Information Governance in the NHS & Healthcare

Managing large volumes of data makes the NHS a target for hackers. Data breaches - and accidental non-compliance with IG regulations - can have significant consequences.

That was illustrated by a ransomware attack on a pathology business working for the NHS by a group of Russian cyber criminals, which meant several London hospitals could not carry out blood transfusions and had to cancel operations and tests.

Figures compiled by NHS England showed that over 10,000 acute outpatient procedures had to be postponed along with 1,700 for elective procedures. 

Whilst that was the work of hackers, there are other threats, such as:

• Phishing - when criminals use scam emails, text messages or phone calls to trick victims into revealing sensitive information or deploying malware on the victim’s computer.
• Social engineering – a broad range of malicious activities accomplished through human interactions to trick users into making security mistakes or giving away sensitive information.

THIS has accreditation to provide training on all aspects of threat containment and secure email compliance through NHS England’s secure email standard DCB1596 certification that ensures sensitive and confidential information is kept secure.

Jason Cresswell, THIS’ IT and cyber security Manager team, explains: “Any e-mail that comes from outside the organisation typically contains a warning banner that appears at the top of the e-mail saying this is external, be cautious with malicious attachments and malicious links that you click on. We try to drill it into all staff that if you're not certain, alert our team and we can check it for you.

“To be registered as a secure e-mail provider between health and social care organisations you must have the DCB1596 certification from NHS Digital. It ensures that malicious attachments get blocked, there's anti malware and spam controls in place, and that the general well-being and security of the of the e-mail environment is up to a certain standard.

“We put customers through that accreditation. The threat landscape is evolving all the time and it’s important there is user awareness of staying abreast of changes and being aware of how you can keep your organisation safe.”

Microsoft Teams is the preferred communication platform for CHFT as it is UK-hosted, General Data Protection Regulation (GDPR) compliant, ISO/27001 compliant and provides integration with other trust software such as Outlook and ultimately Office 365. 

THIS’ cyber security team has put in place some mandatory procedures to ensure Personal Confidential Data (PCD) is kept secure. These include:

• Minimising the use of PCD.
• Implementing security measures for accessing Teams on personal devices.
• Not extracting or storing PCD on non-Trust, personal or any other storage device.
• Working from home guidelines.
• Ensuring recorded Teams meetings comply with GDPR and Information Governance policy.

Our six-strong team of IG consultants, who boast 60 years’ worth of experience between them, provide high quality, specialist support and assistance to ensure organisational compliance in handling personal and corporate data legally, securely, efficiently and effectively.

The team supports NHS organisations, NHS arms-length organisations, charitable organisations and private entities that have to access NHS data.

We provide information governance training, consultancy, and learning products for the complete IG arena, including:

• Freedom of information
• Data protection and confidentiality
• Environmental information regulations 
• Information security
• Senior information risk owners
• Caldicott Guardians
• Privacy impact assessments 
• Information asset owners and administrators
• Data flow mapping
• Records management
• Data quality
• IT security
• Anti-virus assurance
• Internet filtering and reporting

Fundamentally, IG is an enabling service to ensure data is handled safely and stored securely. Our end solution takes away any difficulties clients might encounter.

Helen Holt, THIS’ Data Protection Officer, explains: “For example, many NHS organisations have an IG officer and/or data protection officer within their organisation, who are responsible for the data they handle. 

“The beauty of working with THIS is we can work with an organisation without really being visible, making them safe, secure and compliant. We make them compliant before they really have to worry about it, taking up the slack for them and providing peace of mind.

THIS expertise covers consultancy, training and learning products for all aspects of IG, such as Freedom of Information, privacy impact assessments, data flow mapping, records management, data quality, and IT security including anti-virus assurance.

Attaining the level of knowledge and best practice required by organisations is achieved via THIS’ specialist training services. 

The essential training provides guidance and education for senior information risk owners, information asset owners and administrators, data protection officers and Caldicott Guardians – a senior staff member responsible for protecting the confidentiality of people’s health and care information and making sure it is used properly. All NHS organisations and local authorities providing social services must have a Caldicott Guardian.

THIS holds ISO 27001 Information Security Management, 9001 Cyber Management, Cyber Essentials, AMAM level 6 and 20000-1 Information Technology Service Management. We are compliant with NHS England Data Security and Protection Toolkit (DSPT), a set of requirements that organisations have to comply with to be able to process any NHS data. 

Data protection is compulsory whether you are an NHS or private organisation. Our information governance services are founded on the Data Security and Protection Toolkit (DSPT).

We provide information governance training, consultancy, and learning products for the complete IG arena. 

We hold ISEB qualifications in data protection, information security, risk management and freedom of information, and can ensure compliance with UK General Data Protection Regulations (GDPR) and the Data Protection Act 2018 through our Data Protection Officer service.

And all services are externally certified to Information Security Management System standards ISO/IEC 27001.

As the uses and applications of patient data grow and adapt to an ever-changing landscape, how this information is stored and who has access to it is deserving of the very best practice.  

Our team of specialists are also available to discuss your requirements and provide demonstrations. Get in touch here to see how we can help.