Vertical Markets

Health and care data consultation

by Mark Rowe

Sharing the right information with the right people at the right time is essential to the delivery of high quality healthcare, whether in making an accurate diagnosis or in ensuring that test results are communicated and acted on. As health and social care bodies become more paperless and digital, more robust data protection is needed to ensure patient trust and confidence and that these responsibilities must be taken seriously by the system and its staff. Hence, in September 2015, the Government asked the regulator the Care Quality Commission and Dame Fiona Caldicott, the National Data Guardian for Health and Care, to review data security across health and care.

Dame Fiona Caldicott recommended that the Government consult the public on both the data security standards, and her proposals for a new consent/opt-out model. Hence a public consultation that closes on September 7.

Briefly, the Caldicott review included ten new data security standards; a method of testing compliance with these standards; and a new consent model for data sharing in health and social care.

For details visit https://www.gov.uk/government/consultations/new-data-security-standards-for-health-and-social-care.

According to the consultation document, the review found that people generally trust the NHS to protect information. However there have been cases where that trust has been eroded by data breaches, where sensitive information has been shared inappropriately or without consent, or records are misplaced or lost. There are concerns that the move to digital systems increases the potential impact of data breaches. On the basis that data breaches are caused by people, processes and technology, the review recommended ten new data security standards:

1. All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared
for lawful and appropriate purposes.

2. All staff understand their responsibilities under the National Data Guardian’s Data Security Standards including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.

3. All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit.

4. Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals.

5. Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.

6. Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near
miss, with a report made to senior management within 12 hours of detection.

7. A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.

8. No unsupported operating systems, software or internet browsers are used within the IT estate.

9. A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least
annually.

10. Suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standard.

Related News

Newsletter

Subscribe to our weekly newsletter to stay on top of security news and events.

© 2024 Professional Security Magazine. All rights reserved.

Website by MSEC Marketing