Implementation of Security and Confidentiality in GP Practices

Security and Confidentiality Definition of Security  Means used to protect against unauthorised use of and access to information Definition of Confidentiality  The protection of information so that someone not authorised to access or use the information cannot do so

Security and Confidentiality Human Rights Act (HRA) – Article 8 Right to Privacy  Confidentiality of Person Identifiable Information is a basic human right Common Law Duty of Confidentiality  All personal information given in confidence must be treated with the utmost confidentiality and can only be released without the consent of the person under ‘enactment‘ or if it is deemed to be ‘in the wider public interest’ All named Patient information within the NHS is subject to this definition

Legislation and Guidance  Enacted Law The Data Protection Act 1998 The Data Protection Act 1998  NHS Guidance The Caldicott Report The Caldicott Report Acceptable Use Policy/Information Security Management System Acceptable Use Policy/Information Security Management System

The Data Protection Act 1998  8 Principles  Personal data of living individuals must be: 1. Fairly and lawfully processed with consent 2. Obtained for specific and lawful purposes 3. Adequate, relevant and not excessive 4. Accurate and up to date 5. Not kept longer than necessary 6. Processed in accordance with the individual’s rights 7. Secure (technical and organisational measures) 8. Not transferred outside the EEA unless a country has adequate protection for the individual

Practice DPA Requirements  The Practice creates and processed PII and must notify the Information Commissioners Office annually: This commits the Practice to Principle 7 This commits the Practice to Principle 7 Personal Data of living individuals must be SECURE (technical and organisational measures)Personal Data of living individuals must be SECURE (technical and organisational measures) The notification must include the classes of PII and any disclosures – including the types of organisations to whom it discloses PII The notification must include the classes of PII and any disclosures – including the types of organisations to whom it discloses PII The Practice is the Data Controller of the PII it processes; the Data Protection Officer should be the Senior Partner/Clinician supported by the Practice Manager The Practice is the Data Controller of the PII it processes; the Data Protection Officer should be the Senior Partner/Clinician supported by the Practice Manager

The Caldicott Report 1997  The Caldicott Principles for managing Patient Identifiable Data in the NHS 1. Justify the purposes for using confidential information 2. Only use it when absolutely necessary 3. Use the minimum that is required 4. Access should be on a strict need-to-know basis 5. Everyone must understand his or her responsibilities 6. Understand and comply with the law

 Main recommendations Appoint a Caldicott Guardian to: Appoint a Caldicott Guardian to: Map the flows of Patient Data within the PracticeMap the flows of Patient Data within the Practice Identify PII exchanges into and out of the PracticeIdentify PII exchanges into and out of the Practice Risk assess and question every flow and only allow the flows that meet genuine needRisk assess and question every flow and only allow the flows that meet genuine need Allow access only when there is a genuine needAllow access only when there is a genuine need Set up Information Sharing Protocols with all organisations with whom the Practice shares dataSet up Information Sharing Protocols with all organisations with whom the Practice shares data Develop a Practice annual improvement plan to compliment the LHB planDevelop a Practice annual improvement plan to compliment the LHB plan Accept an audit of the process (LHB and HIW)Accept an audit of the process (LHB and HIW) The Caldicott Report 1997

Person Identifiable Information (PII) – A Summary  Uses must be defined, justified and lawful  Consent is needed to use it ‘widely’  Only record what is necessary  Keep it accurate and up-to-date  Keep it secure  Keep it confidential  Restrict access to a ‘need to know’ basis  Control sharing, but share where needed/justified  Don’t keep it longer than necessary  There is a legal right of access

Acceptable Use Policy (AUP)  Acceptable Use Policy introduced to Practices in 2000 and updated in 2002 Policies and procedures to support demonstration of Information Security Policies and procedures to support demonstration of Information Security All Practices signed a declaration stating compliance with AUP All Practices signed a declaration stating compliance with AUP

Information Security Management System (ISMS)  Model ISMS introduced to support GMPs in 2006/7 ISMS - Ongoing process incorporating policies, procedures and implementation of a support structure to deliver Information Security, along with regular review/audit ISMS - Ongoing process incorporating policies, procedures and implementation of a support structure to deliver Information Security, along with regular review/audit Enables Practices to meet the requirements of AUP Enables Practices to meet the requirements of AUP ISMS includes a revision and update of AUPISMS includes a revision and update of AUP

Roles within the Practice  Who is the Practice’s Data Protection Officer?  Who is the Caldicott Guardian within the Practice?  Who is the lead for Information Security and ISMS within the Practice?

Information Security Website for GMP Staff 