting locations;
security certifications and controls;
subprocessor arrangements;
access by supplier personnel;
backup and restoration processes;
breach-notification requirements;
service availability commitments;
data export and portability;
contract termination arrangements; and
secure deletion at the end of the relationship.

Providers remain accountable for selecting and overseeing suppliers appropriately. Outsourcing technology does not outsource responsibility for people’s information.

Data protection incidents and breach response

Connected systems can increase the impact of a data incident because information may be distributed across several platforms before the problem is recognised.

Incident response arrangements should define:

how suspected breaches are reported;
who leads the investigation;
how affected systems are contained;
which partner organisations must be informed;
how the scale and sensitivity of the incident are assessed;
when regulatory notification is required;
how affected people will be informed where appropriate;
how inaccurate or exposed information will be corrected;
how evidence will be preserved; and
how learning will be implemented.

Providers should test whether contact routes and responsibilities remain clear when incidents involve multiple organisations or technology suppliers.

Business continuity and system resilience

Data governance must continue during system outages, cyber incidents and failed integrations. Providers need to preserve access to essential care and risk information while maintaining a clear record of actions taken during downtime.

Contingency arrangements should cover:

access to current care plans and critical risks;
manual recording processes;
incident and safeguarding escalation;
temporary access permissions;
secure storage of downtime records;
restoration of systems;
reconciliation of records created during the outage;
validation of delayed data transfers;
supplier escalation; and
notification to commissioners where required.

After restoration, providers should confirm that no information has been lost, duplicated or incorrectly synchronised.

Board and senior leadership oversight

Boards and senior leaders should understand the organisation’s key information flows and the risks associated with interoperability. Data governance should not sit solely with an IT manager or data-protection lead.

Leadership oversight may include:

significant data-quality concerns;
security incidents and near misses;
failed integrations;
inappropriate access;
supplier performance;
high-risk data protection impact assessments;
commissioner or regulator concerns;
business continuity testing;
staff training and competency; and
progress against information-governance improvement plans.

Leaders should receive enough detail to challenge whether controls are effective without becoming overwhelmed by technical information that does not support decisions.

Workforce competence and accountability

Frontline staff, managers and administrators all contribute to data quality. Interoperability increases the importance of accurate recording because information may be viewed and used beyond the immediate service.

Training and supervision should address:

accurate and factual recording;
use of agreed terminology;
checking the correct person’s record;
responding to incorrect or conflicting information;
confidentiality and minimum necessary access;
safe use of mobile devices;
recognising suspicious access or activity;
reporting failed system updates;
correcting errors appropriately; and
understanding how records contribute to external reporting.

Staff should understand that copying and pasting information between systems can reproduce outdated or inaccurate content and weaken the reliability of the record.

Data retention and deletion across systems

Retention becomes more complex when information exists across connected platforms, dashboards, exports and backups. Deleting a record from one system may not remove every copy.

Providers should understand:

which system holds the master record;
where duplicated information is stored;
which retention period applies;
how legal holds or investigations affect deletion;
how archived information is accessed;
how supplier backups are managed;
how exports and downloads are controlled;
how records are deleted after contract termination; and
how deletion is evidenced.

Retention schedules should reflect legal, regulatory, contractual and operational requirements while avoiding indefinite storage without a clear purpose.

Measuring data-governance effectiveness

Providers should evaluate whether governance controls are working in practice rather than relying solely on policy completion.

Useful measures may include:

duplicate-record rates;
failed data transfers;
time taken to correct identified errors;
unusual-access investigations;
overdue access reviews;
data-quality audit findings;
breach and near-miss themes;
staff training and competency results;
consistency between reports and source records;
supplier-performance exceptions; and
completion of governance improvement actions.

These measures help leaders determine whether interoperability is improving reliability or introducing hidden weaknesses.

Common pitfalls

A common weakness is assuming that technical integration automatically creates accurate, lawful and accountable information sharing.

Other pitfalls include:

unclear ownership of source records;
automating poor-quality data;
allowing excessive user access;
failing to review supplier permissions;
duplicate records containing conflicting information;
weak correction processes across connected systems;
retaining outdated restrictions or safeguarding information;
overlooking exports, downloads and backups;
limited testing of business continuity arrangements;
insufficient validation of commissioner reports; and
treating data governance as the responsibility of one specialist role.

Providers should also avoid collecting and sharing information simply because the technology permits it. Every information flow should have a defined purpose, accountable owner and proportionate level of access.

Embedding governance into system design

Strong providers design data governance into interoperable systems from the outset rather than adding controls after implementation. They begin by mapping the purpose, source, destination and ownership of each significant information flow.

They then establish:

clear data standards;
defined ownership and accountability;
lawful and transparent sharing arrangements;
role-based access controls;
version history and audit trails;
data-quality validation;
correction and escalation processes;
supplier assurance;
retention and deletion controls;
tested resilience arrangements; and
board-level oversight.

Interoperability can strengthen continuity, coordination and assurance, but only when information remains trustworthy throughout its journey. Providers must be able to demonstrate not simply that systems connect, but that data is governed effectively at every point where it is created, transferred, used or amended.

As adult social care becomes more digitally connected, data governance and interoperability will increasingly be inseparable. Providers that maintain clear accountability, accurate records, secure access and transparent oversight will be better positioned to satisfy commissioner expectations, support regulatory confidence and use integrated information safely to improve care.