Local Authority Version 14.1 (2017-2018)

Requirements List

Req No	Description
Information Governance Management
14.1-144	There is an adequate Information Governance Management Framework to support the current and evolving Information Governance agenda
14.1-145	There are approved and comprehensive Information Governance Policies with associated strategies and/or improvement plans
14.1-146	Formal contractual arrangements that include compliance with information governance requirements, are in place with all contractors and support organisations
14.1-147	Employment contracts which include compliance with information governance standards are in place for all individuals carrying out work on behalf of the organisation
14.1-148	The training needs of all staff are assessed in relation to Information Governance requirements and they are all appropriately trained
Confidentiality and Data Protection Assurance
14.1-251	The Information Governance agenda is supported by adequate confidentiality and data protection skills, knowledge and experience which meet the organisation’s assessed needs
14.1-252	Staff are provided with clear guidance on keeping personal information secure and on respecting the confidentiality of service users
14.1-253	Personal information is shared for care but is only used in ways that do not directly contribute to the delivery of care services where there is a lawful basis to do so and objections to the disclosure of confidential personal information are appropriately respected
14.1-254	Individuals are informed about the proposed uses of their personal information
14.1-255	Where required, protocols governing the routine sharing of personal information have been agreed with other organisations
14.1-256	All new processes, services, information systems, and other relevant information assets are developed and implemented in a secure and structured manner, and comply with IG security accreditation, information quality and confidentiality and data protection requirements
Information Security Assurance
14.1-371	The Information Governance agenda is supported by adequate information security skills, knowledge and experience which meet the organisation’s assessed needs
14.1-372	A formal information security risk assessment and management programme for key Information Assets has been documented, implemented and reviewed
14.1-373	There are documented information security incident / event reporting and management procedures that are accessible to all staff
14.1-374	Operating and application information systems (under the organisation’s control) support appropriate access control functionality and documented and managed access rights are in place for all users of these systems
14.1-375	All transfers of hardcopy and digital person identifiable and sensitive information have been identified, mapped and risk assessed; technical and organisational measures adequately secure these transfers
14.1-376	Business continuity plans are up to date and tested for all critical information assets (e.g. data processing facilities, communications services and data) and service - specific measures are in place
14.1-377	Procedures are in place to prevent information processing being interrupted or disrupted through equipment failure, environmental hazard or human error.
14.1-378	Information Assets with computer components are capable of the rapid detection, isolation and removal of malicious code and unauthorised mobile code
14.1-379	Policy and procedures are in place to ensure that Information Communication Technology (ICT) networks operate securely
14.1-380	Policy and procedures ensure that mobile computing and teleworking are secure
14.1-381	There is an information asset register that includes all key information, software, hardware and services
14.1-382	All information assets that hold, or are, personal data are protected by appropriate organisational and technical measures
14.1-383	The confidentiality of service user information that is not involved in the process of providing direct care is protected through use of pseudonymisation and anonymisation techniques where appropriate
Care Records Assurance
14.1-441	The Information Governance agenda is supported by adequate information quality and records management skills, knowledge and experience
14.1-442	There is consistent and comprehensive use of the NHS Number in line with National Policy requirements
14.1-443	Procedures are in place to ensure the accuracy of service user information on all systems and /or records that support the provision of care
14.1-444	Procedures are in place for monitoring the availability of paper service user records and tracing missing records