The organisation has a framework in place to support lawfulness, fairness and transparency (1.1)

It's a legal requirement to appoint a DPO if:

• you are a public authority or body
• your core activities require large scale, regular and systematic monitoring of individuals
• your core activities consist of large scale processing of special categories of data, such as health and care data

There is a tool on the ICO’s website to help you understand if you need to appoint a DPO.

The DPO:

• is an independent advisory role held by an expert in data protection
• informs and advises on your data protection obligations, data protection impact assessments (DPIAs) and monitors internal compliance
• acts as a contact point for data subjects and the Information Commissioner’s Office (ICO)
• must be adequately resourced and report to the highest management level
• must have sufficiently advanced abilities, as the nature of the health and care information your organisation uses will likely be particularly complex and high risk. In addition, the DPO must understand how relevant legislation and guidance for the health and care sector interacts, particularly the requirements of the common law duty of confidentiality. This may be demonstrated by their experience within health and care, and may be supplemented by professional qualifications in data protection
• must not have a conflict of interest that will prevent them from being able to provide independent advice on data protection. For example, the head of IT would not be an appropriate DPO appointment, as they have an interest in IT projects being approved
• can be an existing employee or externally appointed
• can be a single person shared between groups of smaller organisations

Find out more about DPOs on the ICO website.

The SIRO is a senior advocate for data security and protection matters at board-level. 

Their responsibilities include: 

• influencing the board to foster a culture that values, protects and uses information for the success of the organisation and benefit of its patients and service users
• staying informed about data security and protection risks, and managing those risks
• signing off key elements of the DSPT
• overseeing the development of information risk policies
• managing high severity cyber alerts and accepting appropriate residual risk
• providing leadership during a major incident or breach 
• taking ownership of the organisation’s risk assessment processes
• ensuring that the organisation’s approach to information risk is communicated to all staff and effective in terms of resource, commitment and execution  
• ensuring the organisation’s risk policy is implemented consistently by Information Asset Owners (IAOs)

The SIRO should be an Executive Director or other senior member of the board (or of an equivalent senior management group/committee). 

The role of SIRO may be assumed by the Chief Information Officer (CIO) if the CIO is on the board, however this would not be best practice. 

When cover is needed during times of absence, it is acceptable for another board member to act as SIRO delegate. 

However, neither the permanent post nor the temporary delegate position should be assumed by the Caldicott Guardian, as the SIRO should be part of the organisation's management hierarchy rather than being in an advisory role. 

For more information about how the SIRO can guide the board towards excellent standards in data security, see the NCSC board toolkit.

Also see 3.4.1 and 3.4.2 for cyber SIRO and board data security and protection training.

Caldicott Guardians are senior people within organisations that help ensure confidential information about health and social care service users is used ethically, legally, and appropriately.

They ensure that their organisation(s) satisfy the highest ethical and legal standards for processing the confidential information of patients, service users and staff members.

Their responsibilities include advising on disclosures of confidential information (particularly in situations of legal and/or ethical ambiguity), involvement in addressing patient or service user complaints, reviewing and advising on data protection documentation, contributing to audits and helping to investigate data breaches.

It's essential that the Caldicott Guardian is a person with the ability to apply the Caldicott Principles wisely, and has the courage to speak openly and with authority to their organisation’s highest level decision makers. All Caldicott Guardians need a strong commitment to the role. They need the inquisitiveness to question, analyse and challenge, and the ability to apply wise judgement to the precise circumstances of each case.

It's preferable for Caldicott Guardians to be experienced health and social care practitioners to facilitate their role as an advocate for patients and service users, and to act as the conscience of the organisation. However, this is not a mandatory requirement.

For smaller organisations where it may be difficult to identify an appropriate individual to perform this role, the Caldicott Guardian function may be provided by another organisation. For example, commissioning organisations might consider supporting smaller organisations. Also, a Caldicott Guardian may provide the role across multiple organisations if appropriate.

It may be appropriate in some organisations for the Caldicott Guardian and DPO roles to be held by the same individual, provided that they have the relevant background, knowledge and experience and that any conflicts of interest are managed openly and appropriately. However, it would not normally be appropriate for the same person to be both SIRO and Caldicott Guardian, due to the possibility of a conflict of interest and the decision-making role that the SIRO may hold.

Further guidance is available on the role, responsibilities and which organisations should appoint a Caldicott Guardian.

Information Governance (IG) Leads are representatives from senior management who co-ordinate and manage the IG work programme. 

It's recommended that the roles of DPO and IG Lead are carried out by different people in larger organisations. If the roles are carried out by the same person, there should be no conflict of interest between the duties of the IG Lead and those of the DPO. 

The following duties must be carried out, regardless of who assumes the role:

• ensuring effective management, accountability, compliance and assurance for all aspects of IG (data protection/privacy, confidentiality, freedom of information and subject access)
• ensuring that there is top level awareness and support for IG resourcing and implementation of improvements
• maintaining the appropriate documentation to demonstrate the organisation’s commitment to IG responsibilities and providing direction in formulating, establishing and promoting IG policies
• ensuring the annual DSPT assessment, associated audit and improvement plan are carried out, documented, approved and reported in line with the requirements of the NHS Standard Contract
• communicating the approach to information handling to ensure that staff understand the need to support appropriate information sharing
• ensuring that appropriate training is made available to all staff and completed as necessary to support their duties
• ensuring transparency so that the public are aware of how their information is used and shared
• liaising with other committees, working groups and programme boards in order to promote and integrate IG standards
• monitoring information handling activities to ensure compliance with law and guidance
• providing a focal point for the resolution and/or discussion of IG issue
• keeping up to date with IG and data security developments

This role can vary from a very technical one managing data controls to more a general security assurance developing and maintaining an Information Security Management System.

It can be a full-time role but is sometimes shared with other roles such as the IG Lead, or an IT Manager.

The role and characteristics of Information/Cyber Security Lead/Manager

There are no universally agreed responsibilities but typically these would include:

• informing and advising and implementing an organisation’s security strategy including the effectiveness of security controls
• monitoring compliance/certification with a range of legislation and standards which could include Network and Information Systems (NIS) Regulations, the security elements of UK GDPR and the Data Protection Act 2018, Cyber Essentials, ISO 27001 and the Data Security and Protection Toolkit (DSPT) itself
• responding and coordinating the response to high severity alerts and advisories
• responding to and coordinating efforts to security related incidents
• co-operating with NHS England, the ICO and National Cyber Security Centre (NCSC)
• being a champion and advocate for good information security practice in the organisation
• ensuring information security mandatory and role-based training is provided to staff

For useful resources for managing a cyber security incident, see our cyber and data security pages.

For industry guidelines see ISO 27001: Understanding Security Roles and Responsibilities and Why They Are Vital to the Success of Your Security Program - risk3sixty.

Each provider should ensure all systems are compliant with all relevant information standards published by NHS England on the Information Standards web pages and that their systems suppliers have implemented all applicable standards and are similarly compliant.

National definitions and guidance support the sharing, exchange and comparison of information across the NHS and other care providers. Common definitions, known as information standards, are used for commissioning purposes, to support comparative data analysis, for the preparation of performance tables, for data returns to the Department of Health and Social Care and also support clinical messages, such as those used for pathology and radiology.

National information standards should not just be seen as supporting the collection of data on a consistent basis throughout the NHS and other care providers. They also have an important role in supporting the flow and quality of information used, so that health and care professionals are presented with the relevant information where and when it is required to provide effective care and treatment to service users.

Organisations should ensure that:

• electronic systems have built in data quality checks which conform with, or map, to national data standards (where these exist)
• for the relevant service user information systems, where national data standard definitions and values exist
  - values on the key systems match the national standard definitions
  - no other values are used unless these are mapped explicitly for central returns
  - the number and combination of alpha/numeric digits within a code match the format of the NHS Data Dictionary and the code conforms or maps to a nationally determined coding structure (where these exist)

Organisations should also have policies/procedures to ensure:

• validation routines are used routinely on data entry to assure completeness and validity of datasets, both those used locally and for central returns
• standard definitions used in data schemas on key systems, checking all entries on the schema relating to these definitions against national definitions and codes
• monitoring in place to identify and resolve duplicate records

There are several key contractual and performance frameworks in place that have a data quality component within them designed to monitor and improve data quality at source.

These include:

NHS Standard Contract - Schedule 4, Service Condition 28 and Schedule 6 of the NHS Standard Contract each contain data quality elements. Schedule 4 contains metrics relating to completeness of the NHS Number and Ethnicity coding in national datasets such as the Secondary Uses Services (SUS) dataset and the Mental Health Services Dataset (MHSDS). Part B of Schedule 6 and Service Condition 28 defines how commissioners should use Data Quality Improvement Plans (DQIPs) to monitor critical data quality issues.

Single Oversight Framework - NHS Improvement’s Single Oversight Framework currently contains a Judgement Metric based on NHS England’s Data Quality Maturity Index (DQMI) for providers of Mental Health Services. This will be extended across other provider types in 2019/20.

Model Health System - NHS England and Improvement use the DQMI as a metric within the Model Health System series of metrics.

Care Quality Commission (CQC) Well-led Domain - The CQC collects data quality metrics through their Insight portal as part of the Provider Information Request (PIR) stage of an inspection. This includes the DQMI.

Each of the above frameworks should be reviewed to determine both national and local contractual and performance obligations relating to data quality including:

• monitoring of the DQMI is in place to ensure scores are held at recommended thresholds and issues identified and resolved
• establishing DQIPs where data quality issues are identified and monitoring these through appropriate contract review mechanisms to ensure improvements achieved
• any contractual obligations relating to data quality are ‘passed through’ to subcontractors and vendors alike

There are a number of externally published data quality reports and metrics that should be used to support local data quality assurance and improvement activities.

These include:

• the Data Quality Maturity Index (DQMI) published by NHS England and based on 8 key national datasets including the main three Commissioning Datasets (CDS), Mental Health Services Dataset (MHSDS) and the Maternity Services Dataset (MSDS)
• the CDS DQ dashboards published monthly by NHS England for the three Commissioning Datasets (CDS); Admitted Patient Care (APC), Outpatients (OP) and Emergency Care (ECDS) - registration is required
• the Hospital Episode Statistics (HES) Data Quality Notes published regularly by NHS England contains additional data quality information following additional processing on the three Commissioning Datasets (CDS) submitted through the Secondary Uses Service (SUS)
• national dataset specific data quality reports published at point of submission by NHS England through the Data Processing Service (DPS) for collections such as Mental Health Services Dataset (MHSDS), Maternity Services Dataset (MSDS) and the Community Services Dataset (CSDS) and Improving Access to Psychological Therapies (IAPT).  The Mental Health Data Hub contains a wealth of data quality reports, as does the Community Services Data Quality Dashboard
• dataset specific data quality reports (on both local and national datasets) processed by Data Services for Commissioners (DSfC) and issued via commissioning support units (CSUs) and supplied direct or via commissioners
• third party services from organisations who use open data published by NHS England and other health care bodies to provide benchmarking and clinical coding assurance tools

Organisations should use all available external resources to assure and improve the quality of their data by:

• downloading all available data quality reports to identify point of submission errors and correct prior to submission deadlines
• gaining access to applicable data quality dashboards to identify and correct additional data quality issues within a timely manner
• investigating other external data quality sources and adopting, where applicable

The above should be reflected in local data quality policies and procedures (see Internal Assurance) to ensure that data quality reports on the organisation's data from external sources are followed up and appropriate corrections made, with an effective feedback loop to staff to help prevent similar mistakes being made in the future.

The board/senior management or delegated sub-committee/group should be kept aware of progress. Action plans for improvement should be signed off by the delegated subcommittee/group or senior management, and appropriate resources will need to be applied to ensure the success of these.

A data quality improvement plan (DQIP) is a component of the NHS Standard Contract available to commissioners to detail known or emerging data quality issues within a provider’s national or local data flows and specify a set of corrective actions.

The commissioner can then use the established contract review process to monitor progress against the DQIP. Schedule 6 Part b of the NHS Standard Contract (Particulars) sets out the structure of a DQIP including what data quality issue is being measured, what the threshold of achievement is, how it will be measured, by when the threshold should be achieved and the consequences of not meeting it.

It is to be recommended to commissioners that from 2019/20 the Data Quality Maturity Index (DQMI) is included as standard in all DQIPs to provide focus on data quality and allow the use of existing contract review processes to monitor compliance.

Organisations must ensure that all data held in local systems and subsequently submitted to national systems conforms to the NHS Data Dictionary (where applicable).

The number and combination of alpha/numeric digits within a code must match the format specified in the NHS Data Dictionary and codes must conform or map to a nationally determined coding structure.

Organisations should ensure that all local systems have built in data quality checks which are conformant with, or map to, national Information Standards where these exist.

Point of entry validation should be applied to local systems and should be built into system supplier developments where possible.

All systems used to deliver healthcare, including third party supplier systems, locally developed systems or local configurations of third-party systems must be compliant with all relevant information standards and must conform to the NHS Data Dictionary.

For relevant service user information systems, where national data standard definitions and values exist, values used in these systems data schemas must match the national definitions and values. No other values should be used unless these are mapped explicitly for central returns.

Organisations should make use of all available tracing services, such as the Personal Demographic Service (PDS), to ensure a suitable level of accuracy is attained for person level data. Data items used for PDS tracing should be regularly assessed for quality to ensure the correct details are being traced.

Organisations should ensure that all data submitted through local and national data portals, such as the Secondary Uses Service (SUS+), Bureau Services Portal and Data Landing Portal accurately reflects the care a patient received.

Documented procedures should be in place for reporting on and analysing the quality of information in local systems prior to and after submission of central returns and reports.

This should include:

• reconciliation activities between data held in local clinical systems and reporting systems to ensure data extraction processes do not introduce data quality issues prior to submission
• regular monitoring of national and local data quality reports, with evidence of specific highlighted data quality issues being corrected or data quality improvement plans (see External Assurance) being put in place to resolve more complex issues
• regular monitoring of national data quality metrics such as the DQMI, CDS Data Quality Dashboards and associated key performance indicator (KPI) reports, with evidence of receipt and action taken to address key issues or data quality improvement plans (see External assurance) being put in place to resolve more complex issues

Where data quality monitoring is undertaken by a third party on behalf of the organisation, such as a shared health informatics service, then the precise roles and responsibilities of all parties should be clearly documented within a service level agreement (SLA). Third party assurance statements should be sought from the auditors of the service provider on the controls in place for data quality at the service.

Organisations should have procedures for handling incidents relating to their data, including data quality issues, and these should be defined within the organisations Data Quality Policy (see Internal Assurance).

Incident systems should be used to capture all relevant details relating to reported incidents allowing for audit, learning and review to be completed on reported incidents.

All data quality related incidents should be investigated by the Data Quality Team (or equivalent) and reviewed by the Data Quality Steering Group (or equivalent) to ensure that lessons learned are used to inform updates to the Data Quality Policy, systems configuration and/or staff training. The Caldicott Guardian for an organisation should regularly review all data quality incidents and provide additional guidance on specific incidents where appropriate.

All staff should receive appropriate data quality training and awareness sessions to ensure that they understand the importance of collecting and recording complete and accurate information to minimise the risks to the service user and to the organisation itself. The use of examples and scenarios may be particularly useful to ensure that a basic level of competence has been achieved before access to the systems is allowed.

Some staff within organisations may be required to have higher levels of awareness relating to data quality to carry out their duties. Where this is the case appropriate additional training should be provided according to staff job roles, level of access to person identifiable information and responsibilities for processing/managing records.

The training programme must cover all aspects of data quality including:

• the definition of individual data items - so that staff know what they are recording
• the eventual use of data – so staff understand what the data they are recording will eventually be used for (and therefore why it is important to record accurately)
• the function of data items – so staff know the purpose of recording
• how to validate data with the service user or against the health and care record – so checks are carried out to confirm the accuracy of data

The need for data quality training should be reflected in the organisation’s Data Quality Policy (see Internal assurance) and compliance monitored through the Data Quality Steering Group (or equivalent) who should also regularly review the training material to ensure it is up-to-date.

Each organisation should have a Data Quality Policy be that a standalone document or part of a wider IT governance policy. The policy may also be referenced from other related policies such as that for information governance or records management. The policy should detail data quality related responsibilities for all staff directly involved in the collection and input of clinical and non-clinical data.

The data quality policy should, as a minimum, include:

• purpose and scope of the policy: its intended use and what and who it covers
• key principles: defines the underlying drivers for data quality, links to organisational objectives/values and links to other key organisational strategies and policies
• roles and responsibilities: defines the key roles covered by the policy from the board downwards and their respective responsibilities in delivery against the policy
• data quality standards and audit: defines what data quality is in the context of the organisation and how it will be assured
• data standards: makes reference to internal and external assurance resources such as the NHS Data Dictionary and Data Security and Protection Toolkit
• measurement of good data quality: defines what dimensions will be used to measure data quality, such as completeness, validity and integrity
• validation and quality assurance: details all the internal and external resources that will be used to assure data quality, such as DQMI, SUS Data Quality Dashboards, submission data quality reports and benchmarking tools
• training and support: details what training is available/mandated for data quality
• supporting documentation: lists internal standard operating procedures and other policies that directly impact data quality
• monitoring data quality: defines how data quality is monitored and through which groups/boards it will be reported
• communication: details which channels will be used to communicate on data quality issues
• policy dissemination and implementation: defines how the policy will be shared
• monitoring policy compliance and effectiveness: defines through what processes and activities the organisation will monitor compliance with the policy

To support the data quality policy (or in some instances to create the policy in the first instance) there should be a formal group established to review and monitor compliance with the policy. This may take the form of a data quality steering group or a sub-group within the established IT governance structure such as an information governance group.

The group should have in place a formal terms of reference that sets out the:

• purpose: the strategic objectives of the group as informed by the data quality policy
• duties and responsibilities: what it will monitor, discuss and take decisions on in the context of data quality
• accountability: who in the organisational governance structure it is accountable to, such as information governance group
• links to other groups: what other groups or boards it has dependencies on or have dependencies on it within the organisation - for example, health records management group
• membership: list of members including the Chair and Secretary and what constitutes a quorate meeting
• inputs and outputs: what the main inputs and outputs are of the meeting and their respective contributors and recipients
• frequency of meetings: how often the group will meet and any dependencies/constraints

Depending on the size of the organisation there may be the need/opportunity to create a dedicated data quality team either within the information services department or within a quality/performance structure.

The scope and responsibilities of the team should include:

• policy: contributing to the development and implementation of data quality related policies
• process: defining data quality processes in line with the data quality policy
• reporting: collating and actioning data quality reports issued by NHS England (national flows) or Data Services for Commissioners Regional Offices (DSCRO)/commissioning support unit (CSU) (local flows) as appropriate
• metrics: monitoring of key performance indicators (KPIs) and other performance related metrics such as the DQMI for underlying data quality issues
• improvement: delivering against DQIPs as defined by clinical commissioning groups (CCGs) or NHS England (Specialist Commissioning) and as identified through internal sources
• governance: attending the data quality steering group (or equivalent) as required
• incidents: investigating root cause of data quality incident investigation (from incident system) and feeding learning into training and/or systems validation as appropriate
• training: defining data quality related training requirements (from central sources or through incident management) and delivering regular training to staff
• expertise: providing subject matter expertise on all national and local data flows