Dental Health Spa Information Governance
Reviewed May 2018
Information is a vital asset, both in terms of the clinical management of individual patients and the efficient management of services and resources. It plays a key part in clinical governance, service planning and performance management. It is therefore of paramount importance that information is efficiently managed, and that appropriate policies, procedures, management accountability and structures provide a robust governance framework for information management.
Purpose: Policy Statement
This Information Governance policy provides an overview of the practice’s approach to information governance; a guide to the policies and procedures in use; and details about the IG management structures within the dental practice, including patient information and involvement, team training and monitoring.
All team staff, whether permanent, temporary, contracted including contractors are responsible for ensuring that they are aware of and comply with the requirements of this policy and the procedures and guidelines produced to support it. A Confidentiality Agreement
is signed by all employees, self-employed contractors and third parties.
The practice’s approach to Information Governance
This practice undertakes to implement information governance effectively and will ensure the following:
- Information will be protected against unauthorised access;
- Confidentiality of information will be assured;
- Integrity of information will be maintained;
- Information will be supported by the highest quality data;
- Regulatory and legislative requirements will be met;
- Business continuity plans will be produced, maintained and tested;
- Information governance training will be available to all staff as necessary to their role;
- All breaches of confidentiality and information security, actual or suspected, will be reported and investigated.
Policies in use in this practice
This Information Governance Policy is underpinned by the following policies:
- Information Security Policy
- Confidentiality Policy
- Data Protection Policy
- Access to records Policy
- Digital Access Control Policy
- Information Handling Policy
- Adverse Incident Policy
Procedures in use in this practice
This Information Governance policy is underpinned by the following procedures:
- Records management procedure that set outs how patient dental records will be created, used, stored and disposed of
- Business continuity plan that sets out the procedures in the event of a security failure or disaster affecting computer systems;
Staff compliance with the procedures is supported by the following guidance material:
- Records management: guidelines on good record keeping;
- Staff confidentiality code of conduct: sets out the required standards to maintain the confidentiality of patient information; obligations around the disclosure of information and appropriately obtaining patient consent;
- Access control: guidelines on the appropriate use of computer systems;
- Information handling: guidelines on the secure use of patient information;
- Using mobile computing devices: guidelines on maintaining confidentiality and security when working with portable or removable computer equipment;
- Information incidents: guidelines onidentifying and reporting information incidents.
Responsibilities and accountabilities
The designated Information Governance lead
for the practice is the practice manager.
The key responsibilities of the lead are:
- Developing, implementing and reviewing IG policies, procedures and processes for the practice
- Ensuring a Confidentiality Agreement is signed by all employees, self-employed contractors and third parties.
- Coordinating the activities of any other practice staff given data protection, confidentiality, information quality, records management and Freedom of Information responsibilities
- Raising awareness and providing advice and guidelines about IG to all staff
- Ensuring that any training made available is taken up
- Supporting IG training during induction of new team members/staff
- Supporting IG training as part of the practice commitment to ongoing personal and professional development for all team members/staff
- Conducting an IG risk assessment at least annually
- Conducting periodic IG compliance checks as necessary
- Ensuring that patient data is kept secure and that all data flows, internal and external are periodically checked against the Caldicott Principles
- Monitoring information handling in the practice to ensure compliance with law, guidance and practice procedures
- Information incident management, including recording, reporting, analysing and sharing learning
- Ensuring patients are appropriately informed about the practice’s information handling activities.
- Seeking feedback and sharing feedback with the team to improve outcomes
The day to day responsibilities for providing guidance to staff will be undertaken by the practice manager.
The practice provider is responsible for ensuring that sufficient resources are provided to support the effective implementation of IG in order to ensure compliance with the law, professional codes of conduct and the NHS information governance assurance framework. (if applicable)
We inform and involve patients by communicating this policy to them with our Data Protection Code of Practice
. We regularly monitor and act on feedback from patients and staff regarding their experience in the practice and make changes as appropriate.
This policy has been approved by the undersigned and will be reviewed on an annual basis. Questions about this policy or associated procedures should be raised with the practice manager or owner.