Information Governance Annual Report
1 This brief report summarises the results of the Information Governance Toolkit
submission presented by the PCT in March this year and in addition the other main
IG developments which have occurred in the past year.
2 Connecting for Health (CfH) helpfully sets out the objective of Information
“Information governance allows organisations and individuals to ensure that personal
information is handled legally, securely, efficiently and effectively, in order to deliver
the best possible care. It also enables organisations to put in place procedures and
processes for their corporate information that support the efficient location and
retrieval of corporate records where and when needed, in particular to meet requests
for information and to assist compliance with corporate governance standards”.
3 Information Governance provides a framework to bring together all of the
requirements, standards and best practice that apply to the handling of information.
4 Attached is a summary of the outcome of the IG Toolkit submission made in March
2008. Completion of the Toolkit is mandatory on all NHS organisations. The result
was 63% which once more gave the PCT an amber status score. This represented a
12% increase on the PCT’s score for 2006/07 and can be considered a good
performance given the impact of the reorganisation of the three PCT’s during the first
half of 2007 and the short-term resource issues which resulted. Once more there
was quite considerable variance in performance across the six areas of the Toolkit.
The PCT scored over 70% in the both the Information Governance Management and
Secondary Uses Assurance sections which represents a green status. However the
Corporate Records Assurance section score which remains at red status continues to
be a cause for some concern.
5 Overall the PCT’s performance this year is indicative of the general trend amongst
other Greater Manchester PCTs and the percentage increase achieved this year
should almost certainly allow for a further increase to over 70% and a green status for
Statement of Compliance
6 In addition to the completion of the IG Toolkit the PCT was also obliged to meet all of
the requirements of the Statement of Compliance in order to maintain the connection
to the N3 Network and/or NHS CfH digital services. The PCT was able to confirm it’s
compliance with these requirements prior to the deadline and Connecting for Health
have confirmed that the Trust can maintain the N3 connection.
7 Following the high profile loss of personally identifiable data by a number of Public
Sector organisations, NHS Chief Executive; David Nicolson wrote to all Trusts
requiring that each carry out a data mapping exercise of all the flows of personally
identifiable information in and out of their organisations. In addition he asked each stTrust to provide assurance to SHA’s by 31 March 08 that all such flows were secure
and risks had been mitigated. Manchester PCT conducted a full audit of data flows
with the co-operation of each Directorate and assurance was provided to the SHA by
the deadline. However as the Board previously felt some transfers of patient data
were essential for patient care and could not be halted before the risks could be fully
mitigated these transfers continue in the short term with the Board’s approval. An
encryption tool will provide the long term solution to these outstanding issues and it is
hoped this will also ensure personally identifiable information can be transferred more
efficiently while simultaneously ensuring security is maintained. The PCT is currently
responding to the national procurement of the McAfee Safeboot encryption tool made
by Connecting for Health. The PCT is now in the final stages of purchasing the
licences for this product and should be in a position to begin the roll out of the tool in
early May with those services at higher risk forming a high priority group for early
IG Sub Group
8 IG is co-ordinated by the IG sub-group which meets on a bi-monthly basis and is
chaired by the Assistant Director Corporate Governance and Risk. Membership
includes the Trust’s Caldicott Guardian, the Operational Risk Manager, the Head of
Clinical Governance for MCH and the Associate Directors of IT Infrastructure and
IM&T Programmes. The group continues to explore a number of operational issues
including the discussion of incidents involving IG. The Sub-Group has also recently
approved the PCT Confidentiality Policy and has agreed to continue to be the forum
for discussion and approval for IG of policies and procedures.
IG Support Capacity
9 Whilst IG is everyone’s responsibility, specialist expertise is available to the PCT. The
Caldicott Guardian role remains in the Medical Directorate. In the new PCT structure
there are two full-time IG posts. Currently the post of IG Manager is vacant. The
Corporate Services Manager continues to have responsibility for corporate records
management and Freedom of Information requests. Clearly the IG Manager vacancy
has had some affect on the overall resources available to support staff but this should
be resolved in the near future.
10 The amber result in this year’s IG Toolkit clearly provides the PCT with the target of
increasing this to above 70% and a green result next year. There are a number of
areas requiring action particularly centring on those requirements where the score
has not increased above a level 1; these requirements are mostly found within the
Data Protection and Confidentiality and Corporate Records Management sections.
Therefore increasing the scores in these areas will be a particular priority in the
coming year and this should be a very achievable target which will ultimately lead to a
fairly significant uplift in the PCT’s overall Toolkit status.
11 The purchase of the IG module of the Performance Accelerator should also provide
for a more co-ordinated approach to the completion of the IG Toolkit.
12 The PCT has a number of challenges and risks around IG areas as set out in the
Corporate Affairs Risk Register. The recent work completed on data flow mapping
and the advances made in IG Toolkit performance provide very real opportunities for
a continued improvement in PCT performance in this in increasingly high profile area.
Information Governance Officer