Scope

  • Policy Statement
  • The Policy
  • Process Requirements
  • Physical Security
  • Potential or Actual Security Breaches
  • Information Sharing Guidance
  • o Information Sharing Principles
  • o The Golden Rules
  • Related Policies
  • Related Guidance
  • Training Statement

Policy Statement

The purpose of this policy is to protect, to consistently high standards, all information assets, including service users, residents, staff, records, written or electronic, and all other corporate information, from all potentially damaging threats, internal or external, deliberate or accidental, imagined or real. Until the advent of the internet, cyber was used in the information of words relating to computers, computer networks, or virtual reality. From the Wall Street Journal to Doctor Who, cyber has developed into the English language where it is currently associated with the internet and other developing technologies. Mass cyber attacks are almost always via internet providers’ data systems, which are hacked, and often the data is leaked into the mainstream media outlets. Governments now issue lots of guidance regarding cyber breaches of data protection laws, and this policy reflects much of the guidance.

The Policy

Where information security is cited, it includes cyber security and vice versa.
Information security is primarily about people but is facilitated by the appropriate use of technology, which is ever more sophisticated and evolving in its nature.
This policy applies to all aspects of information handling, including, but not limited to:

  • Structured record systems (paper and electronic),
  • Information recording and processing systems (paper, electronic, video, photographic and audio recordings), and
  • Information transformation systems, such as fax, email, portable media, post, and telephone.
  • The purpose of the policy is to achieve a consistent approach to the security management of information throughout the organisation to enable continual business capability and to minimise the likelihood of occurrence and the impact of any information security incident or breach.

Process Requirements

Information security is paramount in maintaining and protecting the confidentiality, integrity, and availability, where appropriate, of the organisation’s information or data. There are three elements to the process:

  • Maintain the confidentiality of personal information, including customers and staff, by protecting it following all legal and regulatory framework criteria.
  • Ensure the integrity of the organisation’s information by developing, monitoring, and maintaining it to a satisfactory level of quality for use within the relevant activity area.
  • Review and implement the necessary measures to maintain the availability of the organisation’s information systems and services, including putting in place contingency measures that ensure the minimum of disruption should an incident or breach occur.

Physical Security

The physical security of information is the responsibility of everyone who is involved in the handling, maintaining, storage, and retrieval of information, including any information that is shared, transmitted electronically, or transported by external suppliers, e.g. courier services and postal deliveries. Staff at all levels throughout the organisation must take all necessary precautions to avoid loss, theft, damage, or misappropriation of information. The following good practice is in place.

  • All staff must wear ID badges; individuals not doing so, in non-public areas, should be challenged.
  • Visitors must sign in, be met at the reception, and accompanied at all times.
  • All doors must be properly secured and, where used, entry codes must be regularly changed to protect their integrity.
  • Anyone loitering or obviously out of place should be asked their purpose of visit, etc., and checked accordingly.
  • To prevent malware contamination, no external hardware, such as USB, memory or recording portable devices, can be used within the organisation, without prior approval from the Registered Manager.
  • Management of computers and/or networks is controlled via a contractual arrangement with the Frontier Group
  • Frontier House
  • 5 Hedley Court.
  • Orion Businees Park. Tyne Tunnel Trading Estate
  • North Shields. NE29 7ST. Tel: 0800 1244348
  • Users shall not install software, for any purpose, unless authorised to do so by the Registered Manager. Users who breach this requirement may be subject to disciplinary action.
  • Screens should be locked when unattended, even for short periods, such as toilet breaks.
  • Passwords should never be shared and changed at regular intervals.
  • Disposal of equipment is allowed only by authorised personnel.
  • Secure transfer of files and documentation, whether physically or electronically, must be properly recorded and approved.
  • Should a legitimate need arise for a non-routine transfer of information, a risk assessment must be undertaken first to determine the most secure transfer process, e.g., courier, by hand only, etc.
  • Adequate and appropriate monitoring of the information that is held and its use should be undertaken at least annually, as part of the audit cycle.
  • Records management systems, policies, and procedures should be followed at all times, within the information chain.
  • Paper information is particularly vulnerable, e.g., personally identifiable and sensitive personal information should be removed or covered when left unattended on desks or work surfaces.
  • A clear desk routine should be followed, with a final check-in place at the end of the working day that includes paper vulnerability and computer security.

Business continuity is assured by continually reviewing our information systems, in particular:

  • That information shall be available to properly authorised personnel as and when it is required.
  • Relevant information security awareness and training are regularly available and accessible to staff.
  • All breaches of information security, actual or suspected, are recorded, reported, and investigated, and mitigating measures put into place to prevent a recurrence.

Potential or Actual Security Breaches

  • All staff within this organisation are responsible for ensuring that no potential or actual security breaches occur as a result of their actions.
  • On receipt of a reported breach, an investigation with a report, in a timescale appropriate to the risks to the business, will be completed by the Registered Manager.
  • Notifications to any regulatory body will be part of this process, where necessary.

Risk to the business is directly linked to our capacity to remain secure, and any such measures must be viewed as necessary protection against any event occurring. A range of security measures can be deployed to address:

  • The threat of something damaging the confidentiality, integrity, or availability of information held or systems or manual records.
  • The impact that such a threat would have.
  • The likelihood of such a threat occurring.

To mitigate risks, we will work towards a paper lite environment, as outlined in our business plan.

Information Sharing Guidance

This clarifies information sharing for staff at all levels of the organisation. Where staff are in any doubt as to whether it is appropriate to share information, advice should be sought from the data controller Carly Fortune

Information Sharing Principles

  • Must have lawful authority.
  • Must be necessary.
  • Must be proportionate.
  • Must need to know.
  • Must be accountable.
  • Must ensure the safety and security of the information shared.

We are all aware of the intense media interest, particularly when things go wrong, so a balanced approach to information sharing is vital in any decision to share. In safeguarding situations particularly, it is important to ask why you would not share. All health and social care staff and partner agencies have a common-law duty of confidentially within their work with adults at risk. They also have a duty to comply with the Caldicott Principles. These are a set of requirements that ensure that information regarding people who use services is treated with sensitivity to maintain its confidentiality. Information that has been provided in confidence is not normally shared or used without consent from the subject and source of such information. In all cases, the main legislation that underpins the sharing of information concerning adults at risk is:

  • Common law duty of confidentiality.
  • data protection legislation.
  • Human Rights Act 1998.
  • Freedom of Information Act 2000.
  • Crime and Disorder Act 1998.
  • Care Act 2014.

It is a requirement that all staff of this organisation adhere to the golden rules, set out below, for information sharing in all instances of information exchange between all multi-agency partner external contacts. Any request for such information will only be shared when all the golden rules are met.

The Golden Rules

  • Remember that data protection legislation is not a barrier to sharing information but provides a framework to ensure that personal information about living persons is shared appropriately.
  • Be open and honest with the person, family, or representative from the outset about why, what, how, and with whom the information will or could be shared, and seek their agreement unless it is unsafe or inappropriate to do so.
  • Seek advice, if you are in any doubt, and, where this is outside of the organisation, remember confidentiality.
  • Share with consent. Where appropriate and where possible, respect the wishes of those who do not consent to share confidential information.
  • You may still share information, without consent, if, in your judgement, that lack of consent can be overridden in the public interest. You will need to base such judgements on the facts of the case.
  • Consider safety and wellbeing: base your information-sharing decisions on considerations of the safety and wellbeing of the person and others who may be affected by their actions.
  • Adhere to all policies regarding transportation of confidential and sensitive information, including staff records.

Related Policies

Confidentiality
Co-operating with other Providers
Data Protection Legislative Framework (GDPR)
Internet, Email and Mobile Phone (Acceptable Use)
Record Keeping
Social Media and Public Relations
Whistleblowing

Related Guidance

The National Cyber Security Centre (NCSC):
www.ncsc.gov.uk

The National Security Strategy 2016 – 2021:
www.gov.uk/government/publications/national-cyber-security-strategy-2016-to-2021

The Information Commissioner’s Office (ICO):
https://ico.org.uk/

NHS Digital:
www.digital.nhs.uk

Cyber Aware:
www.cyberaware.gov.uk

Cyber Essentials:
www.cyberessentials.ncsc.gov.uk

Get Safe Online:
www.getsafeonline.org

Action Fraud:
www.actionfraud.police.uk

ISO/IEC 27001 Information Security Standard:
www.iso.org/

ISO/IEC 27002 Security techniques – Code of Practice for Information Security Controls:
www.iso.org/

ISO/IEC 27005 Information Security Risk Management:
www.iso.org/

ISO/IEC 22301 Business Continuity Standard:
www.bsigroup.com/

ISO/IEC 22313: Business Continuity Management Systems — Guidance:
www.bsigroup.com/

Strong Password Generator:
https://strongpasswordgenerator.com/

Training Statement

All staff, during induction, are made aware of the organisation’s policies and procedures, all of which are used for training updates. All policies and procedures are reviewed and amended where necessary, and staff are made aware of any changes. Observations are undertaken to check skills and competencies. Various methods of training are used, including one to one, online, workbook, group meetings, and individual supervisions. External courses are sourced as required.

Date Reviewed: May 2021
Person responsible for updating this policy: Carly Fortune
Next Review Date: May 2022