Government Releases Guidance on Data Security for Health and Care Organisations

Department for health releases document including an assurance framework for 2018 the day before Halloween.

The document outlines a plan that health and social care organisations should adopt in line to be compliant with protecting patient data.

From April 2018 the new Data Security and Protection Toolkit (DSP) Toolkit, will replace the Information Governance Toolkit (IG Toolkit) and consists of 10 data security standard and meeting their statutory obligations on data protection and security. The DSP Toolkit will launch as GDPR comes into effect across the EU, highlighting a wider government strategy to prioritise safe data handling, retention and where necessary, deletion.

These standards will apply to all health and care organisations and the guidance highlights the following stipulations that all health and care organisations must follow in the next calendar year:

1. Senior Level Responsibility: There must be a named senior executive to be responsible for data and cyber security in your organisation. Ideally this person will also be your Senior Information Risk Owner (SIRO), and where applicable a member of your organisation’s board.

2. Completing the Information Governance Toolkit v14.1: In 2017/18, organisations are still required to achieve at least level two on the current IG Toolkit before it is replaced with a new approach (the new Data Security and Protection Toolkit), from 2018/19 onwards, to measuring progress against the 10 data security standards.

3. Complete the General Data Protection Regulation Checklist: NHS Digital will publish a checklist to support organisations in implementing the requirements of the General Data Protection Regulation which they will be required to comply with from May 2018. Organisations must complete this checklist to ensure they will be able to meet their legal obligations from May 2018.

4. Training Staff: All staff must complete appropriate annual data security and protection training. This training replaces the previous Information Governance training while retaining key elements of it. It contains new sections on cyber security.

The guidance marks a positive step in trying to enable health organisations to prioritise staff training and be ever vigilant in auditing their data usage and behaviour.

You can read more on the Acumin whitepaper on insider threat within the NHS here.