NHS recruitment came under scrutiny after it emerged the people responsible for failed terrorist attacks worked for the service. But a new body has plans it says will stop dangerous people working with children and vulnerable adults. By Ingrid Torjesen

Sadly, it is through tragic incidents that cracks in security and verification procedures are identified, and in recent years serious crimes have raised concerns that there are gaps in NHS recruitment processes.

The murders of Jessica Chapman and Holly Wells in Soham, Cambridgeshire, in 2002 highlighted the fact that checks on candidates' suitability to work with children and vulnerable adults were not robust. Their killer, Ian Huntley, got a job as a school caretaker, despite having previously been accused of sex with underage girls and rape.

Last summer the focus fell on NHS recruitment processes when the suspected terrorists involved in failed car bomb attacks at Glasgow airport and in London turned out to be NHS employees.

The government commissioned Sir Michael Bichard and Home Office minister Admiral Lord West to review pre-employment screening and recommend how procedures could be tightened.

Sir Michael called for a dedicated scheme to determine whether people are suitable to work with children and vulnerable adults. A new body, the Independent Safeguarding Authority, has been set up to do this. It goes live in October 2009.

The West review has not been finished. The Home Office says its full findings are unlikely ever to be made public, but it has already implemented changes because of it. New immigration rules now restrict international medical graduates' access to UK postgraduate medical training and the maximum fine for knowingly employing somebody not eligible to work in the UK has been increased from£5,000 to£10,000.

On 1 April NHS Employers published revised guidance on recruitment. Its head of employment services Andrea Hester says this makes it clearer what the requirements are and takes into account the new Home Office rules to check the identity of all people who will have access to the NHS care records service.

"The emphasis needs to be on ensuring you actually check the identity of somebody. If you get the identity wrong, nothing else matters," she says. The guidance says photocopies of passports and work permits should be taken from potential employees and filed.

However, an Audit Scotland report after the attack on Glasgow airport last summer found this does not always happen. It assessed procedures at five health boards and found compliance levels for all checks were above 90 per cent; for identity it was 97 per cent. The report highlighted that in a small number of cases a tick sheet indicated identity had been checked, but there was no photocopy of a passport or resident's permit.

Missing checks

NHS Employers' guidance states that Criminal Records Bureau checks must be carried out on all potential staff. However, a MORI poll published last summer showed one in 10 people who applied for jobs in the health sector and were subject to checks were known to the police and that only 4 per cent of these had their job offers withdrawn after their backgrounds were discovered.

NHS Employers says that when a candidate comes from overseas, information should be sought from that country. The Home Office and Security Industry Authority websites contain lists of countries that can provide fairly reliable criminal records checks, while in other cases the embassy of the relevant country should be contacted.

The Audit Scotland report identified disclosure checks to be especially lacking on overseas staff. Audit Scotland assistant director for public reporting Angela Canning says that where the information proved hard or slow to obtain, the Scottish government has recommended employers carry out a risk assessment of the information available on prospective candidates. They could decide not to appoint "if they think there may be potential issues". However, lawyers warn that taking this approach could open employers up to claims of racial discrimination, and recommend that everyone be treated equally.

Michael Ball, a partner in the employment department at law firm Halliwells, has never been able to find a satisfactory solution for checking criminal records of people from outside the EU. He says going back to their locality was "almost a waste of time".

"The fact that a check can be made in this country is enough to protect an employer," he advises. "They will have done their job if they have checked the CRB record is clear. The employer doesn't have to go wandering off to China, interviewing policemen."

He emphasises that the main statutory requirement is to check a candidate has the right to work in the UK: "A lot of HR people forget that [this] standard should be applied to anyone who appears to be a British national as well, because there is a discrimination angle."

Where HR departments often get into trouble is by not making it clear that a job offer is conditional on satisfactory references, a background check and verification of details in the application form, Mr Ball says.

"Where possible, the start date should be delayed until the checks have been completed, because it is much easier to withdraw an offer that was made conditional than it is to dismiss somebody who has already entered employment," he says.

"It is important application forms are looked at to indicate that these checks will be made, because really what you are trying to do is discourage the bogus applicant."

Stuart Craig, an associate in NHS employment at law firm Mills & Reeve, says employers will avoid most of the major pitfalls if they follow the new NHS Employers' guidance rigorously. In his experience, the main "elephant traps" are not getting references from the right person - such as going to a medical colleague rather than a manager - and not following up on occupational health checks, which can lead to disability discrimination issues.

Employing companies that screen people for senior appointments can help avoid expensive mistakes.

Nick Harness, director of employee screening firm Background Checking, says criminal records checking is only as good as the information that is put into the police national computer, as was proved by Ian Huntley in Soham - he was CRB checked.

"If they had done a very brief three-year employment check on the guy, he would never have been employed, because they would probably have had negative references coming back."

Such an employment check, which involves verifying that the company someone said they worked for exists and that their referee is able to provide references, is also helpful in cases where candidates come from overseas, he says.

"What you are then getting is multiple independent referees providing you with information around individuals, which goes towards their integrity, their character and also their ability to do the job."

Details of how the Independent Safeguarding Authority, the body that has been set up to prevent people like Ian Huntley getting jobs where they will have close contact with children or vulnerable adults, will operate were revealed last week. It will draw together information from a wide range of sources, including employers and police, for the first time, and on the basis of this consider whether someone should be registered or barred from working with children and vulnerable adults. People wanting to work with vulnerable groups will pay a one-off fee of£64 to be checked. This covers the cost of the ISA monitoring and the CRB's costs in processing the registration and making searches of the police national computer. Registration will be reconsidered if the authority gets new information about that person from an employer or the police.

Statutory duties

The authority's chief executive Adrian McAllister explains: "There will also be statutory responsibilities on organisations that employ people in the various sectors, to inform the agency if anything comes to light which they feel essentially the authority should know, because it might affect somebody's suitability to work with vulnerable adults or children."

He says the agency is still working out some of the detail of how referral processes for employers will work.

Overall, 11.3 million employees people are expected to have to register with the authority. Mr McAllister acknowledges that this will be a challenge. "We are not going to try and put everybody through the scheme on day one - that will quite simply be impossible. The scheme will be phased in over five years."

Initially, the new body will register only new employees because they are considered to present the highest risk. Existing employees will then be dealt with, and prioritised according to their level of risk.

Mr McAllister anticipates more than 90 per cent of requests will go through the system within seven days, because no information will be held on that person. But he says it is difficult to predict what the average turnaround will be. "Where we have one single piece of information on an individual, that decision might be relatively straightforward and quite speedy; where we might have several strands of information, perhaps some conviction data from the police, perhaps caution data and perhaps one or two referrals from employers, then working through those and making sure we come to a balanced and carefully considered decision on what is a significant event in somebody's life, which is to be barred or not, will take considerably longer."

He adds that there will also be a statutory responsibility on employers to check that someone is ISA registered before employing them to work with vulnerable groups and not to employ anybody who has not been through the scheme or is barred. "There are significant fines or other sentences that can be applied if they don't do that."

Mr McAllister emphasises that the scheme considers only whether someone poses a risk to vulnerable adults or children and does not consider their overall suitability to be employed. "The ISA will not necessarily take into account someone's entire criminal history. Employers still retain their responsibility in appropriate circumstances for ensuring they see the full criminal history through an enhanced CRB check. What that tells them is there may be other convictions that the authority has not considered because they are not pertinent to whether someone might present a risk of harm, but as an employer you might want to consider them while you are making your employment decision."

For example, a drink driving offence is unlikely to be a factor in a barring decision, he says, but could be something an employer might want to consider if the employee might be required to drive vulnerable people around or just drive generally.

Ms Hester at NHS Employers does not anticipate that the extra work the authority will put on HR departments will be cumbersome, even though it will cover staff from doctors to cleaners.

But Unison has warned that the£64 fee will be onerous for low-paid workers and could spark a recruitment and retention crisis. Ms Hester says employers recognised this and many were likely to pick up the bill. "My understanding is that the vast majority of NHS organisations pay the CRB fee, for example. I would imagine it will not be dissimilar to that, but it is very much a local decision.

"The NHS, as any other public body with large buildings and lots of people, is potentially at risk of a security threat and NHS organisations need to have an integrated approach to managing those risks. Pre-employment checks are part of that approach, which aims to protect patients, the public and staff from any potential risks."