NHS practices must complete the online Data Protection and Security Toolkit, which is a highly complex task and involves the need for regular annual checks, audits and updates. Without a system to follow it’s a very difficult task for a dental practice to set up and maintain annually. As is often the case with new Government requirements, they are created for much larger organisations such as NHS Trusts or hospitals and there isn’t a ‘lite’ version for small businesses, which may come in the future. But the problem is that we have to complete it now.
Fortunately iComply provides all of the templates, action plans, risk assessments and procedures that a practice needs to comply not only with GDPR and the new Data Protection Act, we collectively call this Information Governance (IG). You can complete the Data Protection and Security Toolkit, just by following the steps in the Data Protection and Security Toolkit Completion document we call (M 217A). In iComply each year you keep all policies and procedures up to date, Agilio updates them in the background, which means that you only need to know when you review them each year.
There are 30 pages in Microsoft Word containing the following prompts, directly from the online Data Protection and Security Toolkit once iComply has filled in all the evidence for you to adopt. You can see the details in the sample (M 217A) at the end of the newsletter, with the evidence completed being based on the iComply templates.
| ASSERTION: THERE IS SENIOR OWNERSHIP OF DATA SECURITY AND PROTECTION WITHIN THE ORGANISATION | |||
|---|---|---|---|
| PROMPT | PROMPT DETAILS | EVIDENCE | INITIAL DONE |
| NAME OF SENIOR INFORMATION RISK OWNER. | THIS IS THE PERSON WHO IS RESPONSIBLE FOR DATA SECURITY AND COULD BE COMBINED WITH THE CALDICOTT GUARDIAN. | ||
| SIRO RESPONSIBILITY FOR DATA SECURITY HAS BEEN ASSIGNED. | THIS IS A FORMALLY ASSIGNED RESPONSIBILITY FOR DATA SECURITY TO THE RELEVANT INDIVIDUAL. IT COULD FORM PART OF THEIR JOB DESCRIPTION OR BE AN EMAIL FROM THE APPROPRIATE MANAGER IN YOUR ORGANISATION.ASSERTION: THERE IS SENIOR OWNERSHIP OF DATA SECURITY AND PROTECTION WITHIN THE ORGANISATION | ||
| ASSERTION: THERE IS SENIOR OWNERSHIP OF DATA SECURITY AND PROTECTION WITHIN THE ORGANISATION | |||
| PROMPT | PROMPT DETAILS | EVIDENCE | INITIAL DONE |
| NAME OF CALDICOTT GUARDIAN. | A CALDICOTT GUARDIAN IS A SENIOR PERSON RESPONSIBLE FOR PROTECTING THE CONFIDENTIALITY OF PEOPLE’S HEALTH AND CARE INFORMATION AND MAKING SURE IT IS USED PROPERLY. THIS CAN BE THE SAME PERSON AS OTHER ROLES HIGHLIGHTED. IF NOT RELEVANT FOR YOUR ORGANISATION MARK N/A | ||
| WHO ARE YOUR STAFF WITH RESPONSIBILITY FOR DATA PROTECTION AND/OR SECURITY? | RECORD NAMES AND JOB TITLES ONLY FOR STAFF WHO HAVE A SPECIALISED ROLE. | ||
| STAFF AWARENESS- LEADERSHIP (Q1) I FEEL DATA SECURITY AND PROTECTION ARE IMPORTANT FOR MY ORGANISATION. | THE PERCENTAGE OF RESPONDENTS IN YOUR ORGANISATION WHO “AGREE” OR “STRONGLY AGREE” WITH THIS STATEMENT, TAKEN FROM THE NATIONAL DATA SECURITY AWARENESS TRAINING SURVEY QUESTION 1. ORGANISATIONS MAY CAPTURE THIS INFORMATION LOCALLY WHERE THE TRAINING IS DELIVERED LOCALLY. |
One of the most important documents is your Information Governance Procedures template we call (M 217C), it’s 12 pages ready to adapt and adopt. But iComply also provides:G 135 – Backup Procedures and Software Log Overview
G 135A – Computer Backup Log
G 135B – Purchased Software Log
M 215 – Record Retention
M 217L – Network, Computer and Software Access Log
M 217M – Physical Security Risk Assessment
M 217N – Business Impact Analysis
M 217P – Patient Leaflet on Personal Information
Plus an additional 20 data protection policies and procedures
The first step is to set up all of the policies, procedures and necessary audits by following the GDPR and Data Protection Action Plan (M 216A). An example of this action plan is downloadable from the end of this newsletter. I’m not saying that iComply is the only way to complete the Data Protection and Security Toolkit and to keep it up to date, but I think it’s the easiest and most time saving. You can download the excerpts of the Data Protection and Security Toolkit Completion document (M 217A) and the Data Protection Action Plan (M 216A) and the Data Protection and Security Policy from the end of this newsletter.
Agilio Dental
Learn more about how our technology can help to grow your dental business.