Trust Board Meeting: Wednesday 12 November 2014 TB

Transcription

1 Trust Board Meeting: Wednesday 12 November 2014 Title Update on Information Governance: Mid-Year Selfassessment against Information Governance Toolkit Status History For discussion Bi-annual Update Board Lead(s) Andrew Stevens, Director of Planning and Information Key purpose Strategy Assurance Policy Performance Update Information Governance Mid-Year Review Page 1 of 13

2 Executive Summary 1. A self-assessment of the Information Governance toolkit was undertaken in October 2014 and it is anticipated that the Trust will score level 3 in 43 out of 45 toolkit standards. 2. A cyber security audit was undertaken in August The Trust is developing an action plan in response to the audit findings freedom of information requests were made to the Trust in the first half of this financial year. The percentage of requests responded to within 20 working days was on average 69%. 4. A new standard operating procedure to manage freedom of information requests has been developed. The Trust publication scheme has been developed to now be fully compliant with the Information Commissioner s Office standards. 5. Recommendation The Trust Board is asked to note this paper. Update Information Governance Mid-Year Review Page 2 of 13

3 Information Governance (IG) Mid-year Update 1. Introduction 1.1. This paper sets out the work which that been undertaken within the Information Governance Department over the first six months of financial year 2014/ Information Governance Toolkit 2.1. The Information Governance Toolkit is a set of information governance requirements drawn from central guidance and Department of Health Policy. Organizations that process patient data are required to carry out selfassessments of their compliance which are grouped under the following headings: Management structures and responsibilities (e.g. assigning responsibility for carrying out the IG assessment, providing staff training, etc) Confidentiality and data protection Information security The purpose of the assessment is to enable organisations to measure their compliance to see whether information is handled correctly and protected from unauthorised access, loss, damage and destruction The toolkit requires three assessments to be undertaken during the course of a financial year. An initial baseline score which is submitted at the end of July, a mid-year update score at the end of October and a final published score at the end of March. More detailed information concerning baseline scoring against set parameters can be found in appendix one. The Trust toolkit self assessment scores for the past 5 years are presented below. 120 Toolkit Self Assessment Scores % Baseline Target Published / /1012/ / / The table demonstrates that assessed compliance has been increasing year on year with target scores mirroring closely actual year end scores. It is anticipated that by year end 2014/15, 43 out of 45 toolkit standards will be scored at level In order to ensure accurate self-assessment the toolkit is externally audited annually by KPMG. The next audit is due to commence on the 20 October 2014 prior to the submission of the Trust s mid-year toolkit assessment. Update Information Governance Mid-Year Review Page 3 of 13

4 3. Information Governance Data Quality Group 3.1. It is the role of the Information Governance Data Quality group to oversee the work of the information governance department. The overall board lead is the Senior Information Risk Officer with Information Governance section of the meeting being Chaired by the Trust Caldicott Guardian. Meetings are held six weekly and so far in 2014/15 the group have met five times. The group is comprised of representatives from all Divisions and its remit is to ensure the Trust complies with statutory responsibilities, fulfils its legal obligations in terms of confidentiality and data protection, and manages high quality information efficiently within a robust governance structure A work programme has been developed to ensure that important objectives are met during the financial year. Progress against this workplan to date is presented in appendix two. Work undertaken this year includes the revision and development of policies, management and assessment of risks such as the use of fax machines, audit of corporate records, review of Trust intranet and internet IG pages and the development of staff and patient feedback surveys Examples of work still to be undertaken include completion of a database for documenting information assets and flows, further development of the Trust FOI publication scheme, review of the use of fax machines and the transfer of personal data domestically and overseas, and the development of a new interactive learning and development tool. 4. Information Governance Risks 4.1. Currently the risk register comprises of three global information governance risks The Trust not having the resources, systems and/or processes to achieve and maintain level 2 on all requirements of the IG toolkit Data unavailability or loss via poor records management, inappropriate transmission, loss of portable media, laptop/desktop/device theft, unsecured waste disposal, incompliant transcription services, and/or incorrect or excessive disclosure OUH served with an improvement or decision notice, or financial penalty by the ICO due to breaches in confidentiality/non-compliance with the Data Protection Act A further two risk assessments have been undertaken concerning the use of fax machines and portable devices. The group decided to review all risks, scoring their constituent parts, to gain a better understanding of where the highest risks are located Spot checks of information governance arrangements in departments began in October The completion of these should assist Divisions to identify their information governance risks and provide valuable intelligence to the Trust SIRO. The results of spot checks will be reported to the Information Governance Data Quality Group. Update Information Governance Mid-Year Review Page 4 of 13

5 5. Information Governance Incidents 5.1. Serious Incidents Requiring Investigation No information governance serious incidents requiring investigation have been reported in the first half of 2014/ Incidents All incidents reported under the categories of consent, confidentiality, communications and information governance, documentation and records (including EPR) are reported to the department leads as well as the information governance team. The responsibility for investigating these incidents remains with the departmental manager. However, where incidents are believed to be serious or require additional input the information governance team will assist with the investigation The tables presented below shows the ratio of incidents reported and their harm rate for these two categories. IG Incidents by Category First 6 Months 2014/15 Documentation and Records (including EPR), 71, 41% Consent, Confidentiality, Communications & Information Governance, 103, 59% IG Incidents Harm Rate First 6 Months 2014/ No harm Minor Moderate The majority of incidents that were reported resulted in no harm. Those with minor harm mainly related to loss of portable written information. Update Information Governance Mid-Year Review Page 5 of 13

6 Work has been undertaken to promote the safe handling of written information through the purchasing of confidential waste bins and posters at all exits to Trust sites as well as ticker tape messages to staff to remind them of their responsibility to safely dispose of information The moderate incidents reported relate to the security of information and are still under investigation. 6. Cyber Security 6.1. In August 2014 KPMG undertook a Cyber Security Audit of the Trust. The purpose of the audit was to assess the maturity of cyber controls against government standards in combination with internationally accepted maturity models. The domains examined were leadership and governance, human elements, information risk management, business continuity, operations and technology and legal and compliance The audit report identified some key recommendations for implementation which include: Assigning a specific cyber risk owner at board level Implementation of a security awareness programme Development of assurance and board sign off regarding EPR disaster recovery plan testing Development of user access management assurance for departmental systems 6.3. A meeting has been held with KPMG to discuss the audit findings with a further meeting being scheduled in the near future to develop an action plan. 7. Cases Involving the Information Commissioner s Office (ICO) 7.1. Two complaints were made to the ICO in the first half of 2014/15. No formal action has been taken by the ICO other than referring the complaints back to the Trust to be addressed. The complaints related to the security of medical records received in July 2014 and disclosure of information to clinicians received in August Freedom of Information 8.1. A full time FOI Officer was appointed and began work at the Trust in early May Since their appointment the FOI Officer has reviewed the FOI process, a new standard operating procedure has been written and the Trust publication scheme has been developed to now be compliant with ICO requirements. Update Information Governance Mid-Year Review Page 6 of 13

7 8.2. Detail concerning FOI performance is presented below. Performance 2014/15 April May June July August Sept Total # FOI Requests Received Clarified and Remain Outstanding % Sent within 20 days 74% 59% 68% 80% 67% 76% 69% Reasons for breaching 20 day response target Complex Request Internal Delay Final Revision Administrative Delay The numbers of FOI requests received by the Trust is broadly the same as this time period during the last financial year. In the first half of 2014/ requests were received in the first half of the year up to end of September as compared to 299 requests received in 2013/14 up to mid October The average compliance rate for the completion of FOI requests within 20 working days in the first half of 2014/15 is 69%. The process for acknowledgement and requesting information has been reviewed and the timescale for initial work by the FOI Officer has been shortened. It is hoped that this will increase the average compliance rate allowing more time for the request to be checked and signed off. One third of requests that did not meet the timescale were due to the complexity and nature of the request. Additionally, these requests often involved a number of services making the drawing together of data sources more difficult. Andre Stevens, Director of Planning and Information Report prepared by Nuala Buchan-Brodie, Information Governance and Records Manager Update Information Governance Mid-Year Review Page 7 of 13

8 Appendix 1 IG Toolkit Status Up-date following Submission of Baseline Score Legend: Requirement has not been answered Requirement has not been reviewed Requirement is not scored at the required level Requirement is scored at or above the required level Requirement 101 There is an adequate Information Governance Management Framework to support the current and evolving Information Governance agenda 105 There are approved and comprehensive Information Governance Policies with associated strategies and/or improvement plans 110 Formal contractual arrangements that include compliance with information governance requirements, are in place with all contractors and support organisations 111 Employment contracts which include compliance with information governance standards are in place for all individuals carrying out work on behalf of the organisation 112 Information Governance awareness and mandatory training procedures are in place and all staff are appropriately trained 200 The Information Governance agenda is supported by adequate confidentiality and data protection skills, knowledge and experience which meet the organisation s assessed needs 201 Staff are provided with clear guidance on keeping personal information secure, on respecting the confidentiality of service users, and on the duty to share information for care purposes 202 Personal information is shared for care but is only used in ways that do not directly contribute to the delivery of care services where there is a lawful basis to do so and objections to the disclosure of confidential personal information are appropriately respected 203 Individuals are informed about the proposed uses of their personal information Baseline Latest 2 3 Update Information Governance Mid-Year Review Page 8 of 13

9 Requirement 205 There are appropriate procedures for recognising and responding to individuals requests for access to their personal data 206 There are appropriate confidentiality audit procedures to monitor access to confidential personal information 207 Where required, protocols governing the routine sharing of personal information have been agreed with other organisations 209 All person identifiable data processed outside of the UK complies with the Data Protection Act 1998 and Department of Health guidelines 210 All new processes, services, information systems, and other relevant information assets are developed and implemented in a secure and structured manner, and comply with IG security accreditation, information quality and confidentiality and data protection requirements 300 The Information Governance agenda is supported by adequate information security skills, knowledge and experience which meet the organisation s assessed needs 301 A formal information security risk assessment and management programme for key Information Assets has been documented, implemented and reviewed 302 There are documented information security incident / event reporting and management procedures that are accessible to all staff 303 There are established business processes and procedures that satisfy the organisation s obligations as a Registration Authority 304 Monitoring and enforcement processes are in place to ensure NHS national application Smartcard users comply with the terms and conditions of use 305 Operating and application information systems (under the organisation s control) support appropriate access control functionality and documented and managed access rights are in place for all users of these systems 307 An effectively supported Senior Information Risk Owner takes ownership of the organisation s information risk policy and information risk management strategy Baseline Latest 1 2 Update Information Governance Mid-Year Review Page 9 of 13

10 Requirement 308 All transfers of hardcopy and digital person identifiable and sensitive information have been identified, mapped and risk assessed; technical and organisational measures adequately secure these transfers 309 Business continuity plans are up to date and tested for all critical information assets (data processing facilities, communications services and data) and service - specific measures are in place 310 Procedures are in place to prevent information processing being interrupted or disrupted through equipment failure, environmental hazard or human error 311 Information Assets with computer components are capable of the rapid detection, isolation and removal of malicious code and unauthorised mobile code 313 Policy and procedures are in place to ensure that Information Communication Technology (ICT) networks operate securely 314 Policy and procedures ensure that mobile computing and teleworking are secure 323 All information assets that hold, or are, personal data are protected by appropriate organisational and technical measures 324 The confidentiality of service user information is protected through use of pseudonymisation and anonymisation techniques where appropriate 400 The Information Governance agenda is supported by adequate information quality and records management skills, knowledge and experience 401 There is consistent and comprehensive use of the NHS Number in line with National Patient Safety Agency requirements 402 Procedures are in place to ensure the accuracy of service user information on all systems and /or records that support the provision of care 404 A multi-professional audit of clinical records across all specialties has been undertaken 406 Procedures are in place for monitoring the availability of paper health/care records and tracing missing records 501 National data definitions, standards, values and validation programmes are incorporated within key Baseline Latest Update Information Governance Mid-Year Review Page 10 of 13

11 Requirement systems and local documentation is updated as standards develop 502 External data quality reports are used for monitoring and improving data quality 504 Documented procedures are in place for using both local and national benchmarking to identify data quality issues and analyse trends in information over time, ensuring that large changes are investigated and explained 505 An audit of clinical coding, based on national standards, has been undertaken by a Clinical Classifications Service (CCS) approved clinical coding auditor within the last 12 months 506 A documented procedure and a regular audit cycle for accuracy checks on service user data is in place 507 The Completeness and Validity check for data has been completed and passed 508 Clinical/care staff are involved in validating information derived from the recording of clinical/care activity 510 Training programmes for clinical coding staff entering coded clinical data are comprehensive and conform to national clinical coding standards 601 Documented and implemented procedures are in place for the effective management of corporate records 603 Documented and publicly available procedures are in place to ensure compliance with the Freedom of Information Act As part of the information lifecycle management strategy, an audit of corporate records has been undertaken Baseline Latest Total (%) 80% 81% Update Information Governance Mid-Year Review Page 11 of 13

12 Appendix 2 Information Governance Workplan 2014/15 October 2014 Information Governance Work Programme 2014/15 (October update) Task Toolkit Date Lead Status Ref Approve work programme April NB-B Complete Review IG Risks and update Health Assure April, July, Oct, NB-B In progress Jan. Review of IGTK V11 results April MH Complete Review and update contents of the IG Intranet site April onwards NB-B Complete Review IG suite of policies and procedures, approve at IGDQG 101 April onwards NB-B In progress Create comprehensive list of contractors and third parties that have 110, 302 April onwards and NB-B In progress access to information and/or information assets. Ensure contracts reviewed annually. by Review IG Training Needs Assessment and Develop Training Plan 111, 112 April onwards and NB-B Complete by Complete Trust-wide information mapping exercise 308 April onwards and NB-B In progress Assessment of transfers of personally identifiable information to countries outside the UK. Transfers should be fully documented, reviewed and tested to ensure compliance with the DPA and the IG tool kit. Update Information Governance Mid-Year Review Page 12 of 13 by Plan audit of corporate records (in at least 4 corporate areas) 604 December NB-B Complete Update Trust privacy statement CB Complete Review and update Publication Scheme and FOI intranet pages 603 By NB-B In progress Review of use of fax machines within the Trust (from IGDQ minute NB-B In progress 13-14/009) IGTK V12 baseline submission score All July NB-B Complete IGTK V12 update submission score All October NB-B Planned SIRO report and IGTK v12 final submission report All April 2015 RH Planned Carry out spot checks to confirm staff understanding of IG responsibilities 111, 112 By NB-B In progress

13 Task Carry out service user satisfaction survey to record whether SU s trust OUH to hold information securely (previously deemed to be done via annual survey but consider more targeted questions) Toolkit Date Lead Status Ref 201 By NB-B In progress Approval of IGTK V12 final submission score All NB-B Planned IGTK v12 Updates to IGDQ All After each NB-B In progress submission EPR Implementation Updates to IGDQ 6 weekly PA In progress RA Updates to IGDQ (to include annual audit to cover smartcards, RA hardware (computers, scanners and smartcard readers) and consumables. 303, weekly HJ IG Incidents/Confidentiality Breaches Updates to IGDQ 6 weekly NB-B Ongoing Review of IG Key Documents Programme 2013/14 6 weekly NB-B Ongoing ICO News Releases Update to IGDQ 6 weekly NB-B Ongoing FOI performance update to IGDQ Annual FOI performance update to the Health Informatics Committee IG bi-annual report to the Health Informatics Committee Quarterly (June, NB-B Ongoing Sept, Dec, Mar) March NB-B Planned Bi-annually (Sept, Mar) Annual Subject Access Request Report 205 End of March 2015 for April 2015 Review and update evidence for all level 3 toolkit requirements All not listed below NB-B BW Ongoing Planned 31 March 2015 NB-B In progress Update Information Governance Mid-Year Review Page 13 of 13