1. INFORMATION GOVERNANCE
Awareness for Acute Services Staff

2. WHAT IS INFORMATION GOVERNANCE?
Caldicott
Confidentiality
Data Protection
Data Quality
Freedom of Information
Information Security
Records Management
Information Governance Sits alongside Clinical Governance. We have an Information Steering Group which meet quarterly and is chaired by Andy Crawford, Head of Clinical Governance.
It encompasses Data Protection, Caldicott, Records Management, FOIs, Confidentiality, Information Security and Data Quality.

3. OBJECTIVES Refresher on data protection and confidentiality
Legal obligations
Keeping information safe
Reporting Breaches
NHSGG&C policies and procedures

4. WHAT IS DATA PROTECTION?
“DATA PROTECTION IS CONCERNED WITH THE SAFEGUARDING / PROTECTING OF PERSONAL IDENTIFIABLE DATA, WHETHER IT RELATES TO PATIENTS, STAFF OR OTHERS”

5. RESPONSIBILITY FOR DATA PROTECTION
The Information Commissioner’s Office is responsible for ensuring organisations comply with the Act.
They can:
Impose monetary fines of up to £500,000
Audit health boards – inspect and confiscate files
Interview staff
Prosecute and/or fine individuals
Impose other sanctions

6. 8 PRINCIPLES

7. Principle 6: What Can People Access?
Health / Occupational Records
Personnel File
Payroll Information
Complaint / Grievance Files
Datix Reports s
Witness Statements

8. Scenarios
Your Aunt phones and asks if you can check when her appointment is due. You check Trak and tell her. Is this appropriate?
You are worried about a blood test and when you
are back at work you have a look at the results. Is this
appropriate?
Can you use unencrypted USB memory sticks within the Health Board?

9. WHO IS RESPONSIBLE? Everyone! Legal Obligation Terms of Employment
NHS Scotland Code of Practice
Policies and Procedures

10. HOW DO BREACHES HAPPEN?
Faxing/ ing information to the wrong recipient
Theft/Loss of files, notes or papers
Theft/Loss of IT equipment
Posting information about patients, colleagues or the Organisation on social networking sites
Inappropriate access to information (eg. your own, family etc)

11. BREACHES The Individual The Organisation The staff member responsible
A breach of confidentiality can have serious consequences for:
The Individual
The Organisation
The staff member responsible

12. Human Error – Paying Attention
Most breaches we see are not intentional, but down to human error

13. INFORMATION COMMISSIONER
Over 50 organisations have been fined between £1,000 - £400,000
British Pregnancy Advice Service £200,000
Glasgow City Council £150,000
Regal Chambers GP Surgery £40,000
Blackpool Teaching Hospitals NHS Foundation Trust £185,000
Eileen McMillan, Clerical Officer, NHS Portsmouth (5th April 2017) £ and a victim surcharge of £65, Criminal Record and lost her job!

14. NHSGGC Breaches
Two letters to GP sent to one of the patients with same surname as GP
Two referrals from another HB sent to one of the patients in error – contained sensitive clinical history
Letter to GP re patient and fertility treatment sent to Dentist in error
Doctor left patient files at bus stop – handed into RAH by member of the public
Nurse left 15 patient files in car boot over weekend – car stolen and files never retrieved
Patient letters found in hospital grounds from burst bag

15. SCENARIO
In the course of your working duty, you see someone who is known to you attending an outpatient clinic. You then go home and discuss this with family/friends.
Have you breached your duty of confidence?

16. Further guidance available in the Data Breach Policy
REPORTING BREACHES
All ACTUAL, SUSPECTED or POTENTIAL breaches should be reported using the Datix system as soon as possible. This should be done as soon as the breach occurs
Inform your line manager
If IT equipment is missing/stolen – report to the IT Service Desk and Police if necessary.
If appropriate, also inform the Information Governance Department
Further guidance available in the Data Breach Policy

17. POLICIES AND GUIDELINES
Search for Information Governance Framework on Staff Net
Or click the eHealth Button and select Policies and Procedures

18. CONTACT DETAILS Kerry Lochrie, Project Lead
Tel:
Isobel Brown, Information Governance Manager
Tel:
Stephen Harris, Information Security Manager
Tel:
Or our team mailbox is: