Do I need to also maintain this information in a separate Information Asset Register? A. This page provides an overview of the Data Security and Protection Toolkit. Q. Return to the section: Data security and information governance, Return to the section: Data Security and Protection Toolkit, Return to the Pharmacy IT hub or IT a-z index. Of these the PSNC have highlighted 15 as technical questions … A. The template SOPs have been developed by PSNC and the RPSGB with support from the DHSC, NHS Connecting for Health and NHS Employers. Q. I currently donât use any mobile computing systems in my pharmacy. Q. When patients return waste medicines, I currently put these in my controlled waste (DOOP) bin, complete with labels. that someone in the pharmacy contacted suppliers and they have confirmed no transfers outside of the UK. Briefings published by PSNC covering topics such as opening hours, regulations, and NHS IT matters. The Data Security and Protection Toolkit is an online self-assessment tool that enables organisations to measure and publish their performance against the National Data Guardian's ten data security … If there are flows outside of the UK, it is important to undertake an appropriate risk assessment and put in place mitigating controls, for example contractual requirements on the supplier. e-Learning – data security awareness – level one (v3.0), 3. Can a self-employed locum pharmacist be the IG lead for a pharmacy? Q. I currently maintain a comprehensive list of the hardware and software I own for insurance purposes. Q. I recently ordered some âmade to measureâ hosiery but the manufacturer has requested the patientâs details as part of the ordering process. What is the DSP toolkit? A. Within the Terms of Service, there is no requirement to process waste other than place it in a bin. Do the requirements apply to hardcopy data e.g. The 'Data Security Meta Standards' document gives the bigger picture of where the standards fit in. A. FAQs about Data and Security Protection (IG) Toolkit and data security can be found below. A. Yes. Q. Join our mailing list for a weekly round-up of news and resources, plus price concession/NCSO alerts. A. The impact of that loss is likely to be moderate (small number of patients affected) therefore the risk is low. General guidance from Public Health Englandâs âAccess to supervised doses of opioid substitution for people in police custody adviceâ available here may be useful. Q. Any improvements in the scores should be entered into the next version of the Information Governance Toolkit. Q. I am about to undertake my premises risk assessment. If a pharmacist is interrupted part-way through recording information against an individual requirement, click the âsaveâ button and work done will be saved. A. The concept behind having an information asset register is identifying all relevant hardware, software and information to ensure it can be appropriately protected. A. A number of changes were made to the Terms of Service requirements (Clinical Governance) in October 2011 to require pharmacies to comply with an approved information governance programme. These guides for social care take you through the definitions used in the standards, what the standards are asking of you, suggestions and examples of how this might be achieved, how this relates to common current practises, and useful resources. Requirements for IG change annually. Please ensure your email address is correct. This outlines the entry level Data Security and Protection Toolkit evidence items. As with the Information Governance funding, this was paid out through the general funding arrangements rather than via a specific fee. 'http':'https';if(!d.getElementById(id)){js=d.createElement(s);js.id=id;js.src=p+'://platform.twitter.com/widgets.js';fjs.parentNode.insertBefore(js,fjs);}}(document, 'script', 'twitter-wjs'); Website feedback form Therefore if the device contains no personal information, it would not be necessary under the NHS Information Governance requirements to record staff use and provide guidance on use of the device. FAQs about Data and Security Protection (IG) Toolkit and data security can be found below. For example, if the laptop connects to the pharmacy network and is used to access the internet, one risk is that if the anti-virus on the laptop isnât updated regularly, the laptop could introduce viruses to the local network that could compromise the security of information held on other computers connected to the network. Where the pharmacy maintains information on software, hardware or services in a separate asset register for accounting, insurance or business continuity purposes, an option is to do a cross reference from the relevant sections in the information asset register to the relevant register or location that this information is stored to prevent duplicating effort. This can be downloaded to Microsoft word and printed. Further our recent news story Contractor Notice: Drug Tariff to go fully paperless from April 2021,  NHS Business Services Authority... PSNC and the British Medical Association (BMA) have today issued a statement on medicines supply ahead of the end of... âWe Are Undefeatableâ is an award-winning campaign and movement supporting people with a range of long term health conditions, developed... Today PSNC hosted the Community Pharmacy Brexit Forum hearing updates from a number of organisations, including NHS England and NHS... PSNC Q. ; … It allows these organisations to measure their performance against the National Data Guardian’s 10 data security … This includes things like putting in place appropriate policies and procedures, undertaking risk assessments and putting in place appropriate mitigation to safeguard data and having good governance/audit arrangements to prevent contraventions of data protection regulations. But there may be differences depending on the nature of services provided under the LPS, therefore we recommend discussing this with your local NHS England team. Where is the funding for pharmacies initially implementing the IG requirements coming from? Further information available on the Information Commissionerâs website here. Q. I have received an FP10 prescription for an unlicensed ânamed patient supplyâ product. 6.4. The DSP (Data Security and Protection) Toolkit is an online data security self-assessment. !function(d,s,id){var js,fjs=d.getElementsByTagName(s)[0],p=/^http:/.test(d.location)? There is a greater risk of laptops etc being stolen even if they are not removed from the pharmacy, therefore the appropriate measures as outlined in the requirements must be taken. It could be a stand-alone leaflet or relevant content in existing practice leaflets could be adapted and expanded. Q. For many of the questions, I donât have the specific physical security controls in place however I am in an area of low crime. name, address, dob etc. Although the pre-printed serial number on prescription forms is a unique identifier, this identifies the paper form, not an individual patient. There is no âNot Applicableâ option on the Toolkit, how should I record this requirement? Do I need to have a patient leaflet on the use of patient information? Occasionally a pharmacy may be visited by a police officer who is undertaking an investigation into an alleged serious criminal offence (i.e. All organisations that process health and care data are required to complete a DSP Toolkit… A. A.  Given that both contracts are linked to the same premises, it may be appropriate to have only one submission which provides assurances to the on the management of information obtained under both contracts at the premises. Q. I run a wholly mail order business. The Information Commissioner’s Office (ICO) enforces and oversees data protection legislation. Responses to frequently asked questions regarding the Data Security and Protection Toolkit. There is no mandatory requirement to post or fax action plans to local NHS England teams, however, where the local NHS England team is working to provide support to pharmacies in meeting the requirements, pharmacies may find it helpful to submit their copy. Entry Level Evidence items (2020-21), 4. Further guidance on the powers of authorised persons under the Misuse of Drugs legislation may be available from the Home Office, the Association of Police Controlled Drugs Liaison Officers, the General Pharmaceutical Council, the NPA (for members) and from the RPS (for members). A. If the pharmacy does not use any mobile computing devices i.e. broadband connectivity). COVID-19 update: It has been agreed that no action will be taken against contractors who have not completed the Data Security and Protection toolkit for 2019/20, provided they are working to complete the toolkit … Patient identifiable information should not be shared without patient consent. If you have a support query, please contact us at https://www.dsptoolkit.nhs.uk/Home/Contact. 6.4. Historic Data Security and Protection Toolkit … The manufacturer is requesting that I share the prescription form serial number. The DSP toolkit (also known as the data security and protection toolkit) is an online self assessment tool that enables organisations to measure and publish their performance against the National Data Guardian’s ten data security standards.You can access the toolkit … The Data Security and Protection Toolkit uses cookies to improve your on-site experience. DSP Toolkit 2019-20 •The Data Security and Protection Toolkit Standard (DSPT) has been reviewed for 2019-20. A key consideration is whether there are any other sources of this data. there are no laptops and PDAs, nor any portable device used to hold or transfer personal information (e.g. This information should not normally be in the public domain. We aim for the Data Security and Protection Toolkit to be usable without reference to detailed … Two identical pharmacies holding the same information, computers and stock may have quite different physical security needs if one is located in an area of high crime and the other in a low crime area. No. A. Q. My local NHS England team has asked me to share a copy of my action plan with them. What will this be used for? A. A. There are ongoing costs, in maintaining compliance with the requirements, making annual Information Governance returns via the Toolkit and implementing changes made to the requirements by the NHS. Is this allowed? This list of questions can be used in local training materials or incorporated into local e-learning solutions. The locum will have to give consideration to whether this impacts on their self-employed status for tax purposes. They will help your organisation prepare for registering on, and completing, the Data Security and Protection Toolkit (DSPT). On the 1st April 2013, responsibility for monitoring and supporting pharmacy information governance passed from PCTs to NHS England Area teams (now local NHS England teams). The Information Commissioner has formed the view that in future, where such losses occur and where encryption software has not been used to protect the data, regulatory action may be pursued. Data Security, IG and Toolkit frequently asked questions. Q. I have just discovered I have made a mistake in my submission. The Data Security and Protection Toolkit is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards. There is a risk of some solutions slowing down or interrupting the operation of the PMR system if the solution isnât tested or if implementation isnât properly managed. How often should the pharmacy IG policies and procedures be updated? This survey has been developed by NHS Digital to assist organisations in understanding the data security awareness of its staff. This is carried out to ensure compliance with the Misuse of Drugs legislation, but sometimes it is undertaken to detect persons who are obtaining prescriptions from more than one prescriber. A. There are no mandatory requirements for how the information asset register should be structured but it should include information on information stored (e.g. The F-Code or ODS code is the the unique code issued to your pharmacy which identifies you to NHS Prescription Services. Toolkit completion: Overview: Five steps for completing the Data Security and Protection Toolkit 2019/20– this gives a step-by-step guide to completing the Toolkit and references other materials. Q. These guides take you through the definitions used in the standards, what the standards are asking of you, suggestions and examples of how this might be achieved, how this relates to common current practices, and useful resources. This will allow you to integrate it with any other soures to calculate your response to the Staff Awareness questions in the Toolkit… The Data Security Meta Standard provides more information on what the ten data security standards are and why they are important. The account of the previous owner can be locked and the new owner registered against that ODS Code. A local NHS England team may investigate a pharmacy that has not completed an annual return via the Information Governance Toolkit to satisfy itself that the pharmacy is meeting the Terms of Service requirements. A. Yes. PSNC is currently in discussion with the DHSC to finalise the funding allocation for business continuity planning. Data Security and Protection (DSP) Toolkit We know how most dental practices love to hate compliance so we’ve created a comprehensive guide to completing the DSP Toolkit. Do I need to invest in e.g. Do I need to complete 2 submissions? Queries on specific IG requirements can be found towards the bottom of the page. A data breach may trigger the need to review procedures during the year, for example to ensure they take into consideration lessons learned to prevent future breaches. The 2010/11 community pharmacy contractual framework funding settlement included provision for the costs of PC renewal in community pharmacies. The NHS requirements relate only to protecting patient identifiable information therefore Requirement 116 relates only to the contracts of contractors who have access to patient identifiable information, for example PMR suppliers. Mapping and Risk Assessing Information Flows. A. These are all actions that the NHS requires evidence of through the NHS Information Governance Toolkit. A. As part of requirements, you need to consider if information about patients is being transferred outside of the UK (e.g. A. If overseas processing is found to be happening, you need to follow the detailed guidance on overseas transfers and data protection legislation on pages 22-23 and 48 of the workbook. prescription forms as well as information held electronically? Q. I have heard that I need to encrypt my computers to reach level 2 of the NHS Information Governance Toolkit. Report quota issues, Copyright © 2020 PSNC • Site designed and built by Jellyhaus. Strengthening Assurance - Independent Assessment Guides 20-21, 6. 'About the Data Security and Protection Toolkit' provides an overview of what the toolkit is, who should complete the toolkit, and why. Definition of Data Security and Protection Toolkit organisation types 2020/2021. The guidance is designed to be used by DSPT independent assessment providers, including internal auditors, when assessing DSPT submissions. The online self-assessment tool enables organisations to measure and enhance their data and cyber security … Data security standards - big picture guides for social care, 6.3 Additional Information on evidence item 1.4.1, 6.4. Q. A contractor would have to review the template and consider whether they were sufficiently relevant to local circumstances, adapting the templates where necessary. Q. A. To support the efficiency of future orders, ‘made to measure’ hosiery manufacturers may ask for a patient identifier when the order is placed, for example so that the template produced for that individual patient can be re-used in future. Once Iâve registered for the IG Toolkit, how do I update my registered email address or other information? Q. I have a laptop in my consultation area that I use to store patient information but it is used like a desktop and never removed from the pharmacy. A. Yes, in 2015 the requirement came in which meant that pharmacies are no longer exempt from having a business continuity plan in place. If a pharmacy has missed the 31st March deadline, we would recommend contacting your local NHS England team to discuss this. £90 million of investment was agreed for these unavoidable one-off infrastructure costs. A. These webinars are provided by the … When can I next submit an assessment? Therefore, as an interim measure, if following a risk assessment it is felt that continued reliance upon unencrypted data is necessary for the benefit of patients, the outcome of the risk assessment must be reported to the most senior person in the organisation, so that he/she is appropriately accountable for the decision to accept data vulnerability or to curtail working practices in the interests of data security.â Therefore encryption had not been mandatory to achieve Level 2 compliance with the NHS IG requirements as outlined in the older version 9 of the IG Toolkit (now replaced by DSPTK). The Data Security and Protection Toolkit is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 security standards. This page provides an overview of the Data Security and Protection Toolkit and its core functionality. This page provides copies of historic guidance and training for reference purposes. You may receive reminders. Our monthly updates on dispensing news and guidance, plus a variety of factsheets. Regulatory burdens are assessed on a retrospective basis and included in funding negotiations. The IG lead needs to have the appropriate responsibilities to be able influence procedures and deliver implementation. The toolkit has a total of 115 questions, although only 56 of these are mandatory. For example, a pharmacy may find it helpful to include a sticker on the asset with an assigned asset reference number. It is exceptionally burdensome for pharmacies and there is a risk that patient identifiable information will be inadvertently disclosed. Can a local NHS England team take action against a pharmacy contractor who does not achieve the required level by the 31st March 2015? Pharmacies should ensure that their action plan is filed locally so that it is available to show to local NHS England team officials during support visits (which may be part of contractor monitoring visits) to the pharmacy. There is flexibility in how the pharmacy structures co-ordination of information handling within the pharmacy. Data security standards - big picture guides. Both are linked to the same premises. Click on a heading below to reveal FAQs on that topic. Q. A. Q. The pharmacy must be able to show that the role has been appropriately assigned. A. What happens if I don’t complete my submission by the deadline? General Practice however there may be alternative questions relevant to just your organisation type: Data Security and Protection Toolkit – Administrator Guide v 1.5 FINAL 03/07/2019 ... Data Security and Protection Toolkit … Data security standards - big picture guides, 6.1. The guidance states that, âThere have been a number of reports recently of laptop computers, containing personal information which have been stolen from vehicles, dwellings or left in inappropriate places without being protected adequately. To date £12m has been allowed. No â local NHS England teams cannot access your action plan through the Information Governance Toolkit. should not normally be disclosed without patient consent or otherwise allowed by law. Similar requirements on the disclosure of personal data exist under the common law duty of confidentiality. Pharmacies are also required to be compliant with data protection legislation and the NHS Code of Practice on Confidentiality. The pharmacy will need to give consideration to how pharmacies can access the leaflet, for example sent regularly to all patients, sent once to all patients and then to new patients who use the service or made available on the website with a pointer to it. Remember, the IG Lead doesnât need to be a pharmacist so if the pharmacy does not have a permanent pharmacist, one option would be for a senior dispenser or non-pharmacist manager to act as IG lead. For example: “Requirement not applicable, this pharmacy does not use removable or portable computing equipment including CDs/DVDs and USB sticks.” The pharmacy should ensure that staff do not use mobile computing devices in their role. There are a number of exceptional circumstances in which personal data can be disclosed without patient consent, for example, where disclosure of personal data is necessary to prevent serious injury or damage to the health of a patient. There may be other reasons to include confidentiality clauses in contracts for example protecting information relating to the business that is commercially sensitive. Find out what’s happening in the wider NHS. 7. A separate Data Security Awareness Survey is also available alongside the new course. Data breaches are all over the news, and organizations are acutely aware that even if they have achieved PCI compliance or SOX compliance, new compliance regulations like the GDPR demand more stringent data security controls.To help you improve your security and compliance posture, we have put together a list of the top 12 data security solutions for protecting sensitive data … How can this be achieved? not routinely exercising powers under the Misuse of Drugs Act 1971). As this may not be the police officer who normally visits to inspect the registers, pharmacy contractors will wish to verify the identity of the police officer, and receive confirmation that the police officer is investigating a possible serious offence. We also have video guides with advice on how to complete each question. Some of the NHS IG requirements therefore have a specific focus on either digital or hardcopy information. Use our form to help you answer 12 questions. Q. I use a mobile device for connecting to the internet for drug information but it does not hold any patient sensitive information. Powers are granted under the Misuse of Drugs Act 1971 to carry out these routine checks . The persons described above may take copies of documents or in some cases remove from the pharmacy premises original documents as part of their CD responsibilities under the Misuse of Drugs Act. Disclosure in these cases is specifically authorised by the law, and this overrides the duty to protect patient confidentiality. Information held in hardcopy or in electronic format must be protected but the safeguards may differ. The DSP Toolkit Compliance Service is a bespoke consultancy service that delivers a detailed review of your organisation’s data protection regime, recommended corrective actions for achieving full compliance with the 2019–20 DSPT standard, updates to any necessary documentation, support and guidance to improve your security … They want me to disclose the details of the medication that an individual in custody is taking. Toolkit completion: Question-by-question guidance (mandatory questions) – this can be used to work your way down the Toolkit … It is for a contractor to assess the risk they face based on local circumstances. Encryption supports the protection of information and therefore supports compliance with data protection legislation. Q. Does the IG lead have to be a named individual (for example âFred Bloggsâ) or can it be a position (for example âPharmacy Managerâ)? This would be for the contractor to decide and is outwith the scope of the NHS requirements. These guides take you through the definitions used in the standards, what the standards are asking of you, suggestions and examples of how this might be achieved, how this relates to common current practises, and useful resources. The Data Security and Protection Toolkit replaces the previous Information Governance toolkit from April 2018. A. We would recommend taking expert advice from your system supplier. This portal provides links to websites for all Local Pharmaceutical Committees (LPCs). General Practice however there may be alternative questions relevant to just your organisation type: Complete each question as instructed and click on Continue when answered. London To register for the IG Toolkit, I need to provide my email address. A. On the Information Governance Toolkit, there are fields linked to each requirement to record the location of evidence or to upload evidence. The intention of the âmobile numberâ field was to record mobile phone numbers however note that under this requirement, it is only necessary to track mobile phones that are being used to store personal information. Q. Find out the latest on pharmacy funding and NHS statistics. Historic Data Security and Protection Toolkit guidance and training, 7.1 Guidance carried over from the IG Toolkit, 9.1 e-Learning – data security awareness – frequently asked questions. Note, it is a legal requirement through data protection legislation to make “fair processing information” available. Although it is accepted that for practical reasons the role may need to be assigned to a position in some scenarios, where possible, best practice is that the lead is a named individual. To access this functionality, contact the Helpdesk (0845 3713671) with the name and address of the pharmacy head office. It is recognised however that this may take some time to achieve. By 31st March 2011, all pharmacies are required to make a leaflet available with comprehensive information on how patient information is used by the pharmacy. Q. I would like to arrange encryption of my laptop. This list of questions can be used in local training materials or incorporated into local e-learning solutions. The Data & Security Protection Toolkit, formerly Information Governance Toolkit, must be completed every year by all pharmacies and businesses who have access to NHS patient data and systems. It is not appropriate to provide the patientâs name without prior consent. 9 Guidance for Care Providers for the Data Security and Protection Toolkit Final version of this guidance willinclude: • ‘Tool tips’ guidance to accompany the assertions in the newtoolkit • An updated Guide for Registered Managers • An updated Guide for Staff • ‘Big Picture’Guides (overall view of 10 Data … Do I need to do this? The other instances that arise where police officers may visit the pharmacy is to collect CDs on behalf of patients who are held in police custody. Before disclosing patient data, pharmacists would need to satisfy themselves that the person requesting the data is properly authorised under the Misuse of Drugs Act and that the request for information is consistent with the carrying out of routine checks. Q. I have had a call from a local police station. Guidance on notification can be found on page 47 of the Pharmacy Contractor Workbook and the ICO have further information. User-friendly, this guide makes completing the updated Toolkit … Note some evidence will include commercially sensitive information and would therefore be inappropriate to upload. Q. Do they not have access to this through the Toolkit? If so, only the minimum amount of personal data necessary should be disclosed. Further to detailed negotiations on the work involved, the DHSC and PSNC agreed that over £23 million of this sum was to support the implementation of the IGT, which equates to over £2000 per pharmacy. For security reasons, local NHS England team’s record details of which forms were issued to which prescribers. The Online Toolkit Do I need to have a confidentiality clause in the contracts of third party contractors who don’t have access to patient identifiable information? Will funding be available in future years to reflect the ongoing costs in continuing to comply with the requirements? What do these refer to? A. The intention of including âasset numberâ in the template register was to provide a reference to link between the register and the asset itself for tracking purposes.
Unthinkable Software Salary,
Designing E- Learning Courses Pdf,
Golden Syrup Vs Molasses,
Prefix For Fed,
Maryland Cookies Vegan,
Coffee For Hair,
Healthy Breakfast Smoothie Recipes,