Information Governance Toolkit. Getting Started for NHS Business Partners/Independent Treatment Centres/Arms Length Bodies

Transcription

1 Information Governance Toolkit Getting Started for NHS Business Partners/Independent Treatment Centres/Arms Length Bodies Page 1 of 11

2 Getting Started for NHS Business Partners/Independent Treatment Centres/Arms Length Bodies Contents: Information Governance and IG Toolkit Carrying out an IG Toolkit assessment 1. Registering the organisation 2. Completing the assessment 3. Submitting the assessment Next steps: 1. Creating an implementation plan for improvements 2. Viewing the Assessment and Requirements 3. Creating a new assessment Page 2 of 11

3 Information Governance and the IG Toolkit What is Information Governance? Information Governance is to do with the way that information about patients and employees is handled. It is particularly concerned with personal and sensitive information, but it also incorporates information about the organisation. The aim of implementing Information Governance is to: Promote the effective and appropriate use and sharing of information. Enable organisations to understand their own performance and manage improvement in a systematic and effective way to meet the Information Governance Assurance requirements set out by David Nicholson (Chief Executive of the NHS). Encourage joint working between primary, secondary and tertiary care, preventing duplication of effort and enabling more efficient use of resources. What are the Information Governance standards? For this version of the Toolkit, NHS Business Partners (etc) are asked to measure their compliance against 25 standards covering the following initiatives: Information Governance Management Confidentiality and Data Protection Assurance Information Security Assurance Clinical Information Assurance Why do NHS Business Partners need to complete the IG assessment? The NHS Operating Framework 2009/2010 and supplementary guidance provided in Informatics Planning 2009/10 require that all bodies that provide or support the provision of NHS services work within the NHS Information Governance Assurance Framework and demonstrate compliance with all key information governance requirements. These key requirements are contained within the Information Governance Toolkit, an online assessment tool, which enables organisations to evidence compliance. Page 3 of 11

4 What is the relevance of the IG assessment to the IG Statement of Compliance process? Those organisations wishing to use NHS Connecting for Health systems and services, including the N3 network, are required to complete the IG Statement of Compliance (IGSoC) as part of the terms and conditions of use. The IGSoC process requires that organisations undertake an annual IG assessment using the IG toolkit. IG assessments whether done specifically for the IGSoC or as part of the wider IG assurance process, need to be submitted annually by the 31st March each year to demonstrate standards are being improved or maintained, and will if necessary, need to be supported by action/implementation plans. The key requirements defined within the NHS Operating Framework are also the key requirements necessary for the IG Statement of Compliance. Page 4 of 11

5 Carrying out an IG Assessment The following three steps need to be performed to evidence use of the IG Toolkit: 4. Registration of the organisation 5. Completion of the assessment 6. Submission of the assessment Step 1: Registration An organisation must be registered to complete the on-line IG assessment PLEASE NOTE: registration only needs to be carried out once. Therefore if you have carried out an IG assessment for the same organisation in previous years, you will not need to be registered again. How is registration carried out? The Digital Information Policy team will register the organisation on your behalf. The team will need to know your Organisation or ODS code (previously known as NACS code). If you wish to carry out an assessment for information governance assurance purposes, simply send an , to - include your ODS code and ask to be registered on the IG Toolkit. The Digital Information Policy team will contact you and if appropriate register you on the IG Toolkit. NB: If you do not know or do not have an ODS code, please state this in your . If you are carrying out an assessment for the IG Statement of Compliance (required for use of NHS Connecting for Health systems and services, e.g. the N3 network), then you need to get NHS sponsorship and complete the IGSoC process, see: The IGSoC process will result in you being contacted by the Digital Information Policy team with news of your access to the IG Toolkit. What happens next? A login name and password will be sent by to the contact agreed with the Digital Information Policy team. Page 5 of 11

6 Once the login and default password has been received, the user should log into the Toolkit login will be successful if your name and organisation appears in the horizontal toolbar at the top right of the screen see Figure 1. Figure 1 Select the My Password facility on the menu to change the password. The screen in Figure 2 will be displayed. Complete the required fields in compliance with the Rules for entering passwords detailed on screen, then click Change Password. A message will be displayed informing the user that the password has been changed. Log out of the Toolkit and log back in using the new password. Figure 2 Page 6 of 11

7 Step 2: Completing the Assessment How is information added to the assessment? (a) Log into the IG Toolkit (using the new password) and select the Requirements button from the menu: This brings up the list of Information Governance requirements for the NHS Business Partners. (b) Click on a requirement to open it: This reveals a screen similar to Figure 3 below, and contains the requirement question, the attainment levels and three hyperlinks titled Screen version Printable version and Guidance Document. Click the Screen Version or Printable Version link for advice on how to assess levels of compliance in terms of the evidence available. Click the Guidance Document link for information on how to achieve each attainment level and links to legislation, government and national guidance, and examples of standards of good practice from other organisations. Figure 3 (c) For each requirement, enter a Current Rating, enter a Target rating for improvement (where necessary) and set a date by which the target level will be achieved. Please also enter a comment to support your score, e.g. where evidence is held; justification for scoring a requirement as not relevant. As you update each requirement, click the Save Rating button. Page 7 of 11

8 Step 3: Submitting the assessment What happens when all the requirements have been answered and saved? Once you are satisfied that the scores recorded accurately reflect the organisation s level of compliance with the IG requirements, you should click the Submit button that will appear at the top of the assessment requirements list- see Figure 4 below. Figure 4 What if the organisation wants to "unsubmit" the assessment? An IG Toolkit assessment submission represents evidence of an organisation s attainment against the IG standards at a particular point in time. This evidence must be retained for audit purposes and should not be overwritten by un-submitting and adjusting scores once the deadline for submission has passed. If a genuine error has been made the user should contact the Helpdesk at exeter.helpdesk@nhs.net or telephone The request will be considered by the Digital Information Policy team, but generally an assessment would only be unsubmitted after the deadline if there are extenuating circumstances. PLEASE MAKE SURE YOU ARE SATISFIED THAT THE SCORES ACCURATELY REFLECT THE ASSESSMENT STATUS OF YOUR ORGANISATION BEFORE CLICKING THE SUBMIT BUTTON Otherwise, any improvements in scores should be entered in the next version of the IG Toolkit. Page 8 of 11

9 What if the organisation wants to delete the assessment? In the unlikely event that an assessment needs to be deleted it can be done by clicking the delete button on the Assessments page and ticking the confirm deletion box. This can only be done if the assessment has not already been submitted. Please note: if the assessment is deleted all requirements answered and scores entered will be lost and a new assessment will have to be created. PLEASE TAKE CARE NOT TO DELETE BY ACCIDENT How is approval of the assessment carried out? Each organisation s assessment is approved centrally by the Digital Information Policy team at NHS Connecting for Health. Next steps 1. Creating an Implementation Plan Log into the Toolkit as usual and select Assessments from the menu. The Assessment screen with a table similar to that in Figure 5 will be displayed. Click on the blue text that reads Implementation Plan. Figure 5 This automatically generates an implementation plan, similar to Figure 6, for each requirement, based on the current ratings and target ratings you entered whilst scoring the requirements. Page 9 of 11

10 Figure 6 2. Viewing the Assessment and Requirements Can the organisation view the assessment and requirements once they have been submitted? The assessment and requirements can still be viewed from the assessment screen whilst a user is logged into the Toolkit. Can anyone else see the assessment? Once the assessments have been approved, anyone with Internet access can view any organisation s completed assessment. Only the scores can be seen, not the comments entered into the text boxes. To view reports: select Reports from the menu and either put in a query or press the search button. 3. Creating subsequent annual assessments How do I create a new assessment for next year? New assessment sets are generally released at the end of June in each year. Information about when a new assessment can be created is posted on the What s New page of the IG Toolkit at the appropriate time. At this time you should log into the toolkit select the Assessments button on the menu. This will display a screen similar to Figure 7. Page 10 of 11

11 Figure 7 Enter some meaningful text in the text box, e.g. IG Assessment for Somewhere Company 20xx / 20xx. Click the Create new assessment button and the screen will change to a status screen similar to Figure 8 below. Your account will enable you to create, complete and save the assessment on-line. Figure 8 Help For assistance with the IG toolkit requirements or queries about IG Policy issues, please contact the Helpdesk on or exeter.helpdesk@nhs.net Page 11 of 11