INFORMATION GOVERNANCE STRATEGIC VISION, POLICY AND FRAMEWORK

INFORMATION GOVERNANCE STRATEGIC VISION, POLICY AND FRAMEWORK Policy approved by: Assurance Committee Date: 3 December 2014 Next Review Date: December 2016 Version: 1.0 Information Governance Strategic Vision, Policy and Framework 1 of 15

Review and Amendment Log / Control Sheet Responsible Officer: Clinical Lead: Chief Financial Officer Medical Director Author: Kath Allen Information Governance Specialist, David Green Information Governance Advisor Date Approved: 3 December 2014 Committee: Assurance Committee Version: 1.0 Review Date: December 2016 Version no. Version History Date Author Description Circulation 0.1 31 Aug 2014 IG Specialist, WSYBCSU Initial Draft 0.2 15 Sept 2014 IG Advisor Director of Informatics Amendments and rationalisation of IG Strategy and Policy documents 0.3 18 Nov 2014 IG Advisor Further amendments and corrections. Advice details added Director of Informatics, SIRO, Caldicott Guardian, Counter Fraud Lead Senior Management Team, all staff Assurance Committee Equality Impact Assessment In applying this policy, the organisation will have due regard for the need to eliminate unlawful discrimination, promote equality of opportunity, and provide for good relations between people of diverse groups, in particular on the grounds of the following characteristics protected by the Equality Act (2010); age, disability, gender, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, and sexual orientation, in addition to offending background, trade union membership, or any other personal characteristic. A single Equality Impact Assessment is used for all policies and procedures. This document has been assessed to ensure consideration has been given to the actual or potential impacts on staff, certain communities or population groups. Information Governance Strategic Vision, Policy and Framework 2 of 15

Contents Section Title Page 1 Introduction 4 2 Strategic Vision 4 3 Aims 4 4 Scope 5 5 Accountability and Responsibilities 5 5.1 Governing Body 6 5.2 Assurance Committee 6 5.3 Cross CCG Information Governance Committee 6 5.4 Accountable Officer 6 5.5 Senior Information Risk Officer 6 5.6 Caldicott Guardian 6 5.7 Information Asset Owners and Administrators 6 5.8 Heads of Service 7 5.9 Employees 7 5.10 Information Governance Advice 7 6 Definition of Terms 7 7 Key Principles and Procedures 7 7.1 Openness and Transparency 7 7.2 Legal Compliance 8 7.3 Information Security 9 7.4 Clinical Information Assurance, Quality Assurance and Records 9 Management 8 Training 10 9 Implementation and Dissemination 10 10 Monitoring Compliance and Effectiveness of the Policy and 10 Framework 11 Associated Documents 10 11.1 Core Information Governance Policies 10 11.2 Other Associated Policies 11 11.3 Associated Procedures and Guidance 11 Appendix A Legislation and Guidance 13 Appendix B Cross-Leeds information Governance Committee Terms of Reference 15 Information Governance Strategic Vision, Policy and Framework 3 of 15

INFORMATION GOVERNANCE STRATEGIC VISION, POLICY AND FRAMEWORK 1. INTRODUCTION NHS Leeds West Clinical Commissioning Group (CCG) recognises the importance of reliable information, both in terms of the clinical management of individual patients and the efficient management of services and resources. The CCG also recognises the duty of confidentiality owed to patients, families, staff and business partners with regard to all the ways in which it processes, stores, shares and disposes of information. The Information Governance Strategic Vision, Policy and Framework sets out the CCG s overall direction for information governance, provides a number of key policy statements and defines an approach and framework to the management of information governance. This document should be read in conjunction with a number of more detailed policies and procedures that are referenced in sections 11. 2. STRATEGIC VISION 3. AIMS The CCG vision is to instil an information governance culture in all staff through the provision of clear advice that helps staff understand and apply information governance standards and principles. The CCGs will continue to improve how it undertakes information governance by assessing its own performance against compliance frameworks such as the Information Governance Toolkit and develop and implement action plans for improvement. The aim of this policy is to ensure that all staff understand their obligations with regard to any information which they come into contact with in the course of their work and to provide assurance to the Governing Body that such information is dealt with legally, securely, efficiently and effectively. The CCG will establish, implement and maintain procedures linked to this policy to ensure compliance with the requirements of Data Protection Act 1998, records management guidance, information security guidance, other related legislation and guidance, contractual responsibilities and to support the assurance standards of the NHS Information Governance Toolkit. These standards are: Information Governance Management Confidentiality and Data Protection Assurance Information Security Assurance Clinical Information Assurance Information Governance Strategic Vision, Policy and Framework 4 of 15

This policy supports the CCG in its role as a Commissioner of Health Services and will assist in the safe sharing of information with its partner and agencies. 4. SCOPE This policy must be followed by all staff who work for or on behalf of the CCG including those on temporary or honorary contracts, secondments, volunteers, pool staff, Governing Body members, students and any staff working on an individual contractor basis or/and who are employees for an organisation contracted to provide services to the CCG. The policy is applicable to all areas of the organisation and adherence should be included in all contracts for outsourced or shared services. There are no exclusions. This policy and framework covers: All aspects of information within the organisation, including (but not limited to): Patient/Client/Service User information Personnel/Staff information Organisational and business sensitive information Structured and unstructured record systems - paper and electronic Photographic images, digital, text or video recordings including CCTV All information systems purchased, developed and managed by/or on behalf of, the organisation CCG information held on paper, floppy disc, CD, USB/Memory sticks, computers, laptops, tablets, mobile phones and cameras The processing of all types of information, including (but not limited to): Transmission of information verbal, fax, e-mail, post, text and telephone Sharing of information for clinical, operational or legal reasons The storage and retention of information The destruction of information The CCG recognises the changes introduced to information management as a result of the Health and Social Care Act 2012 and will work with national bodies and partners to ensure the continuing safe use of information to support services and clinical care. Failure to adhere to this policy may result in disciplinary action and where necessary referral to the appropriate regulatory bodies including the police and professional bodies. 5. ACCOUNTABILITY AND RESPONSIBILITIES This section details the key information governance roles within the organisation and also sets out the responsibilities for staff who work for (or on behalf of) the CCG. Information Governance Strategic Vision, Policy and Framework 5 of 15

5.1 Governing Body The Governing Body is accountable for ensuring that the necessary support and resources are available for the effective implementation of this policy. 5.2 Assurance Committee The Assurance Committee is responsible for the review and approval of this policy, related work plans and procedures and will receive regular updates on compliance and any related issues or risks. 5.3 Cross CCG Information Governance Committee A joint Information Governance Committee (the Cross Leeds Information Governance Committee) operates in Leeds and comprises of the 3 Leeds CCGs, in which information governance implementation is overseen, monitored and reviewed. See Terms of Reference at Appendix B. 5.4 Accountable Officer The Chief Officer is the Accountable Officer of the CCG and has overall accountability and responsibility for Information Governance and is required to provide assurance, through the Annual Governance Statement that all risks to the CCG, including those relating to confidentiality and data protection, are effectively managed and mitigated. 5.5 Senior Information Risk Owner The Senior Information Risk Owner (SIRO) has organisational responsibility for all aspects of risks associated with information governance, including those relating to confidentiality and data protection. The SIRO will ensure that an appropriate management framework is put in place. This role is undertaken by the Chief Finance Officer. 5.6 Caldicott Guardian The Caldicott Guardian plays a key role in ensuring that the CCG satisfies the highest practical standards for handling patient identifiable information. The Caldicott Guardian approves any use of patient identifiable information. This role is undertaken by the Medical Director. 5.7 Information Asset Owners and Administrators A number of CCG managers are assigned as Information Asset Owners (IAO) and are directly accountable to the SIRO. IAOs provide assurance that information risk is being managed effectively in respect of the information assets that they are responsible for and that any new aspects or changes introduced to their business processes and systems undergo a privacy impact assessment. An Information Asset Administrator (IAA) may be assigned by an IAO. An IAA will Information Governance Strategic Vision, Policy and Framework 6 of 15

have delegated responsibility for the operational use of an information asset. They will report any risks associated with an information asset (that falls under their responsibility) to the IAO and consult with the IAO where necessary about the operation of an information asset. 5.8 Heads of Service Heads of Service are responsible for ensuring that they and their staff are familiar with this policy and its associated guidance. They must ensure that any breaches of the policy are reported, investigated and acted upon. 5.9 Employees Information governance compliance is an obligation for all staff. Staff should note that there is a Non-Disclosure of Confidentiality Information clause in their contract and that they are expected to participate in induction training, annual refresher training and awareness raising sessions carried out to inform/update staff on information governance issues. Any breach of confidentiality, inappropriate use of health, business or staff records or abuse of computer system is a disciplinary offence, which could result in dismissal or termination of your employment contract, and must be reported to the SIRO and (in the case of health or social care records) the Caldicott Guardian. All employees are personally responsible for compliance with the law in relation to data protection and confidentiality and will need to be aware of their responsibilities in relation to any information governance related legislation that may affect their work duties e.g. Freedom of Information Act. Other responsibilities in relation to a specific policy will be detailed in that policy. 5.10 Information Governance Advice The CCG will provide, either directly or via a commissioned service, an Information Governance advisory service where managers and staff can obtain specialist IG advice. Staff will be informed how to access this provision. 6. DEFINITION OF TERMS The words used in this policy are used in their ordinary sense and technical terms have been avoided. 7. KEY PRINCIPLES AND PROCEDURES 7.1 Openness and Transparency The CCG recognises the need for openness and transparency in the way it conducts its business and in the management and use of information. The CCG also recognises that where information is subject to a duty of confidentiality and/or conditions of the Data Protection Act, other legislation or guidance (such as Caldicott guidelines), it must comply with those conditions in determining how Information Governance Strategic Vision, Policy and Framework 7 of 15

that information is handled. Information about the organisation will be available to the public in line with the Freedom of Information Act, Environmental Information Regulations and Protection of Freedoms Act unless an exemption applies. The CCG will establish and maintain a Publication Scheme in line with legislation and Guidance from the Information Commissioner s Office. There will be clear procedures and arrangements for handling queries from patients, staff, other agencies and the public concerning personal and organisational information. Integrity of information will be developed, monitored and maintained to ensure that it is appropriate for the purposes intended. Availability of information for operational purposes will be maintained within set parameters relating to its importance via appropriate procedures and computer system resilience. Legislation, national and local guidelines will be followed. The CCG will undertake annual assessments and audits (through the Information Governance Toolkit) of its policies, procedures and arrangements for openness. Patients will have ready access to information relating to their own health care under the Data Protection Act 1998 using the CCG s Access to Records Procedure. The CCG will have clear procedures and arrangements for liaison with the press and broadcasting media. 7.2 Legal Compliance The CCG regards all personal information as confidential. Compliance with legal and regulatory requirements will be achieved, monitored and maintained. The CCG regards all identifiable personal information relating to staff as confidential except where national policy on accountability and openness requires otherwise. The CCG will establish and maintain policies to ensure compliance with the Data Protection Act, Human Rights Act, Freedom of Information Act and the Common Law Duty of Confidentiality and associated guidance. See Appendix A. Information governance training will be mandatory for all staff. This will include awareness and understanding of Caldicott principles and confidentiality, information security and data protection. Information governance will be included in induction training for all new staff. The necessity and frequency of any further Information Governance Strategic Vision, Policy and Framework 8 of 15

training will be Personal Development Review (PDR) based. The CCG will undertake annual assessments and audits of its compliance with legal requirements as part of the annual assessment against the NHS Information Governance Toolkit Standards and in line with changes and developments in legislation and guidance. The CCG will work with partner NHS bodies and other agencies to establish an Information Sharing Protocol to inform the controlled and appropriate sharing of information with other agencies, taking account of relevant legislation (e.g. Data Protection Act, Crime and Disorder Act, Children Act). 7.3. Information Security The CCG will establish and maintain policies for the effective and secure management of its information assets and resources. The CCG will undertake annual assessments and audits of its information and Information Technology security arrangements as part of the annual assessment against the NHS Information Governance Toolkit Standards and in line with changes and developments in legislation and guidance. The CCG will promote effective confidentiality and information security practice to its staff through policies, procedures and training. The CCG will establish and maintain incident reporting procedures and will monitor and investigate all reported instances of actual or potential breaches of confidentiality and security. The CCG will appoint a SIRO and assign responsibility to Information Asset Owners to manage information risk. A SIRO report will be issued to the Assurance Committee as part of the Information Governance Report. The CCG will use pseudonymisation and anonymisation of personal data where appropriate to further restrict access to confidential information. The CCG will conform to developing guidance from the Health and Social Care Information Centre (HSCIC) and NHS England. 7.4 Clinical Information Assurance, Quality Assurance and Records Management The CCG will establish and maintain policies for information quality assurance and the effective management of records. Audits will be undertaken or commissioned of CCG s quality of data and records management arrangements. Managers will be expected to take ownership of, and seek to improve, the quality of data within their services. Wherever possible, information quality will be assured at the point of collection. Information Governance Strategic Vision, Policy and Framework 9 of 15

The CCG will promote data quality through policies, procedures/user manual and training. All new projects, processes and systems (including software and hardware) which are introduced must meet confidentiality and data protection requirements. To enable the organisation to address the privacy concerns and risks a technique referred to as a Privacy Impact Assessment (PIA) must be used. The CCG will establish a Records Management Lifecycle Policy covering all aspects of records management and consistent with the NHS records Management Code of Practice. 8. TRAINING Information governance will be a part of induction training and is mandatory for all staff. The CCG will identify the information governance training needs of key staff groups taking into account their role, responsibility and accountability levels and will review this regularly through the PDR processes. 9. IMPLEMENTATION AND DISSEMINATION Following ratification by the Assurance Committee, this policy will be disseminated to staff via the CCG s Extranet and communication through in-house staff briefings. This policy will be regularly reviewed in line with changes to relevant legislation or national guidance. 10. MONITORING COMPLIANCE AND EFFECTIVENESS OF THE POLICY An assessment of compliance with requirements, within the NHS Information Governance Toolkit (IGT), will be undertaken each year. This includes confidentiality and data Protection. Incidents are reported and all serious information governance issues must be reported by the SIRO at Governing Body level and in Annual Reports. Any suspicion of fraud or bribery should be reported at the earliest available opportunity by contacting the CCG Counter Fraud Specialist at the following link: Counter fraud 11. ASSOCIATED DOCUMENTS 11.1 Core Information Governance Polices The Information Governance Strategic Vision, Policy and Framework acts as an overarching policy for a number of core information governance policies, they are: Information Governance Strategic Vision, Policy and Framework 10 of 15

Confidentiality and Data Protection Policy Freedom of Information Act and Environmental Information Regulations Policy Information Security Policy Network Security Policy Records Management and Information Lifecycle Policy This policy must be read in conjunction with these core policies. The Information Governance Strategic Vision, Policy and Framework sets out a number of key requirements that are applicable for each of the core Information Governance Policies. They are: Accountability and Responsibilities Training Implementation and Dissemination Monitoring Compliance and Effectiveness of the Policy 11.2 Other Associated Policies Other key policies that have relevance to the overarching and core Information Governance Policies and which should also be read in conjunction with this policy include: Risk Management Policy Incident Reporting Policy Business Continuity Policy Disciplinary Policy Anti-Fraud Policy Anti-Bribery Policy Whistle Blowing Policy Internet and Email Policies and Procedures 11.3 Associated Procedures and Guidance The CCG will produce appropriate procedures and guidance relating to information governance as required by related policies. This will include an Information Governance handbook which will be updated regularly and which will be given to all staff. Associated procedures will include (but are not limited to): Access to Records Procedure Information Sharing Protocol Freedom of Information Procedures Email and Internet Procedures Privacy Impact Processes Remote Access and Home Working Procedures Safe Haven Procedure Information Governance Strategic Vision, Policy and Framework 11 of 15

Appendix A Legislation and Guidance Legislation and guidance that may have an effect on the way information is processed is shown below. This is not an exhaustive list and further guidance can be obtained from your organisation s Caldicott Guardian, SIRO or the Information Governance Support Team. Data Protection Act 1998 NHS Act 2006 Human Rights Act 1998 Computer Misuse Act 1990 Caldicott Guidance as updated 2013 Common Law Duty of Confidentiality Access to Health Records Act 1990 (where not superseded by the Data Protection Act 1998) Health and Social Care Act 2012 Crime and Disorder Act 1998 The Children Act 1989 and 2004 Copyright, Designs and Patents Act 1988 (as amended by the Copyright (Computer Programs) Regulations 1992 Electronic Communications Act 2000 Regulation of Investigatory Powers Act 2000 (& Lawful Business Practice Regulations 2000) Public Interest Disclosure Act 1998 Audit & Internal Control Act 1987 NHS Sexually transmitted disease regulations 2000 Human Fertilisation and Embryology Act 1990 Abortion Regulations 1991 Prevention of Terrorism (Temporary Provisions) Act 1989 & Terrorism Act 2000 Road Traffic Act 1988 Regulations under Health and Safety at Work Act 1974 Health and Social Care Act 2012 Public Records Act 1958 Freedom of Information Act 2000 Environmental Information Regulations 2004 Protection of Freedoms Act 2012 Coroners and Justice Act 2009 Caldicott Review updated 2013 Health and Social Care Information Centre Guidance Professional Codes of Conduct and Guidance Information Commissioners Guidance Documents Fraud Act 2006 Bribery Act 2010 Information Governance Strategic Vision, Policy and Framework 12 of 15

Enterprise and Regulatory Reform Act 2013 Equality Act 2010 Information Governance Strategic Vision, Policy and Framework 13 of 15

Appendix B Information Governance Committee Terms of Reference Purpose The Leeds Information Governance (IG) Committee is a formal city-wide committee forming part of the governance and assurance framework for each of the 3 Clinical Commissioning Groups (CCGs) in Leeds. These CCGs are; Leeds North, Leeds West and Leeds South and East. It will assist each CCG in ensuring that it manages and uses information securely and safely in compliance with the associated legislation. An Information Governance Committee is recommended within the national Information Governance Toolkit (IGT) to support and drive the broader information governance agenda and provide each CCG Board or Governing Body with the assurance that effective information governance best practice mechanisms are in place within the organisation. The Leeds Information Governance Committee will ensure that the appropriate policies, procedures and structures are developed and put in place to provide a robust governance framework for information management, thereby ensuring CCG compliance with the national Information Governance Toolkit in the following key areas: Data Protection Freedom of Information Caldicott Confidentiality Information Security Records Management Data Quality Objectives The main objectives of the Leeds IG Committee will be to: Ensure that the CCG satisfies statutory and NHS requirements and standards concerning information governance Ensure that the CCG has effective policies and management arrangements covering all aspects of Information Governance in line with the CCGs overarching Information Governance Policy and Strategy Ensure that the CCG undertakes regular assessments and audits of its Information Governance policies and arrangements Establish an annual Information Governance Improvement Plan, secure the necessary implementation resources, and monitor the implementation of that plan Define clear lines of accountability for IG policy, practice and implementation Support the Caldicott Guardian and Senior Information Risk Owner Identify and evaluate areas of risk, set priorities and, where appropriate, undertake or recommend remedial action in relation to information processing issues e.g. breaches of confidentiality or security Advise on the introduction of changes to processes and systems within the CCG or shared with partner agencies, to ensure the safe and secure processing of personal information Information Governance Strategic Vision, Policy and Framework 14 of 15

Monitor compliance with Information sharing protocols Promote education and training programmes for staff in order to support improvements in the CCG information processing practice and culture Liaise with other CCG committees, working groups and boards in order to promote Information Governance and resolve any issues As part of the CCG delegated responsibility from NHS England, to support General Practitioners with advice to enable them to complete their Information Governance Toolkit submissions. To monitor the IG support service delivered by the Commissioning Support Unit under a service level agreement Frequency of meetings The Group will meet a minimum of four times a year. Meeting minutes will be taken. Reporting The Leeds IG Committee will report to each of the CCG assurance committee as follows: Leeds West Assurance Committee Leeds North Governance, Performance and Risk Committee Leeds South and East Governance and Risk Committee This will generally be by means of the following: Copy of the Information Governance Committee minutes. An IG summary that covers any IG matters that need to be brought to the attention of the relevant assurance committee Membership of the Group The core membership of this group will include: Director of Informatics (city-wide) - Chair Senior Information Risk Owner (SIRO) or delegate per CCG Caldicott Guardian or delegate per CCG Commissioning Support Unit Information Governance Manager/Specialist An Information Asset Owner (IAO) per CCG Others may attend when agenda requires Quoracy The Information Governance Committee will be quorate when the Chair, a SIRO or Caldicott Guardian and 1 employee representative per CCG from the core membership are present (Nb. The CCG representative could include the Chair, SIRO or Caldicott Guardian). Accountability The Leeds IG Committee will be accountable to each of the CCG assurance committees. Information Governance Strategic Vision, Policy and Framework 15 of 15