Principle E3: Using and sharing information

The organisation uses and shares information appropriately.

Description

You lawfully and appropriately use and share information for direct care.

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework.

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

Assessing applicability – if an organisation has determined that outcome E3.a is not relevant because they do not use or share information for ‘direct care’, obtain evidence of the process the organisation has undergone to arrive at this determination. If you are satisfied that none of the organisation’s uses of information are for ‘direct care’, they can declare ‘Achieved’ for this outcome and it is not necessary to further audit the steps outlined below.

1. Policies and procedures - obtain and inspect documents provided by the organisation showing how they manage information sharing for direct care and assess whether they cover:

1. Direct care information sharing the organisation routinely engages in as part of providing its essential services, including categories of organisations and individuals who information is shared with. (A#2, A#6)
2. Health and care staff and support staff knowing that they should ask for advice from the Caldicott Guardian or IG team when dealing with difficult direct care information sharing requests. (A#2, A#6)
3. How the organisation ensures information sharing is relevant and proportionate. (A#3)
4. How the organisation ensures individuals’ reasonable expectations and right to respect for a private life are considered in sharing decisions where relevant. (A#4)
5. A process to enable appropriate non-routine ad hoc data sharing for direct care. (A#5)

2. Staff awareness - obtain evidence of how the organisation:

1. Identifies relevant staff roles who need to have an understanding of processes for direct care information sharing. (A#1)
2. Makes relevant staff aware of scenarios where they should share information for direct care. (A#1, A#2)
3. Makes relevant staff aware of scenarios where they should escalate direct care information sharing decisions to IG team or equivalent. (A#1, A#2)
4. Makes relevant staff aware of their obligation to only share information which is proportionate and relevant. (A#3)

3. Data sharing arrangements - verify that:

1. The organisation has agreed internal thresholds for direct care information sharing, which, when met, trigger a review of whether an arrangement such as a data sharing agreement, a sharing framework, a Data Protection Impact Assessment (DPIA), etc. is needed or would be beneficial. (A#6)
2. The organisation has procedures for ensuring that sharing arrangements for direct care appropriately cover the nature of the information being shared, ensuring sharing is appropriate and proportionate, and clarifying roles and responsibilities in the sharing. (A#3, A#6)

Suggested documentation includes: 

• evidence of policies and procedures for direct care information sharing
• training needs analysis and materials used for staff awareness
• documents related to data sharing arrangements for direct care

Description

You lawfully and appropriately use and share information for purposes outside of direct care.

Expand the achievement levels to find out the requirements needed to meet each level.

As documented in the introduction to this framework, independent assessors are expected to use their professional judgement when assessing organisations against the Cyber Assessment Framework.

The approach and documentation list described below provides guidance on how to conduct testing and should be adapted as appropriate in order to assess whether the NHS providers outcomes are effectively achieved.

1. Policies and procedures - obtain and inspect documents provided by the organisation showing how they manage information sharing for purposes outside of direct care and assess whether they cover:

1. Scenarios where information sharing for purposes outside of direct care can be handled by non-IG staff roles. (A#2)
2. Scenarios where information sharing for purposes outside of direct care requires escalation to IG team or equivalent. (A#2)
3. How considerations around the common law duty of confidentiality, UK GDPR and individuals’ right to respect for a private life are factored into decision-making before information is shared. (A#2)

2. Staff awareness - obtain evidence of how the organisation: 

1. Identifies relevant staff roles who need to have an understanding of processes for non-direct care information sharing. (A#1) 
2. Makes relevant staff aware of scenarios where they should share information for non-direct care purposes, ensuring information is relevant and proportionate. (A#1)
3. Makes relevant staff aware of scenarios where they should escalate non-direct care information sharing decisions to IG team or equivalent. (A#1)
4. Makes relevant staff aware of scenarios where they may need to communicate non-direct care information sharing decisions to patients and service users. (A#3)

3. Communicating to individuals - obtain and inspect the organisation’s privacy information or equivalent, assessing whether it appropriately covers situations where information may be used or shared for purposes outside of direct care. (A#3)

4. Disclosure log - obtain and inspect the disclosure log if relevant, and assess whether it lists the requests for individuals’ information for purposes outside of direct care. This document should also include the result of the decision, the accountable owner for the decision, lawful basis for making this decision and the length of time for which the sharing agreement may last. (A#4)

Suggested documentation includes: 

• evidence of policies and procedures for non-direct care information sharing
• training needs analysis and materials used for staff awareness
• privacy information or equivalent
• documents related to data sharing arrangements for other purposes outside of direct care
• disclosure log