Safe Haven Supplementary Guidance V2

Safe Haven – Supplementary Guidance v2

DOCUMENT STATUS: / Ratified
DOCUMENT RATIFIED BY: / Governing Body
DATE ISSUED: / September 2014
DATE TO BE REVIEWED: / September 2016

AMENDMENT HISTORY: VERSION DATE AMENDMENT HISTORY

VERSION / DATE / AMENDMENT HISTORY
1 / Approved version
2 / 12.11.2014 / Coroner GSi email address added

REVIEWERS:

NAME / TITLE/RESPONSIBILITY / DATE / VERSION
Gina Holmes / Information Governance lead / 13.06.2014 / 0.1
Elaine Moss and David Harper / Chief Nurse and Corporate Governance Manager / 30.07.2014 / 0.2

APPROVALS:

NAME / SIGNATURE / TITLE/RESPONSIBILITY / DATE / VERSION
Amanda Sullivan / Chief Officer / 04.09.2014 / 1
Gina Holmes / Corporate Governance Officer / 12.11.2014 / 2
Gina holmes / Corporate Governance Officer / 02.06.2015 / 3

Contents

Contents...... 2

1. Fax machines...... 3

2. Post …………………………………………………………………………………………… 4

2.1 Internal post ……………………………………………………………………………… 4

2.2 External post...... 5

3. Telephones and answer phones...... 6

4.Electronic mail...... 6

4.1Corporate email accounts i.e. ………………………………………………………………………………………………..… 6

4.2NHSmail email accounts …………………...... 7

5. Removable media e.g. memory sticks, laptops, CDs, DVDs...... 10

6. Appendices …………………………………………………………………………………..

Definitions……………………………………………...... 11
Fax Cover Sheets ………………………………………………………………..…..….. 15
Safe Haven Email Addresses ……………………………………………………….….. 16
Encrypted USB Application Form ………………………………………..………………21
How to add NHSmail into Microsoft Outlook ………………………………………..… 22
Accessing Microsoft Office from an NHIS PC that is not your usual device …..…… 23

All flows of Personal Confidential Data and Corporate Sensitive data should be subject to a risk assessment, and procedures should be in place to ensure receipt at a secure and protected point.

FAX MACHINES

Personal confidential data should only be faxed in exceptional circumstances. The following procedures must be followed:

ensure that fax machines are switched off outside office hours;
always contact the recipient before sending a fax;
ensure that the fax machines are located in secure areas at both ends of the transmission;
double check the fax telephone number with the recipient;
use pre-programmed numbers wherever possible to avoid misdialling, and ask a colleague to double check manually entered numbers;
use a fax cover sheet in appendix 1 .This will let anyone know who the information is for and whether it is confidential without them having to look at the contents;
complete all fields on the fax cover sheet;
do not include personal confidential data on the fax cover sheet;
include the number of pages to be transmitted (including the cover sheet)
ensure the safe receipt of the fax immediately;
clinical information must be sent using the NHS number only i.e. do not include name, date of birth, address; and
faxes must not be left unattended.

INTERNAL AND EXTERNAL POST
Internal Post

Items that are not marked with a name or department, and are not labelled as private and confidential, take to a member of the corporate governance administration team to establish to whom it belongs.

Post holders who normally receive personal confidential data mail must ensure that adequate arrangements are in place to take receipt of mail during periods of holidays and sickness.

Incoming Post:

Staff sorting post will ensure all personal confidential data is delivered to the named individual;
must be opened by the addressee or anyone other than the addressee who is appropriately authorised to do so;
be aware of your surroundings and open away from the general public and other areas where employees do not have a legitimate/legal basis for accessing; and
do not leave unattended on the desk or pass to anyone else if the recipient is not available.

Outgoing Post:

Avoid sending large amounts of personal confidential data by mail. If this is absolutely necessary include a return address
confirm the name, department and address of the recipient;
seal the information in a robust envelope using strong wrapping tape;
mark the envelope Private and Confidential;
where appropriate send the information by Special Delivery or deliver by hand; and
do not leave unattended on the desk or pass to anyone else if the recipient is not available.

2.2External Post

Items that are not marked with a name or department, and are not labelled as private and confidential, take to a member of the administration team to establish to whom it belongs.

Post holders who normally receive personal confidential data mail must ensure that adequate arrangements are in place to take receipt of mail during periods of holidays and sickness.

Incoming mail:

Staff sorting post will ensure all personal confidential data is delivered to the named individual;
must be opened by the addressee or anyone other than the addressee who is appropriately authorised to do so;
be aware of your surroundings and open away from the general public and other areas where employees who do not have a legitimate/legal basis for accessing; and
do not leave unattended on the desk or pass to anyone else if the recipient is not available.

Outgoing mail:

Avoid sending large amounts of personal confidential data by mail. If this is absolutely necessary include a return address;
confirm the name, department and address of the recipient;
seal the information in a robust envelope using strong wrapping tape;
mark the envelope Private and Confidential;
where appropriate send the information by Special Delivery or deliver by hand; and
do not leave unattended on the desk or pass to anyone else if the recipient is not available.

TELEPHONE/ANSWER PHONES

If the use of a telephone is essential to convey the information then the following security protocols must be adhered to:

Ensure you are in an area where your conversation cannot be overheard;
confirm the name, job title, department and organisation of the person requesting the information, ensuring that you are speaking to the correct person;
take a contact telephone number e.g. main switchboard number (never a direct line or mobile telephone number);
ring back to confirm that person’s identity;
confirm the reason for the request; and
ensure that the enquirer has a legitimate right to have access to the information before information is given out and provide information only to the person who has requested it.

ELECTRONIC MAIL (email)

4.1 Corporate email accounts only i.e.

Incoming -This account is not suitable for processing personal confidential data.

CCG employees in the 5 local CCGs (M&A, N&S, NNE, NW and Rushcliffe) should only send and receive personal confidential data via NHSmail (). The generic statement below should be used to inform the sender that this is not secure.

We have received personal confidential data to a non-secure email address. PCD cannot be sent to a CCG email address i.e. this is not secure.

In order for a transfer of PCD to be encrypted and secure, it must be sent and received to an nhs.net account or Government Secure Intranet email address only i.e. , , , , , , , , . Please get in touch with your usual contact at XXXXX to discuss and agree future alternative arrangements.

Outgoing-This account is not suitable for processing personal confidential data.

It is the responsibility of all staff to ensure that contractors, committee members, temporary staff and external agencies have been provided with a copy of this procedure.

Do not send emails containing personal confidential data to any device that has not been supplied to you through work i.e. your personal pc, iPad, iPhone, Smartphone etc. All users of NHSmail must comply with the Acceptable Use Policy presented to them when they register.

4.2 NHSmail email accounts onlyi.e.

Emails sent to other NHSmail users or Government Connect Secure Extranet[1] accounts are secure.

Incoming - This account is suitable for processing personal confidential data.

Personal confidential data must be received using either of the following 2 methods:

1between NHSmail i.e. and NHSmail accounts i.e. .

2between NHSmail i.e. and Government Secure intranet accounts:

Outgoing – This account is suitable for processing personal confidential data.

Personal confidential data should only be sent following the instructions below.

When you start to type in the name of the recipient, some email software will suggest similar addresses you have used before e.g. ‘Gina’ - the automatic complete function may return several ‘Gina’s’.

Ensure you:

select the correct individual;
verify the recipient(s) email address by sending a test email;
ask the recipient to confirm that no unauthorised persons have access to the mailbox;
check the email addresses of the recipient(s) in the ‘To’, ‘Cc’ and ‘Bcc’ fields;
if you want to send an email to a recipient without revealing their address to other recipients, make sure you use blind carbon copy (bcc), not carbon copy (cc). When you use cc every recipient of the message will be able to see the address it was sent to;
if sending to multiple recipients use a distribution list that is reviewed on a regular basis i.e. quarterly, new starters and leavers;
ensure that the distribution lists contain only those individuals who are authorised to receive the information; and
mark the email as ‘Confidential’ using the 2 steps below.

Include ‘Confidential’ in the subject header
do not include personal confidential data in the subject header;
check the email addresses of the recipient(s) in the ‘To’, ‘Cc’ and ‘Bcc’ fields;
if sending to multiple recipients use a distribution list that is reviewed on a regular basis i.e. quarterly, new starters and leavers;
ensure that the distribution lists contains only those individuals who are authorised to receive the information;
include the minimum amount of personal confidential data that is required for the purpose;
password protect attachments that are being sent to NHSmail accounts only; and
do not password protect attachments that are being sent to GCSX accounts[2]

Incoming

Transfers the personal confidential data to a secure location i.e. shared drive and delete the email.

REMOVEABLE MEDIA

Removable media i.e. usb sticks should only be used to process personal confidential data as a last resort. Under normal circumstances personal confidential data should be processed on corporate systems i.e. shared drives, and exchanged using appropriately protected and approved information exchange connections i.e. NHSmail.

If you require an encrypted usb stick i.e. Safestick to process personal confidential data you will need to request a device, please see appendix 3.

GOOD PRACTICE

Have a ‘clear-desk’ policy when you are not working in the office;
do not allow unauthorised people into areas where personal confidential data is kept unless supervised;
always check for identification and view ID badge (smartcard not suitable);
consider scanning hard copy information, securely destroying the originals and transferring the electronic records to the shared drive;
ensure work station screens are sited so that unauthorised people cannot see them i.e. make sure they cannot be seen through windows;
activate a password protected screen saver when unattended;
do not share your passwords with anyone;
change passwords regularly i.e. every 90 days;
do not write passwords down; and
regularly review access privileges to systems, these should be kept to a minimum (e.g. administrator access to the system).

APPENDIX 1- DEFINITIONS

Unless a contrary intention is evident or the context requires otherwise, words or expressions contained in this document shall have the same meaning as set out in the National Health Service Act 2006 and the Health & Social Care Act 2012 or in any secondary legislation made under the National Health Service Act 2006 and the Health & Social Care Act 2012 and the following defined terms shall have the specific meanings given to them below:

Board (Governing Body) / means the Chair, Executive Members and Non-executive Members of NHS Mansfield and Ashfield Clinical Commissioning Group and NHS Newark and Sherwood Clinical Commissioning Group collectively as a body.
Chair / means the person appointed by the Secretary of State for Health under paragraph 2(1) of Schedule A1 of the NHS Act 2006, to lead the Board and to ensure that it successfully discharges its overall responsibility for NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group as a whole. The expression “the Chair” shall be deemed to include the Vice-chair if the Chair is absent from the meeting or is otherwise unavailable.
Chief Officer / means the chief executive of NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group appointed pursuant to paragraph 3 of Schedule A1 of the NHS Act 2006.
Clinical Commissioning Group/CCG / means a body established in accordance with section 1 of the NHS Act 2006.
Committee / means a committee appointed by the Governing Body, which reports to the Governing Body.
Committee Member / means a person appointed by the Board to sit on or to chair a specific Committee.
Corporate Sensitive Data / Any data not relating to individuals that according to organisational policy may affect the business or commercial interests of the organisation”. This is information that if disclosed could harm or damage the reputation or image of the organisation. This information will be watermarked as confidential.
Employee / means a person paid via the payroll of NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group, or for whom NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group has responsibility for making payroll arrangements, but excluding Non-executive Members.
Executive Member / means a Member of the Board who is appointed under paragraph 3 of Schedule A1 of the NHS Act 2006.
HSCA 2012 / means Health & Social Care Act 2012.
Member / means a Non-Executive Member or Executive Member of the Board as the context permits. Member in relation to the Board does not include its Chair.
NHS Act 2006 / means National Health Service Act 2006 (as amended).
Non-executive Director / means a Non-executive Member of NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group.
Non-executive Member / means a Member of the Board who is appointed under paragraph 2(1)(a) and 2(1)(b) of Schedule A1 of the NHS Act 2006.
Officer / means an Employee of NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group or any other person holding a paid appointment or office with NHS Mansfield and Ashfield Clinical Commissioning Group and/or NHS Newark and Sherwood Clinical Commissioning Group.
Personal Confidential Data (PCD) / This is a term used in the Caldicott Information Governance Reviewand describes personal information about identified or identifiable individuals, which should be kept private or secret and includes dead as well as living people.
The review interpreted 'personal' as including the Data Protection Act definition of personal data, but included data relating to the deceased as well as living people, and 'confidential' includes both information 'given in confidence' and 'that which is owed a duty of confidence' and is adapted to include 'sensitive' as defined in the Data Protection Act.
Personal data / Personal data means data which relate to a living individual who can be identified –
a) from those data, or
b) from those data and other information which is in the possession of, or is likely to
come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of the individual
Processing / In relation to information or data means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including:
a) organisation, adaptation or alteration of the information or data;
b) retrieval, consultation or use of the information or data;
c) disclosure of the information or data by transmission, dissemination or otherwise making available; or
d) alignment, combination, blocking, erasure or destruction of the information or data.
Sensitive Personal Data / Personal data consisting of information as to -
a) the racial or ethnic origin of the data subject,
b) his political opinions,
c) his religious beliefs or other beliefs of a similar nature,
d) whether he is a member of a trade union (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992),
e) his physical or mental health or condition,
f) his sexual life,
g) the commission or alleged commission by him of any offence, or
h) any proceedings for any offence committed or alleged to have been committed by
him, the disposal of such proceedings or the sentence of any court in such
proceedings.

APPENDIX 2- Fax Cover Sheet

APPENDIX3 –Safe Haven Email addresses

Organisation / Secure email address
Coroner /
EdwinstoweHealth Centre
High Street, Edwinstowe, Nottinghamshire, NG219QS /
Focus independent adult social work
Olympia House, 5 Saxon Court, Gilbey Road, Grimsby Safeguarding Adults Team – North East Lincolnshire /
Safeguarding team (Nottinghamshire Healthcare NHS Trust)
Newark Health Centre, 14-22 Portland Street, Newark, Notts, NG24 4XF and Child Development Centre, City Hospital Campus, Hucknall Road, Nottingham, NG5 1PB / or

NHS Mansfield and Ashfield Clinical Commissioning Group and General Practice

Organisation / Secure email address
Acorn Medical Practice – C84679 /
Ashfield House – C84067 /

Ashfield Medical Centre – C84712 /
Brierley Park Medical Centre (previously Huthwaite Health Centre) /
Bull Farm Primary Care Resource Centre – C84710 /
Drs Law and Mountcastle (Churchside Medical Practice) – Y02977 / Drs now left Practice and work at Orchard Medical Practice
Drs Ward, Pearce and partners (Churchside Medical Practice) – C84020 /

Forest Medical (Oak Tree Lane Surgery & Rosemary Street Health Centre) /
Harwood Close Surgery – C84061 /
Healdswood Surgery – C84114 /
Jacksdale Medical Centre – C84654 /
Kirkby Community Primary Care Centre – Y02181 /
Please double check this before use
Kirkby Family Medical Centre – C84074 /
Kirkby Health Care Complex – C84629 /
Kirkby Health Centre – C84076 /
Kirkby Surgery – C84140 /
Mansfield & Ashfield Clinical Commissioning Group (Accredited Safe Haven) /
Mansfield & Ashfield Clinical Commissioning Group (safeguarding) /
Meden Vale Medical Centre – C84658 /
Millview Surgery – C84106 /
Oakwood Surgery – C84016 /
Orchard Medical Practice – C84051 /
Pleasley Surgery – C84057 /
Riverbank Medical Services – C84127 /
Roundwood Surgery – C84069 /
Sandy Lane Surgery – C84637 /
Selston Surgery – C84142 /

St Peter’s Medical Practice – C84031 /

The Pantiles Medical Centre – C84121 /
Practice merged with Willowbrook in April 2014
Willowbrook Medical Practice – C84012 /
Woodlands Medical Practice – C84014 /
Woodside Surgery – C84718 /

NHS Newark and Sherwood Clinical Commissioning Group and General Practice