Data security and protection for health and care organisations

Document outlining action expected from health and care organisations in 2017 to 2018, to implement recommendations by the National Data Guardian.   It has been updated.

NHS Digital publishes guidance on data off-shoring and cloud computing for health and social care

National guidance has been published, setting clear expectations for health and care organisations who want to use cloud services or data offshoring to store patient information.

The guidance will ensure that organisations know how to use these solutions safely and securely, especially in the light of the fact that tighter restrictions on the processing and transfer of personal data are being brought in through the launch of the General Data Protection Regulation (GDPR) in May.

Age-related macular degeneration [NG 82]

New:  NICE guideline

1.1 Classifying age-related macular degeneration

1.2 Information and support

1.3 Risk factors

1.4 Diagnosis and referral

1.5 Pharmacological management of AMD

1.6 Non-pharmacological management of AMD

1.7 Monitoring AMD

Terms used in this guideline

Changes to data protection requirements under the General Data Protection Regulation (GDPR)

This factsheet from NHS Employers, developed in conjunction with Capsticks, outlines the key changes that will affect the way that employers in NHS organisations carry out tasks involving personal data, particularly around employment checks and recruitment processes.

New national data opt-out

A new national data opt-out will be introduced from March 2018 to give patients a clear choice on how their personally identifiable data is used for purposes beyond their individual care, as detailed in the government’s response to the national data guardian.

NHS Digital is developing the system now along with a suite of communications products for the workforce and patients to test.  

National Data Guardian for Health and Care 2017 report: impact and influence for patients and service users

This report from the National Data Guardian looks back over the past three years since the creation of the National Data Guardian role and it describes future priorities. It sets out a case for the independent advice and challenges that the role provides to ensure that confidential data collected by the NHS and social care services is safeguarded and used appropriately to improve care.

Sharing data in line with patients' reasonable expectations

The National Data Guardian has been looking at the circumstances under which health and care data may be shared, and the role that patients’ reasonable expectations play in shaping these circumstances. Part of this work has been examining how implied consent is used within health and care settings to share patient data and support individual care. 

These reports cover two events examining this, and the importance of understanding patient expectations.

General Data Protection Regulation - will you be ready?

From 25 May 2018, all health organisations and arm's-length bodies will need to demonstrate compliance with new General Data Protection Regulation (GDPR) requirements. GDPR will replace the Data Protection Directive (1995).

Employers are encouraged to plan ahead for the operational changes and consider how they will raise awareness of the new requirements and evidence they meet them. This will include:

• Planning and resourcing the appointment of a data protection officer whose job description is compliant with GDPR requirements.
• Revising information governance and related policies, addressing accountability, data protection officer reporting arrangements and statutory reporting requirements.
• Creating an action/project plan which includes a set of measures to meet the requirements, ideally endorsed by the board.

A seminar on 16 January 2018 in London and 18 January 2018 in Manchester will provide an overview of the GDPR and of the Data Protection Bill insofar as it relates to the processing of personal data within the health and social care context and incorporates and supplements the GDPR.

Revised guidance on confidentiality published

The HCPC has relaunched its Guidance on confidentiality, which provides advice for registrants on how they should handle and share information about service users.

Practical guidance on sharing of information and information governance for all NHS organisations specifically for Prevent and the Channel process

This guidance from NHS England is intended to assist those involved in information sharing and information governance for the purpose of Prevent, a counter-terrorism safeguarding programme. It is designed to assist in the decision making process about the appropriateness of sharing information (particularly sensitive health information) such as the decisions made by Caldicott Guardians.

Your data: better security, better choice, better care

This DH report outlines the government's response to the Caldicott Review and the Care Quality Commission's review on data protection in the NHS. The response accepts the recommendations in both reviews and it makes commitments to the safeguarding of information with the creation of the National Data Guardian's position as a statutory position and the introduction of stronger sanctions to protect anonymised data.

Proper Planning Prevents…NHS cyber attack

What lessons can be taken for future major incident planning from the NHS cyber attack? Helen Buckingham reflects and reports back from our New Cavendish Group.

Confidentiality: good practice in handling patient information

This guidance sets out the principles of confidentiality and respect for patients’ privacy that all doctors are expected to understand and follow. It also sets out the responsibilities of doctors for managing and protecting patient information.

• Guidance

New Confidentiality guidance published by the GMC

The General Medical Council (GMC) has published revised, expanded and reorganised guidance on confidentiality for all doctors practising in the UK. The guidance – Confidentiality: good practice in handling patient information – comes into effect from Tuesday 25 April 2017.

Guidance on safeguarding children and information protection

NHS England has clarified the relevant guidance on sharing child protection information in the NHS standard contract 2017/19.

Child Protection Information Sharing (CP-IS) is included in the NHS Standard Contract 2017/19 and this guidance offers support to the Designated Professional Safeguarding Children system leadership (see below).

“The Provider must co-operate fully and liaise appropriately with third party providers of social care services in relation to, and must itself take all reasonable steps towards, the implementation of the Child Protection Information Sharing Project.”(NHS Standard Contract, 2017/19, SC32.8 page 35)

Local authority pays damages after transgender boy’s privacy breached

A local authority has paid almost £5,000 to a transgender boy whose right to a private life was broken by an employee.

The 17-year-old, who was born a girl, was an adopted child but his relationship with his adoptive parents “completely broke down” after he told them he wanted to change sex.

A network to support the new models of care with information governance

For the new care model vanguards and the integrated care pioneers, who are redesigning care on an industrial scale, information Governance (IG) has the potential to be a major headache. In this blog, Geraint Lewis, Chief Data Officer at NHS England, discusses the launch of a new collaborative network aimed at ensuring that IG becomes a tool to improve health and wellbeing rather than being perceived as an irritation or a barrier to good work.

Managing risk in social media

Social media is a powerful marketing tool for organisations but it is not without risk. These risks can have a major impact on you, your career and your organisation. And they can happen whether or not you are using social media.

Managing risk in social media helps you analyse and prepare your organisation for the problems that may occur when using social media. It helps you understand how to handle internal social accounts and deal with external social media activity which your organisation may become involved in.

This e-learning course will not only help you to understand, identify and manage risks, but will also guide you in preparing to protect your organisation from damage that may be caused.

CQC launches an updated code of practice on confidential personal information

The CQC has updated the code its staff follow to obtain, handle, use and disclose confidential personal information.

The code explains how CQC makes decisions relating to people’s confidential personal information. This includes how we decide whether we need to look at medical or care records during an inspection, and whether we need to share personal information that we hold.

CQC launches an updated code of practice on confidential personal information

The code explains how CQC makes decisions relating to people’s confidential personal information. This includes how we decide whether we need to look at medical or care records during an inspection, and whether we need to share personal information that we hold.