Information Governance and Data Security

• The Eight Caldicott Principles

Handwashing is something so routine to us all that it is carried out as a matter of habit and viewed as an essential part of keeping people safe. We all need to routinely display the same levels of care towards cyber security, to keep our patients - and ourselves - safe.

Good data and cyber security is our shared responsibility. Individual health and care organisations are accountable for their own cyber security, and all staff across the NHS have a role to play. Falling victim to cyber and security threats, inclulding phishing, password theft, tailgating and social engineering will have a direct impact on our patients.

NHS Digital's cyber security campaign, Keep IT Confidential, aims to drive cultural change by increasing the perceived importance and level of attention paid to data and cyber security by all staff in the NHS.

Whether you work directly with patients or in a vital support role, there are some simple effective steps that eveyone can take to protect patient data and create a safe culture of good cyber practices. Please see below links to the NHS Digital campaign posters and a leaflet which managers are encouraged to use in their staff areas.

Some key risks and areas to think about are:

• weak passwords

Weak passwords risk breaches in patient confidentiality. The easiest way to protect yourself from cyber threats is by having a strong and varied password. Passwords are the best form of defence that we have to prevent unauthorised access, so make sure you keep them private and out of sight of others. The longer and more complex your password, the more difficult it is to crack.

• phishing

Phishing is when hackers and criminals send unsolicited emails that contain attachments or links to try to trick people into providing access to information such as patient data, health care records or details of IT systems . If an email looks untrustworthy, forward it to spamreports@nhs.net and delete it.

Click here to watch an information video

• tailgating

Tailgating is when unauthorised people gain entry to a building by following a staff member through physical security facilities (doors, barriers, gates, etc) to avoid detection. By letting people follow you, or swiping unauthorised people in, you could risk someone stealing patient data. Don't let unauthorised people follow you into restricted areas.

Click here to watch an information video

• unlocked screens

Unlocked screens are an open invitation to patient data theft. Locking screens and logging out of systems help prevent people from accessing sensitive or confidential information. Keep your screens and devices locked when they're not in use.

• social engineering

Social engineering involves criminals using tricks or decption to manipulate people into giving access to information such as patient data, health care records or details of IT systems. A social engineer might call and pretend to be a fellow employee, ask you to hold the door for them, or pose as a "friend" on social media channels. Challenge everyone who is unauthorised before giving out information or giving them access to secure areas.

Click here to watch an information video

Useful materials

NHS Digital have produced posters and a leaflet which teams can access and use in their areas. 

Generic poster

Generic A5 leaflet

Specific posters x 5

• Privacy Impact Assessment
• Privacy Policy
• Use & Release of Person-Identifiable, Pseudonymised and Anonymised Data
• Use & Release of Personal Identifiable Data (Caldicott Approval Form)
• Data Flow Review Questionnaire
• Email communications with patients / clients
• Handling Outgoing Mail
• STANDARD OPERATING PROCEDURE FOR THE MANAGEMENT OF OBJECTIONS TO PROCESSING PERSONAL DATA
• Handling Personal Data Breaches
• ICO Code of Practice on Information Sharing