Information Governance Information for Employees Royal Cornwall Hospitals Trust

1. Information Governance Information for Employees Royal Cornwall Hospitals Trust

2. Information Governance Information for Employees Royal Cornwall Hospitals Trust

3. What is Information Governance?

4. Data Protection Act 1998 Caldicott Report Public Records Act 1958 Access to Health Records Act 1990 Freedom of Information Act 2000 Environmental Regulations Act 2000 NHS Confidentiality Code of Practice NHS Records Management Code of Practice Computer Misuse Act 1990 Common Law Confidentiality IT Security Information Quality Assurance Code of Confidentiality Local Policies/Procedures Records Management Information Sharing Protocols Legislation/Policies

5. Data Protection Act 1998 • 8 Principles • Fairness and legality • Permission • Adequacy /Relevant, not Excessive • Accuracy • Length of use • Access rights • Security • Transfer outside EEA • Caldicott Report 1998 • 6 Principles for use and sharing • Justify the purpose • Use only when necessary • Use minimum necessary • Access – strict need to know basis • Individual responsibility • Comply with the law • Duty to share and protect

6. Information Governance Is the way in which we handle: - Personal and sensitive information of patients and employees. Organizations and Individuals have a responsibility to handle personal information Legally, Securely, Efficiently and Effectively, Information Governance provides: - A framework to bring together all of the requirements, standards and best practice In handling of information. All employees are responsible for maintaining the confidentiality of information gained during their employment by the Trust.

7. Personal Information can be accessed from: • The patient • The health record • Colleagues • Personnel files/HR/Payroll • Electronically processed data • Stored images • Knowledge held by employee • Telephones • Fax machines – ‘Safe Haven’ • Pieces of paper • Verbally

8. Confidentiality and Information Security • To obtain information without consent…. • Is unlawful • Is a breach of the DPA, HRA and if obtained via • Hospital systems, a breach of the Computer Misuse Act. • May/will result in…. • Disciplinary action • Dismissal • Civil action for damages • Custodial sentence • Unlimited fine The RCHT monitor access to all systems. All breaches will be dealt with in accordance with the Trust’s disciplinary procedure

9. Top Tips Do Not……… • Leave your PC logged on • Access information on PAS • inappropriately • Leave your office unlocked • Include patient identifiable • information in the subject of • an email • Send personal data outside • the Trust without permission • Share Passwords Do……… • Respect confidentiality • Direct Police – they do not have an automatic right to information • Direct general enquiries • Check identity – this includes staff • Report incidents –don’t ignore them (Datix)

10. Role of Individual Staff All staffs are responsible for: All staff, whether permanent, temporary or contracted, and contractors are individually Responsible for ensuring that they are aware of the requirements incumbent upon them For ensuring that they comply with these on a day to day basis. Failure to follow this and the associated polices and procedures will result in the Trust enforcing its disciplinary procedure.

12. Disposal of Confidential Information • When disposing of paper-based person identifiable information or confidential • information and computer printouts always use ‘Confidential Waste’ sacks/shredders. • Floppy discs/CDs containing confidential information must be destroyed. • Computer hard disks are only to be destroyed/disposed of by the CITS experts within the Trust. Confidentiality of Passwords, PIN Numbers, etc Personal passwords, (i.e. groupwise) PIN numbers, etc issued to or created by employees should be regarded as confidential and they must not be communicated to anyone. To do so is a disciplinary offence. This includes swipe cards, digital lock codes etc.

13. How long Are Records kept?

14. Trust Board agendas/minutes 30yrs 2yrs Ordinary agendas 6yrs from end of service, at which time a summary of the file must be kept, until individual reaches 70. Personal files Policies/Procedures 10yrs after life of policy/procedure- to be able to answer complaints/litigation, using the Policy/procedure in place at the time Records of destruction Permanently and not destroyed Generally 8yrs after death/last attendance, Unless you are a child then 26yrs or 8yrs after death. Maternity records to these children the same time Health Records Human Fertilisation Some records 50yrs Cancer Records 30yrs

17. Information Governance

19. How many patient files lost nationally per year G NHS lost 1.8 million patient records in a year More than 5,000 confidential patient records are being lost by the NHS every day, according to new figures. October 2012 Daily Telegraph Among the breaches included data security records dumped in public bins and electronic records found for sale on an internet auction site.

20. Patient notes were found in public places within NHS buildings, with private documents also left in car parks and on public transport, In one incident at NHS Dumfries and Galloway, details of a patient appointment written on a scrap of paper was used as a bookmark in a furniture catalogue which was sent around a hospital.

21. NHS Surrey has been fined £200,000 by data regulators over the loss of sensitive information about more than 3,000 patients July 2013 Regulators said NHS Surrey failed to check that a data destruction company had properly disposed of the records. Upon investigation, the trust discovered the computer contained the health records of 2,000 children and 900 adults, plus a number of NHS human resources records. Medical secretary sharing confidential information with relative- Lost job

22. G NHS Fines What could be the consequences of sending a confidential fax to wrong destination? £60k Sending a confidential fax to wrong destination £100k Confidential information in bag, left in pub- -stolen-sold on And sending a discharge letter to the wrong address? £60k Discharge letter sent to wrong address. St Georges Hospital, failed on THREE occasions to ask patient if address details etc. had changed.

23. Manual handling

24. Video Bricklayer of Bangladesh

25. MHOR(as amended 2004) G What Are Your Obligations? Risk Assessment Health Reporting Use equipment provided Follow systems of work

26. 75L

30. G If This Was Printed On Your Back?

32. G If This Was Printed On Your Back?

34. G If This Was Printed On Your Back?

35. Manual Handling Budget Range Video Manual Handling

38. Most injuries in the workplace are caused by people lifting, pushing, pulling or carrying heavy loads, and making awkward movements when doing so. In the UK alone, 54 million working days are lost each year because of back problems caused by poor technique when handling objects. This can also damage the shoulders, neck, hands, arms and feet. Because almost everything we do involves some form of manual handling, it’s essential that we know how to do it safely to avoid getting hurt.

39. G Follow Training Decant Ask For Help Use Equipment Follow Systems Risk Assess. Posture Say “NO” Which of the above should be number one? How Do You Prevent Manual Handling Injuries?

41. Safeguarding Vulnerable Adults Level One Mandatory update

42. The learner will be able to demonstrate their understanding of: The categories of abuse The indicators of different types of abuse The process to follow when abuse is suspected Aims

43. Definition of Abuse ‘A violation of an individual’s human and civil rights by an act, or a failure to act, on the part of another person or persons. Abuse may consist of a single or repeated act of neglect or failure to act or it may occur when a vulnerable person is persuaded. 4.4

44. Cornwall dvd

45. Definition of a vulnerable adult A “vulnerable adult”, is a person 18 years of age or older. Who is or may be in need of community care services by reason of mental or other disability, age or illness AND Who is or may be unable to take care of him or herself OR Is unable to protect him or herself against significant harm or exploitation Safeguarding of Vulnerable Adults Policy and Procedures 4.1

46. Examples of Acts of Omission Inadequate assessment & planning of an individuals needs The neglect of an individual's personal care needs Failure to give pain relief Not communicating with and ignoring patients & / or their relatives/carers Too hasty discharge from hospital

47. A Key Act of Omission Failure to take action in your role when you suspect a person in your care has been or is being abused Recognise abuse Respond Record Report Safeguarding is everyone's responsibility

48. Responding to a Disclosure Don’t: Do not be judgmental (eg ‘Why didn’t you try to stop them?) Do not break confidentiality agreed between the person disclosing the information, yourself and your line manager Do not gossip with other staff members or service users about the information shared with you (ie: ‘It’s awful, you’ll never guess what I’ve just been told.) 50

49. RCHT Internal process Ensure the person is not in danger and protect from harm Make a factual report in the patients medical record Simultaneously inform your line manager and document that you have done so Discuss with manager before any decision to make a formal alert If your line manager is the abuser or is otherwise uncontactable contact the clinical site co-ordinator on bleep 2634 When it is decided that a formal safeguarding alert is needed phone the access team on 03001234131 to make verbal alert. ALSO Complete a Datix web incident report 51

50. Raising a concern (Whistle blowing) procedure If you raise a genuine concern under this policy, you will: not be at risk of dismissal demotion pay reduction failure to renew a contract failure to gain potential promotion or other detrimental action. Provided you are acting in good faith, it does not matter if you are mistaken. 52