1. Data Protection and Confidentiality

2.
Course objectives
Confirm the meaning of data protection and confidentiality
State key legislation in relation to data protection and confidentiality
Confirm the eight core principles of data protection
Consider the implications for both employers and employees and the risks of not adhering to the law
State data protection issues relating to marketing, postage, and social media
Know people’s individual rights for accessing their own information
Confirm practical methods of ensuring that all staff comply to confidentiality policies

3. Sensitive information about YOU
Sensitive information about YOU
How sensitive is information about you?
What do you wish to remain ‘secret’ about yourself?
What personal information about yourself would you tell your employer?
What personal information would you tell your doctor?
What personal information would you tell a member of your immediate family?

4. What is Information Governance?
What is Information Governance?
It concerns the safe management of information you look after for your organisation. This includes:
Data protection confidentiality and Privacy
FOI Act 2001
Records management
Information Security

5. Data Protection, Confidentiality and Privacy
Data Protection, Confidentiality and Privacy
Patient information
Health Records
Employee information
Data protection act
Data Protection
Influencing thinking on privacy and processing of personal information
Maintaining a Statutory Register of personal data users
Need-to-know basis

6. The Eight Principles of Good Practice
The Eight Principles of Good Practice
These say that data must be: 1. fairly and lawfully processed 2. processed for limited purposes 3. adequate, relevant and not excessive 4. accurate and up to date 5. not kept longer than necessary 6. processed in accordance with the individual’s rights 7. secure 8. not transferred to countries outside European Economic area unless country has adequate protection for the individual

7. Sharing information We can only share information about people if:
Sharing information
We can only share information about people if:
we have their consent to do so
there is a law that says we have to
it is in the public interest, such as to prevent serious harm

8. The 6 Principles of Confidentiality
The 6 Principles of Confidentiality
Justify the purpose(s)
Don’t use patient-identifiable information unless it is absolutely necessary
Use the minimum necessary patient-identifiable information
Access to patient-identifiable information should be on a strict need-to-know basis
Everyone with access to patient identifiable information should be aware of their responsibilities
Understand and comply with the law

9.
Caldicott Guardians
Has key responsibility for staff awareness and training
Puts in place systems for access on a need to know basis
Is the local champion re: relationship with patients and their information
Is a member of the wider information governance team
Is responsible for ensuring that systems are in place for safeguarding confidential patient information
Advises on confidentiality issues

10.
Caldicott Principles 2013
All staff members need to know about the Caldicott Principles and to follow them:
Justify the purpose(s) for using patient data
Don’t use patient-identifiable data unless absolutely necessary
Use the minimum necessary patient-identifiable information
Access to patient-identifiable information should be on a strict need to know basis
Everyone should be aware of their responsibilities to maintain confidentiality
Understand and comply with the law, in particular the Data Protection Act
The duty to share information can be as important as the duty to protect patient confidentiality

11. Sensitive data Racial or ethnic origin Political opinions
Sensitive data
Racial or ethnic origin
Political opinions
Religious or other beliefs
Trade Union membership
Physical or mental health condition
Sex life
Criminal proceedings or convictions

12. Patient-identifiable information
Patient-identifiable information
A combination of one or more of these can be used to identify a patient:
Forename
Surname
Initials
Address
Telephone number
Date of birth
Sex
Post code
Social security number
Ethnic group
Occupation