Training prepared by Geoff Webb Information Security & Governance Consultant Data Protection isn’t a choice, it’s the law What all CPH staff must do 17/07/2013 DPA Presentation v31

Person Identifiable Data (PID) - the information that would enable a person’s identity to be established 17/07/2013 DPA Presentation v32 Main Points

The term applies to a combination of some of the following data items wherever it/they may appear and irrespective of the name of any data field in which it/they may appear, allowing that patient to be identified: Name - including last name and any forename or aliases Address – including any current or past address of residence Postcode - including any current or past postcode of residence Telephone number Date of birth NHS number Ethnic category Local Patient identifier Hospital Encounter number Patient pathway identifier SUS spell ID Unique booking reference number Date of death 17/07/2013 DPA Presentation v33 Person Identifiable Data (PID)

Person Identifiable Data (PID) - the information that would enable a person’s identity to be established Security and confidentiality of PID 17/07/2013 DPA Presentation v34 Main Points

Keep it safe Don’t let someone else have it Don’t give someone’s secrets away 17/07/2013 DPA Presentation v35 Security and confidentiality of PID

Why not? The Data Protection Act is the law that protects us against illegal and inappropriate use of our personal information without our consent, and the same applies to us using the information of others 17/07/2013 DPA Presentation v36 Security and confidentiality of PID

Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:eight principles of the Data Protection Act 1.Fairly and lawfully processed 2.Processed for limited purposes 3.Adequate, relevant and not excessive 4.Accurate and up to date 5.Not kept for longer than is necessary 6.Processed in line with your rights 7.Secure 8.Not transferred to other countries without adequate protection 17/07/2013 DPA Presentation v37 Data Protection Act Principles

Person Identifiable Data (PID) - the information that would enable a person’s identity to be established Security and confidentiality of PID The need to identify individual data subjects 17/07/2013 DPA Presentation v38 Main Points

Do you really need to know who they are? If so, they must give informed consent Anonymisation and Pseudonymisation 17/07/2013 DPA Presentation v39 The need to identify individuals

Data Protection Act Civil Rights Freedom of Information 17/07/2013 DPA Presentation v310 Reasons to be careful – part 1

Information Commissioner’s Office (ICO) Wrath of the ICO Legal and Financial penalties 17/07/2013 DPA Presentation v311 Reasons to be careful – part 2

If we breach any of the DPA Principles, the ICO can impose heavy financial penalties, up to £500,000 a time. If a person thinks that we are not doing all we should with their personal data they can ask the ICO to investigate. The ICO will arrive unannounced and will carry out a stringent audit on all our processes for handling Personal Data. 17/07/2013 DPA Presentation v312 Data Protection Act and the ICO

Information Security Maintain Confidentiality Always keep on the right side of the law 17/07/2013 DPA Presentation v313 What can you do?

Electronic data security Physical security What to watch out for 17/07/2013 DPA Presentation v314 Information Security

Don’t gossip 17/07/2013 DPA Presentation v315 Maintain Confidentiality

17/07/2013 DPA Presentation v316 Stay safe online What’s at risk? Personal information Corporate information

Source of risk? Virus writers attachments Software 17/07/2013 DPA Presentation v317 Stay safe online

Types of risk? Worms Trojan Horses Botnet Phishing 17/07/2013 DPA Presentation v318 Stay safe online

Types of risk? Worms Trojan Horses Botnet Phishing 17/07/2013 DPA Presentation v319 Stay safe online

Types of risk? Worms Trojan Horses Botnet Phishing 17/07/2013 DPA Presentation v320 Stay safe online If you click on My Account Activity you will go to somewhere quite unexpected

Can you avoid the risk? 17/07/2013 DPA Presentation v321 Stay safe online

Can you avoid the risk? Not really 17/07/2013 DPA Presentation v322 Stay safe online

Can you avoid the risk? Not really Damage limitation 17/07/2013 DPA Presentation v323 Stay safe online

Can you avoid the risk? Not really Damage limitation Use Encryption 17/07/2013 DPA Presentation v324 Stay safe online

Avoid being the risk protocol Using social media Follow the rules 17/07/2013 DPA Presentation v325 Stay safe online

What if you are targeted? SPAM Suspected Malware You said something you shouldn’t have 17/07/2013 DPA Presentation v326 Stay safe online

What you need to do 1.Think before you Send 2.Don’t fall for hoaxes 3.Take care with social media 17/07/2013 DPA Presentation v327 Stay safe online

Finally If a process isn’t intuitive, use a Checklist Know where the Policies, Procedures and Guidelines are stored When in doubt, ask! 17/07/2013 DPA Presentation v328 Always keep on the right side of the law