When a polygraph report reaches a care record: consent, special category data and proportionality

Most health and care professionals will never commission a polygraph examination. A smaller number will encounter one indirectly, through multi-agency safeguarding work, and that is where the information governance questions begin.

The route is statutory rather than clinical. Sections 28 to 30 of the Offender Management Act 2007 permit polygraph conditions on the licences of certain offenders released from custody, and the Domestic Abuse Act 2021 extended that framework to domestic abuse perpetrators.

Where those cases intersect with safeguarding arrangements, information about an examination — or about a disclosure prompted by one — can find its way into a shared discussion, and from there into a record.

Three questions worth asking first

What is the legal basis for holding it? Physiological recordings and their interpretation are personal data, and under UK GDPR they attract the Article 9 special category regime. A record entry that repeats a polygraph outcome inherits that status, along with the retention and access obligations that follow.

What does the result actually assert? Less than the surrounding conversation usually assumes. The American Polygraph Association places the accuracy of validated techniques in an 87 to 98 per cent range, varying by technique and examiner training, and inconclusive outcomes are a routine third result. Section 30 of the 2007 Act is explicit that a result may not be used as evidence in criminal proceedings against the person tested, and that no recall may rest on a failed test alone.

Is it proportionate to the care being delivered? A structured record exists to support safe care. Information that cannot change a clinical or care decision, but can materially change how a person is treated by everyone who reads it, deserves a specific justification rather than inclusion by default.

The private market sits outside all of this

Alongside the statutory framework there is a commercial sector. Providers such as SynergyID conduct examinations for individuals, families and employers, and clients sometimes arrive at a care setting holding a report they have paid for themselves.

Those examinations sit entirely outside NHS and social care standards. They are not clinical assessments, they carry no professional registration requirement in the UK, and the resulting document has no status in a care record beyond being a paper the person chose to share.

Treating it as a disclosure by the individual, rather than as an assessment finding, is usually the accurate framing.

Practical positions for information governance leads

• Record that a person disclosed something, and what they disclosed. Avoid recording a polygraph score as though it were a diagnostic result.
• Confirm the lawful basis and the sharing agreement before any such material moves between organisations.
• Check whether consent was genuinely voluntary. Where refusal carries a cost — employment, contact arrangements, a licence condition — consent and compliance are not the same thing.
• Apply the same retention discipline used for other special category data, rather than allowing the document to persist as a scanned attachment indefinitely.

Why it matters for standards work

Structured records earn their value from consistency: the same information, meaning the same thing, wherever it is read.

Material generated outside the care system, under a different evidential standard, is precisely the kind of content that erodes that consistency when it is absorbed without scrutiny. The safeguard is not a new field. It is the discipline of asking what a piece of information is for, and what it can honestly support.