Purpose

This document sets out how the practice manages information governance at a high level and directs staff to the relevant detailed policies that govern data protection, confidentiality, records management and IT systems. The practice is committed to ensuring that all patient, staff and business information is handled lawfully, securely and confidentially.

​

Scope

This policy applies to:

• All staff (permanent, temporary, agency, trainees)

• Contractors and third parties handling practice information

• All information held in any format (paper, electronic, images, recordings)

​

Information Governance Framework

Information governance within the practice is delivered through a suite of policies, procedures and controls that together ensure compliance with legal and regulatory requirements.

​

These include:

• Data Protection Policy

• Data Security Policy

• IT & Communications Systems Policy

• Records Management, Record Keeping & Retention Policy

• Business Continuity Policy

​

Key Principles

The practice ensures that information is:

• Processed lawfully, fairly and transparently

• Used only for legitimate purposes

• Limited to the minimum necessary

• Accurate and kept up to date

• Retained only for as long as necessary

• Protected against unauthorised access, loss or disclosure

Accountability is demonstrated through training, audit and incident management.

​

Legal and Regulatory Framework

The practice complies with:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018

• Common law duty of confidentiality

• Caldicott Principles

• Care Quality Commission (CQC) requirements

​

Roles and Responsibilities

​

Data Controller

Has overall responsibility for information governance compliance.

​

Data Protection Lead

Oversees data protection arrangements and acts as a point of contact for data protection matters.

​

All Staff

Are responsible for handling information in line with training and the relevant policies and must report concerns or breaches immediately.

​

Confidentiality and Patient Information

Information is shared only on a need-to-know and lawful basis.

All security, access control, data sharing and breach management arrangements are detailed in the relevant supporting policies.

​

Training, Monitoring and Review

• All staff receive mandatory information governance training – this is recorded within the DCME Training Matix

• Compliance is monitored through audits and incident reviews

• This summary and associated policies are reviewed annually or sooner if required by changes in law or guidance

​

Related Policies

Please refer to the following for full operational detail:

• Data Protection Policy

• Data Security Policy

• IT & Communications Systems Policy

• Records Management, Record Keeping & Retention Policy

• Business Continuity Policy