INFORMATION GOVERNANCE Awareness for Acute Services Staff

WHAT IS INFORMATION GOVERNANCE? Caldicott Confidentiality Data Protection Data Quality Freedom of Information Information Security Records Management Information Governance Sits alongside Clinical Governance. We have an Information Steering Group which meet quarterly and is chaired by Andy Crawford, Head of Clinical Governance. It encompasses Data Protection, Caldicott, Records Management, FOIs, Confidentiality, Information Security and Data Quality.

OBJECTIVES Refresher on data protection and confidentiality Legal obligations Keeping information safe Reporting Breaches NHSGG&C policies and procedures

WHAT IS DATA PROTECTION? “DATA PROTECTION IS CONCERNED WITH THE SAFEGUARDING / PROTECTING OF PERSONAL IDENTIFIABLE DATA, WHETHER IT RELATES TO PATIENTS, STAFF OR OTHERS”

RESPONSIBILITY FOR DATA PROTECTION The Information Commissioner’s Office is responsible for ensuring organisations comply with the Act. They can: Impose monetary fines of up to £500,000 Audit health boards – inspect and confiscate files Interview staff Prosecute and/or fine individuals Impose other sanctions

8 PRINCIPLES

Principle 6: What Can People Access? Health / Occupational Records Personnel File Payroll Information Complaint / Grievance Files Datix Reports Emails Witness Statements

Scenarios Your Aunt phones and asks if you can check when her appointment is due. You check Trak and tell her. Is this appropriate? You are worried about a blood test and when you are back at work you have a look at the results. Is this appropriate? Can you use unencrypted USB memory sticks within the Health Board?

WHO IS RESPONSIBLE? Everyone! Legal Obligation Terms of Employment NHS Scotland Code of Practice Policies and Procedures

HOW DO BREACHES HAPPEN? Faxing/Emailing information to the wrong recipient Theft/Loss of files, notes or papers Theft/Loss of IT equipment Posting information about patients, colleagues or the Organisation on social networking sites Inappropriate access to information (eg. your own, family etc)

BREACHES The Individual The Organisation The staff member responsible A breach of confidentiality can have serious consequences for: The Individual The Organisation The staff member responsible

Human Error – Paying Attention Most breaches we see are not intentional, but down to human error

INFORMATION COMMISSIONER Over 50 organisations have been fined between £1,000 - £400,000 British Pregnancy Advice Service £200,000 Glasgow City Council £150,000 Regal Chambers GP Surgery £40,000 Blackpool Teaching Hospitals NHS Foundation Trust £185,000 Eileen McMillan, Clerical Officer, NHS Portsmouth (5th April 2017) £653.75 and a victim surcharge of £65, Criminal Record and lost her job!

NHSGGC Breaches Two letters to GP sent to one of the patients with same surname as GP Two referrals from another HB sent to one of the patients in error – contained sensitive clinical history Letter to GP re patient and fertility treatment sent to Dentist in error Doctor left patient files at bus stop – handed into RAH by member of the public Nurse left 15 patient files in car boot over weekend – car stolen and files never retrieved Patient letters found in hospital grounds from burst bag

SCENARIO In the course of your working duty, you see someone who is known to you attending an outpatient clinic. You then go home and discuss this with family/friends. Have you breached your duty of confidence?

Further guidance available in the Data Breach Policy REPORTING BREACHES All ACTUAL, SUSPECTED or POTENTIAL breaches should be reported using the Datix system as soon as possible. This should be done as soon as the breach occurs Inform your line manager If IT equipment is missing/stolen – report to the IT Service Desk and Police if necessary. If appropriate, also inform the Information Governance Department Further guidance available in the Data Breach Policy

POLICIES AND GUIDELINES Search for Information Governance Framework on Staff Net Or click the eHealth Button and select Policies and Procedures

CONTACT DETAILS Kerry Lochrie, Project Lead Email: kerry.lochrie@ggc.scot.nhs.uk Tel: 0141 355 2059 Isobel Brown, Information Governance Manager Email: Isobel.Brown@ggc.scot.nhs.uk Tel: 0141 355 2020 Stephen Harris, Information Security Manager Email: Stephen.Harris@ggc.scot.nhs.uk Tel: 0141 278 4728 Or our team mailbox is: data.protection@ggc.scot.nhs.uk