Title: GUIDANCE AND PROCEDURES
Author: emis_user
Last saved by: Wilson Diane
Company: Liverpool PCT

DRS. HAMLETT, MATTOCKS & EGAN
PENNY LANE SURGERY
7 SMITHDOWN PLACE
LIVERPOOL
L15 9EH
TEL: 0151 733 2800/6565
FAX: 0151 734 3418
----------------------------------------------------------------------------
Information Governance Policy (V2.3 Aug 22)

Last Reviewed: August 2021
Reviewed by: Kate Foley – Practice Manager
Signed: _______________________________

INTRODUCTION:
Penny Lane Surgery recognises the importance of reliable information, both in terms of the clinical management of individual patients and the efficient management of services and resources. Information Governance plays a key part in supporting Clinical Governance, service planning and performance management. 

Information Governance (IG) is “a framework for handling personal information in a confidential and secure manner to appropriate ethical and quality standards in a modern health service. In order to ensure that personal clinical information is dealt effectively, efficiently, securely and legally, a policy has to be framed known as information governance policy. 

Information governance policy is designed to achieve the aforesaid goal and would design appropriate procedures and shall place responsibility on practice staff members for information management within the practice.  

It also gives assurance to Penny Lane Surgery and to individuals that information is dealt with legally, securely, efficiently and effectively, in order to deliver the best possible care and to meet the Trust’s legal and good practice responsibilities 

SCOPE:
Penny Lane Surgery implements processes and procedures on the use of information in the provision of patient care, systems and services, which take into account the guidance, recommendations and obligations of the following:
- Caldicott - care in confidentiality of patient identifiable information 
- Consent for disclosure of patient identifiable information 
- Information Quality Assurance 
- Common law duty of confidentiality 
- The General Data Protection Regulation (GDPR) 2018.
- Records Management – including Health Records 
- Freedom of Information Act 2000 

This policy covers all aspects of information within the practice, including:
Patient/service user information, personnel information and organisational information. The policy also covers all aspects of handling information, including (but not restricted to):
•	Structured record systems – paper and electronic
•	Transmission of information – fax, email, post, electronic messaging and telephone.

The policy applies to all the members of practice staff and also includes visitors, external contractors, third party and all those who can have possible access to patient confidential information during course of their duty. Information includes all information stored or available in or by any medium or form. It also includes all information transmitted by fax, email, post and telephone.

OBJECTIVES:
The objectives of Penny Lane Surgery Information Governance Policy are to preserve: 

Confidentiality: Protecting sensitive information from unauthorised access or disclosure 

Integrity: Safeguarding the accuracy and completeness of information and computer software 

Availability: Ensuring information and vital services are available to users when required. 

Quality:  Ensuring information is of sufficient quality for the intended purpose. 

The potential impact of failure to preserve any of the above can be extremely serious. The impact of failure needs to be assessed using risk analysis techniques, but will frequently be such as to require very significant security measures to be taken. 

AIMS:
The aim of this policy is to establish and maintain the security, quality and confidentiality of information, information systems, applications and networks owned or held by the Penny Lane Surgery by: 

•	Ensuring that all members of staff are aware of and fully comply with the relevant legislation as described in this and other Penny Lane Surgery policies and standards  
•	Describing the principles of security and explaining how they will be implemented in the Penny Lane Surgery. 
•	Introducing a consistent approach to security and ensuring that all members of staff fully understand their own responsibilities 
•	Creating and maintaining within the Penny Lane Surgery a level of awareness of the need for Information Security as an integral part of the day to day business. 
•	Protecting information assets under the control of the Penny Lane Surgery 
•	Assess the training needs of staff against the Information Governance requirements, systems in place and present organisational structure. 

PRINCIPLES:
The Practice recognises the need for an appropriate balance between openness and confidentiality in the management and use of information. The Practice fully supports the principles of corporate governance and recognises its public accountability, but equally places importance on the confidentiality of, and the security arrangements to safeguard, both personal information about patients and staff and commercially sensitive information. The Practice also recognises the need to share patient information with other health organisations and other agencies in a controlled manner consistent with the interests of the patient and, in some circumstances, the public interest.

The Practice believes that accurate, timely and relevant information is essential to deliver the highest quality health care. As such it is the responsibility of all clinicians and managers to ensure and promote the quality of information and to actively use information in decision making processes.

There are 4 key interlinked strands to the information governance policy:
•	Legal Compliance 
•	Openness
•	Quality Assurance 
•	Information security 

Legal Compliance 
•	The Practice regards all identifiable personal information relating to patients as confidential.
•	The Practice regards all identifiable personal information relating to staff as confidential except where national policy on accountability and openness requires otherwise.
•	The Practice will establish and maintain policies to ensure compliance with the Data Protection Act and the common law confidentiality.
•	The Practice will establish and maintain policies for the controlled and appropriate sharing of patient information with other agencies, taking account of relevant legislation (e.g. Health and Social Care Act, Crime and Disorder Act, Protection of Children Act).

Openness
•	Non-confidential information on the Practice and its services should be available to the public through a variety of media, in line with the Practice’s code of openness.
•	The Practice will establish and maintain policies to ensure compliance with the Freedom of Information Act.
•	Patients should have ready access to information relating to their own health care, their options for treatment and their rights as patients, in accordance with The General Data Protection Regulation (GDPR) 2018.
•	Patients are able to access their medical records without a fee under GDPR. Patients do not need to disclose the reason for accessing their medical records.
•	The Practice will have clear procedures and arrangements for handling queries from patients and the public.
•	The practice has a policy in place for dealing with information transmitted or stored on computer, fax, email and telephone. The said polices should be observed at all times. 

Information Quality Assurance
•	The Practice will establish and maintain policies and procedures for information quality assurance and the effective management of records.
•	Wherever possible, information quality should be assured at the point of collection.
•	Data standards will be set through clear and consistent definition of data items, in accordance with national standards.
•	The Practice will promote information quality and effective records management through policies, procedures/user manuals and training

Information Security
•	The Practice will establish and maintain policies for the effective and secure management of its information assets and resources.
•	The Practice will promote effective confidentiality and security practice to its staff through policies, procedures and training.
•	The Practice will establish and maintain incident reporting procedures and will monitor and investigate all reported instances of actual or potential breaches of confidentiality and security.
•	Make the external contractor and third party aware of confidentiality policy and Data protection policy of practice relating to data they know during course of work. 
•	Request for access to medical records or letters or patient information by Hospital and other clinics shall be forwarded to practice manager and information will only be sent by secured communication (i.e. via NHS.net account).

DUTIES AND RESPONSIBILITIES

Clinical Staff:
All clinical staff in the practice have a primary duty and responsibility to ensure only necessary and required information is accessed and is dealt efficiently and securely with during course of patient care and support. Also they should provide active support to practice manager during review of the information governance policy. 

Practice Manager:
The Practice Manager is responsible for the effective implementation and smooth running of all policies and procedures. The Practice Manager is also responsible for ensuring adherence to these policies and procedures.

All other staff:
All staff members are responsible for co-operating with the development and implementation of practice information governance policies as a part of their normal duties and responsibilities. 

External Contractors and third party:
All visitors, external contractors and any other third parties are expected to comply with information governance policy of the practice.

TRAINING AND AWARENESS:
Information Governance ‘Awareness’ is the degree or extent to which every member of staff understands the importance of Information Governance and what it means:
•	That information is an important and valuable asset of the organisation.
•	The need for effective implementation of information governance in their own organisation and workplace
•	Individual information governance responsibilities in holding, obtaining, recording, using and sharing information and how to act accordingly

MONITORING AND REVIEW:
The implementation of the Information Governance Policy and Action Plans will ensure that practice effectively manages the holdings, obtaining, recording, using and sharing of information. The policy will be reviewed annually. 

INFORMATION GOVERNANCE PROGRESS REPORT

Outstanding Actions:
Mandatory Training to be completed by all clinical and admin staff
Policies and Procedures to be reviewed annually

Mandatory training:
-	All staff reminded of overdue mandatory training each month.
-	Overdue training regular discussed in Practice and Partners meetings

Policies and Procedures:
-	Access to Health Records Policy due for review Sep 2019
-	Appropriate Use of Password Policy due for review Sep 2019
-	Destruction and Disposal of Paper Records Policy due for review Sep 2019
-	Disaster Recovery Policy due for review June 19
-	Incident Reporting and Management Policy reviewed in Aug 19
-	Information Governance Policy due for review Aug 19
-	Restriction of Unauthorised Entry Policy due for review Aug 19
-	Sharing Patient Information Policy reviewed Aug 19
-	Transfer of Personal and Sensitive Information Policy due for review Aug 19
-	Visitors Code of Conduct Policy due for review Jan 19
-	Whistleblowing Policy due for review Aug 19

Staff Compliance Checks:
-	Ad-hoc checks by Practice Manager and during Practice Meetings.
-	Staff compliance spot checks due Feb 2020.

Signed by: ______________________________

Date: __________________________________

Ref. | Question | Action Required | Comment | Owner
1.4.2 | When was the record or register of information flows approved by the Management team or equivalent? | Register of information flows to be reviwed in Partners meeting. | |
1.4.3 | Provide a list of all systems/information assets holding or sharing personal information. | Asset register to be updated. | |
7.1.2 | Do you have well defined processes in place to ensure the continuity of services in the event of a data security incident, failure or compromise? | Business continuity plan to be reviewed | Robust business continuity plan in place with at least annual testing of effectiveness. |
9.1.1 | The Head of IT, or equivalent role confirms all networking components have had their default passwords changed. | Assurance to be sought from IM&T (Informatics Merseyside) | |
10.2.1 | Organisations ensure that any supplier of IT systems that could impact on the delivery of care, or process personal identifiable data, has the appropriate certification | Assurance to be sought from IM&T (Informatics Merseyside) | |
Information Governance Toolkit Compliance Action Plan 2019-20