http://www.kirklees.nhs.uk/uploads/tx_galileodocuments/Information_Governance_Policy_01

Kirklees Primary Care Trust

Information Governance Policy

Policy Version: Issued by: Status: Reference: Review date:

2 The Confidentiality and IM&T Security Team, The Health Informatics Service Final Version March 2010

1

KIRKLEES PRIMARY CARE TRUST INFORMATION GOVERNANCE POLICY 1

Introduction Information Governance addresses the demands that law, ethics and policy place upon information processing – holding, obtaining, recording, using and sharing of information. It is crucial to ensure that staff are aware of these demands and the implications for patient care.

Kirklees PCT recognises the importance of reliable information, both in terms of the clinical management of individual patients and the efficient management of services and resources. Information governance plays a key part in supporting clinical governance, service planning and performance management.

Robust information governance systems and processes give assurance to the PCT and to individuals that personal information is dealt with legally, securely, efficiently and effectively, in order to deliver the best possible care.

Guidance from the Department of Health stipulates that security measures in place within the PCT are reflective of the modern working environment.

Greater controls must be placed on laptops and removable data storage devices (CDs, flash drives, USB drives data sticks, etc). Flexible working arrangements dictate that information is increasingly being taken off-site so current policies must address this.

The PCT will establish and maintain policies and procedures to ensure compliance with requirements contained in the National Information Governance Toolkit.

2

Scope This policy covers:

all aspects of information within the organisation, including (but not limited to): o Patient/Client/Service User information o Personnel/Staff information o Organisational information

all aspects of handling information, including (but not limited to): o Structured record systems - paper and electronic o Transmission of information – fax, e-mail, post and telephone

all information systems purchased, developed and managed by/or on behalf of the organisation

and applies equally to staff employed on permanent, temporary or voluntary placement.

2

3

Principles

3.1

Openness

The PCT recognises the need for an appropriate balance between openness and confidentiality in the management and use of information

Information will be defined and where appropriate kept confidential, underpinning the principles of Caldicott and the regulations outlined in the Data Protection Act. Non-confidential information about the PCT and their services will be available to the public through the Freedom of Information Act

The PCT has a Freedom of Information Policy and Procedure and publication scheme in place

Patients have access to information relating to their own health care, options for treatment and their rights as patients. This is managed through the PCT’s Handling Access Requests for a Health Record Procedure

The PCT has clear procedures and arrangements for liaison with the press and broadcasting media

Integrity of information will be monitored and maintained to ensure that it is appropriate for the purposes intended

Availability of information for operational purposes is maintained within set parameters relating to its importance via appropriate procedures and computer system resilience

The PCT regards all identifiable personal information relating to patients as confidential and compliance with legal and regulatory framework will be achieved, monitored and maintained

The PCT regards all identifiable personal information relating to staff as confidential except where national policy on accountability and openness requires otherwise

The PCT has established and maintain policies and procedures to ensure compliance with the Data Protection Act, Human Rights Act, the common law duty of confidentiality and the Freedom of Information Act. The PCT is also accountable to professional bodies

Awareness and understanding of all staff, with regard to responsibilities, will be routinely assessed and appropriate training and awareness provided

Risk assessment, in conjunction with overall priority planning of organisational activity will be undertaken to determine appropriate, effective and affordable information governance controls are in place 3

3.2

3.3

4

Records Management processes are in place which include publication of retention periods, appropriate destruction timetable and archiving processes

Information Security

The PCT will establish and maintain policies for the effective and secure management of its information assets and resources (see Appendix 1)

Audits will be undertaken or commissioned to assess information and IT security arrangements

The PCT’s Incident Reporting system will be used to report, monitor and investigate all breaches of confidentiality and security

The PCT has a Caldicott Guardian and requests for bulk transfer of information will be authorised through Information Sharing Agreements and the Caldicott Guardian

Information Quality Assurance

The PCT will establish and maintain policies and standards for information quality assurance and the effective management of records

Audits will be undertaken or commissioned for the quality of data and records management arrangements, improvement plans will be drawn up and implemented

Managers will be expected to take ownership of, and seek to improve, the quality of data within their services

Wherever possible, information quality will be assured at the point of collection

The PCT will promote data quality through policies, procedures/user manual and training

Legislation and PCT Related Policies The PCT has a comprehensive range of policies supporting the information governance agenda; reference must be made to these alongside this policy.

Legal and professional guidance / codes of conduct should also be considered where appropriate (Appendix 1). All PCT policies should take into account Information Governance requirements.

5

Year on Year Improvement Plan and Assessment An assessment of compliance with requirements, within the Information Governance Toolkit (IGT), is undertaken each year. Annual reports and proposed work programmes will be presented to the PCT’s Information Governance Group for approval prior to submission. The requirements are grouped into the following initiatives: 4

• • • • • • 6

Information Governance Management Confidentiality and Data Protection Assurance Information Security Assurance Clinical Information Assurance Secondary Use Assurance Corporate Information Assurance

Information Governance Management Information governance management across the organisation will be coordinated by the Information Governance Group.

The responsibilities of the Information Governance subgroup are laid down in the Terms of Reference (Appendix 2) and include (but are not limited to): •

Recommending for approval by the PCT Board related policies and procedures

•

Recommending for approval to PCT Board the annual submission of compliance with requirements in the Information Governance Toolkit and related action plan

•

To co-ordinate and monitor the Information Governance Strategy across the organisation

Information Governance leads throughout the organisation will be central to the delivery of the information governance strategy 7

Training All staff should receive, as part of their induction, a training session on Information Governance. Top–up training will be provided via the PCT’s Mandatory Essential Training Programme.

5

APPENDIX ONE Related Policies • • • • • • • • • • •

• • •

Confidentiality Code of Practice Freedom of Information Act Policy Incident Reporting Policy Information Governance Strategy Information Security Policy Network Security Policy Internet Use Policy Email Use Policy Remote Access Policy Communications Policy Professional codes of conduct from the BMA, GMC and NMC and others including Allied Health professionals, Finance Professionals and NHS Managers Records Management Policy Guidance for the safe transmission of faxes (Safe Haven) Data and Information Quality

Legislation • • • • • • • • • •

Data Protection Act 1998 Human Rights Act 1998 Freedom of Information Act 2000 Reuse of Public Sector Information (SI 2005 1515) Access to Health Records Act 1990 (where not superseded by the Data Protection Act) Computer Misuse Act 1990 Copyright, designs and patents Act 1988 (as amended by the Copyright Computer programs regulations 1992) Crime and Disorder Act 1998 Electronic Communications Act 2000 Regulation of Investigatory Powers Act 2000

6

APPENDIX TWO TERMS OF REFERENCE 1.

BACKGROUND The PCT is reliant on robust information in order to deliver its objectives in an efficient and effective manner. The Information governance Toolkit and C9 Standard for better health set out the minimum standards that the PCT must work to when managing this information. These standards are pertinent to all the information held ad used by the PCT. The PCT is a repository for a large volume of personal or confidential information that must be managed in accordance with the Data Protection Act. In addition, the PCT must comply with the Freedom of Information Act when an individual requests access to some of its information.

2.

PURPOSE OF THE INFORMATION GOVERNANCE GROUP The Information governance Group exists to ensure that the PCT is compliant with the relevant standards pertinent to Information Governance and to oversee the annual information governance work programme.

It will provide assurance to the governance committee that the PCT is managing its information in accordance with the above standards, or issue exception reports should there be issues that need to be brought to the attention of either the Governance Committee or Trust Board.

3.

OBJECTIVES 1. To ensure that the PCTs have an effective policy and management arrangements in place to meet the requirements of

Data Protection Act 1998 Freedom of Information Act 2000 Connecting for Health Information governance Toolkit Caldicott Guardian Standards C9 Standard for Better Health NHS Litigation Authority Risk Pooling Scheme for Trust Risk Management standards British Standard 7799 (Information Security) Common law duty

2. To be the body that sets the strategy and policy that ensures that all the PCT’s records. This will be operationalised by the Records Management Group.

3. To recommend policies or procedures to the Governance Committee for ratification.

7

4. To provide Board Assurance, via the governance committee, that risks associated with Information Governance are being managed or to highlight significant risks and associated resource implications.

5. To monitor the implementation of the prioritised Information Governance work programme 6. To receive reports into breaches of information security or confidentiality and monitor that learning points are implemented across the PCT 7. To ensure that audits required in order to comply with Information Governance standards are carried out within the PCT and to consider the reports of these audits 8. To provide steerage, advice, guidance and support on Information Governance to PCT employees 9. To provide advice and guidance for Independent Contractors on Information Governance 4.

MEMBERSHIP Core Membership Director of Corporate Services (Chair) Caldicott Guardian Assistant Director of Corporate Services & Risk Performance and Information Directorate Representative Public Health Directorate Representative Provider Services Representative Assistant Director, Head of Information, Analysis and Data Quality The Health Informatics Service (THIS) Representative Confidentiality & Information Security Officer In attendance according to content of agenda Commissioning and Service Development directorate representative Finance Directorate representative Human resources Directorate representative Confidentiality & Information Security Manager

5.

QUORUM The meeting will be quorate on the attendance of one third of the membership whish must include the Chair (or their deputy) NB: If a member is unable to attend a meeting, they should arrange for a deputy to attend on their behalf.

6.

FREQUENCY OF MEETINGS The Information Governance Group will meet bi-monthly, unless the Chair calls an additional meeting to address a particular issue.

8

7.

SUPPORT TO THE COMMITTEE The Committee will be supported by the PA to the Director of Corporate Services.

8.

REPORTING 1. The Information Governance Group is a sub-group of the Governance Committee and hence directly accountable to the Governance committee.

The minutes of each meeting to be presented to the Governance Committee for receipt and discussion as appropriate together with an appropriate cover sheet.

2. Relevant articles will be produced for PCT newsletter and the Team Brief.

These will also be posted on the internet/intranet.

9.

SUB-COMMITTEES Records Management Group

10.

CONDUCT OF BUSINESS

11.

Agendas and papers will be circulated to committee members at least 7 calendar days before the meeting.

Minutes of the meeting will be circulated no later than 14 Calendar days after the meeting This Committee will observe the requirements of the Freedom of Information Act 2000, which allows a general right of access to recorded information held by the PCT, including minutes of meetings, subject to specified exemptions This committee will operate in accordance with the PCT’s guidance for Chairs and Minute takers All members must declare any conflict of interest they may have regarding an agenda item at the start of the meeting

REVIEW DATE These Terms of Reference will be reviewed on an annual basis.

Approved by the Governance Committee Review Date

9

March 2007 March 2008