1

2015/16 Annual Report of the Information Governance,

Management & Technology Committee

Contents 1. Introduction .................................................................................................................. 2

2. Meetings and Membership .......................................................................................... 2

3. Committee reporting framework ................................................................................. 4

4. Work Programme 2015/16 ........................................................................................... 7

5. Work Programme 2016/17 ......................................................................................... 19

Appendix 1 – IGMT Committee attendance breakdown ................................................. 20

Appendix 2 – Policy Matrix ............................................................................................... 22

Appendix 3 – IG Risk Register at March 2016 ................................................................. 24

2

1. Introduction

The Information Governance, Management and Technology (IGMT) Committee is

established on behalf of NHS Rushcliffe (RCCG), NHS Nottingham North and East

(NNE), NHS Nottingham West (NW), NHS Mansfield and Ashfield (M&A) and NHS

Newark and Sherwood (N&S) CCGs in accordance with the joint arrangements

detailed in their respective Constitutions and referred to in this document as ‘the

CCGs’.

The purpose of the Committee is to support and drive the broader information

governance (IG) and information management & technology (IM&T) agendas,

including:

Ensuring risks relating to information governance and health informatics are

identified and managed

Leading the development of community-wide IG and IM&T strategies

Developing IM&T to improve communication between services for the benefit of

patients

This annual report will provide an overview of the achievements the IGMT

Committee has led throughout 2015/16 and its objectives for 2016/17.

2. Meetings and Membership

The membership of the Committee reflects the CCGs’ acknowledgement of the

importance of IG and IM&T, the emphasis it places on its contribution to the

commissioning process and the successful implementation of projects of work.

Each CCG is represented on the Committee by their respective leads for IGM&T.

The membership of the IGMT Committee is as follows:

Director of Outcomes and Information (Chair and Representative for South

CCGs)

Each CCG’s SIRO,

3

Each CCG’s Caldicott Guardian,

Information Governance Lead at the Greater East Midlands Commissioning

Support Service

Information Governance Lead at NHS Nottingham City CCG

Director of Health Informatics, NHIS

Head of Transformation, NHIS

GP representative

Governing Body Lay Member.

Members’ qualification, disqualification, appointment, tenure on the Information

Governance, Management and Technology Committee and eligibility for

reappointment are as per Governing Body members is detailed in Section 2 of

Appendix C of each CCG’s constitution. The IGMT Committee has a register of all

its’ members’ interests and declarations of interest is a standing item on all agendas

at the beginning of all meetings to ensure that all interests of members are captured

and handled appropriately.

Others are invited to attend meetings as appropriate and to facilitate cross

community discussion, Nottingham City CCG have been represented in attendance

only to allow consistency across all CCGs in Nottinghamshire.

The IGMT Committee has met on a bi-monthly basis throughout 2015/16. Members

are expected to attend at least 75% of meetings and are responsible for identifying

appropriate deputies to represent their position if unable to attend. Attendance for

the year has been 77.78%. A breakdown of attendance by member is included in

Appendix 1. To be deemed quorate, the meeting must include the Chair or Deputy

Chair, a representative for each CCG and at least one SIRO and one Caldicott

Guardian from across the CCGs. The Committee was quorate for five of the six

meetings held in 2015/16. The September 2015 meeting was not quorate as there

was no Caldicott Guardian present, for this meeting all items for approval were

agreed on the condition that Caldicott Guardian approval was given virtually

following the meeting.

4

Minutes are taken at all meetings by NHS Rushcliffe CCG and circulated unratified,

to members of the Committee for approval at the following meeting. A highlight

report is also produced following each meeting for CCG Governing Bodies. Patients

are represented by a governing body lay member.

3. Committee reporting framework

The IGMT Committee receives updates from several IG and IM&T working groups.

See below reporting framework and purpose of groups:

5

East Midlands Strategic Information Governance Network (EMSIGN)

The EMSIGN provides a forum for Information Governance professionals working in

Health and Social Care across the East Midlands to share knowledge and expertise

relating to the area of Information Governance. The network acts as a conduit for

communication, consultation and dissemination of relevant Information Governance

topics. The group members, where appropriate, comment on national policy and

developments and this is fed up to national Information Governance forums

predominately within NHS England or the Health and Social Care Information

Centre.

The group also provides a support function to all the members to ensure the

development of consistent practices across the East Midlands region; this is

pertinent to ensure effective information sharing across partner agencies.

Records and Information Group

The purpose of the Record and Information Group is to support Health and Social

Care organisations across Nottinghamshire ensure that best practice is applied in

the sharing and management of Information. The group develop robust Information

Governance guidance and recommend these to the member organisations across

the Nottinghamshire Health and Social Care Community for inclusion within

organisational policy. The group develop advice, standards, principles and

documentation to support the adoption of best practice, communicating these to

support staff who provide care

Information Governance (IG) Leads Working Group

The purpose of the IG Leads Working Group is to support the Nottinghamshire

Clinical Commissioning Groups to ensure that best practice is applied in the sharing

and management of information and as a forum to discuss and resolve common

issues or queries in relation to the Information Governance agenda and IG Toolkit

standards.

Data Management Group

The Nottinghamshire Data Management Group (DMG) act as the body agreeing the

tactical and strategic priorities of the Nottinghamshire Data Management Team

6

(DMT). The DMG agree a set of common priorities which allow the DMT to deliver

the rapid and dynamic implementation of solutions including:

Setting the overall data management strategy for Nottinghamshire CCGs;

Agreeing the prioritisation of IGM&T product developments in relation to Business

Intelligence and Data Warehousing environments;

Supporting the implementation of products in individual CCGs;

Ensuring risks relating to information governance and health informatics are

identified and managed;

Supporting the CCGs in defining product specifications which meet the agreed

functionality.

In doing so it ensures the DMT:

Support clinical commissioning innovation;

Provide rapid and responsive developments;

Operate within a sound governance environment which adheres to CCGs’

policies; and

Work to robust management processes which are documented.

The DMG focuses its business on strategic-level discussions and rely on the more

frequent discussions between SIROs to agree arrangements for more operational

changes and issues of a more urgent nature.

Nottinghamshire IM&T SRO Programme Board

The Connected Nottinghamshire IM&T SRO Programme Board is responsible for the

creation of the Digital Roadmap, setting the overall ambition and strategic direction

for IM&T in the City and County of Nottinghamshire. It aligns the programme with

key business and transformation agendas and monitors, reviews and reports overall

progress. Specifically the Board ensures alignment with the Sustainable

Transformation Plan for the Nottinghamshire Digital Footprint.

The Board translates the strategy into tangible projects, ensuring they are delivered

and their benefits realised across the clinical, care and managerial environment

across the health and social care community.

7

It also ensures IGM&T contributes towards the overall strategic direction of individual

organisations and realises financial benefits relating to both the improved quality and

productivity of clinical and care services and cost effectiveness of IM&T service

providers.

4. Work Programme 2015/16

Key areas of work for the IGMT Committee in 2015/16 have included:

Continuing progression of the implementation of the necessary changes to

ensure compliance with changes in statutory legislation.

Further progression of the use of Data Services for Commissioners will move the

CCGs to align with organisations supplying data services under the Lead

Provider Framework.

The publication of a Data Management Strategy in order to provide assurance to

CCGs that sensitive and confidential data is being processed in accordance with

the requirements for encryption and pseudonymisation.

Reviewing Cyber Security to ensure CCGs and GP Practices are well placed to

mitigate any risk associated with malicious attempts to breach security

arrangements.

Monitoring the CCGs’ progress of completion of the Information Governance

Toolkit.

Maintaining an information governance risk register for the CCGs.

Receiving quarterly data quality reports on SUS data submitted by trusts relating

to their patients.

Following the progress of all local IT projects and agreeing a range of policies

and procedures.

Agreed relevant information governance, information management and

information technology policies with amendments as necessary reflecting

changes in legislation or local ambition.

Maintaining the contract management arrangements with Nottinghamshire Health

Informatics Service (NHIS) in order to demonstrate improvements to the delivery

of services to the agreed standards.

8

The IGMT Committee approved the following documents in 2015/16:

Bring Your Own Device Policy

Data Quality Policy

Data Warehouse Access Authorisation form and process

IGMT Strategy

Information Governance Leads Meeting Terms of Reference

Information Governance Management Framework

Information Governance, Management and Technology Committee Terms of

Reference

Information Risk Policy

Network Security Policy

Privacy Impact Assessment Guidance and Template

Smart Card Policy

Information Governance

Each CCG has an Information Governance lead that works closely with their CCG’s

Caldicott Guardian and Senior Information Risk Owner (SIRO) to fulfil the

organisations’ information governance requirements.

The CCGs also commissioned Information Governance support to provide expert

support, advice and guidance to the strategic and technical information governance

arrangements. NHS Newark and Sherwood CCG and NHS Mansfield and Ashfield

CCG commissioned the support from Greater East Midlands Commissioning Support

Unit (GEMCSU) and NHS Rushcliffe CCG, NHS Nottingham West CCG and NHS

Nottingham North and East CCG commissioned the support from NHS Nottingham

City CCG.

The table below identifies the information governance objectives for the CCGs as

identified in the IGMT Committee’s terms of reference and the Committee’s progress

and outcomes towards achieving the objectives.

Table 1 – Information Governance Objectives and Outcomes

9

Objective

Outcome

1) Ensure that an appropriate comprehensive information

governance framework and systems are in place

throughout the constituent organisations in line with

national standards.

The IGMT Committee approved the CCGs’ Information

Governance Management Framework in September 2015. The

Framework set out the accountability arrangements, method of

dissemination of policies and revised terms of reference of the

IGMT Committee.

2) Receive regular action plans with regard to the

organisations’ progress on the annual Information

Governance Toolkit submission.

The IG Working group reported to the IGMT Committee

regularly on progress made towards the annual Information

Governance Toolkit Submission throughout the year.

3) Ensure that information is effectively managed, and that

appropriate policies, procedures and management

accountability are provided in relation to confidentiality,

security and records management.

The IGMT Committee agreed all information governance

policies requiring review in 2015/16. Appendix 2 lists all the IG

and IM&T policies and their status.

4) Ensure that information risks are identified, assessed and

managed in line with the Information Governance

Assurance Framework and recommend actions to the

Senior Information Risk Owner (SIRO) to ensure risks are

mitigated.

The Information Governance Risk Register was a standing

item for the IGMT Committee and so all risks were reviewed,

updated and new risks identified at every meeting throughout

2015/16. The latest risk register presented at the March 2016

IGMT Committee meeting is in Appendix 3.

10

5) Ensure that information risks for commissioned services,

including GP practices are identified and managed in line

with National Serious Incident Framework, NHS England,

March 2015. This will include incidents that result in a

serious breach in confidentiality or data loss.

The IGMT Committee prepared to decommission GP System

of Choice (GPSOC) systems for redundant practices in

2015/16. Through the support of the IGMT Committee and

commissioned services from GEM CSU and Nottingham City

CCG, CCGs have supported GP practices in the identification,

management and reporting of information governance

incidents.

6) Assure the CCGs’ Governing Bodies that all person

identifiable information is processed in accordance with the

Data Protection Act and that all staff are aware and comply

with the NHS Code of Confidentiality and other professional

codes of conduct.

The IG leads working group assured the IGMT committee that

all data flows of person identifiable information is processed

appropriately through the mapping exercises completed as part

of the IG toolkit. The IGMT Committee were also assured via

the IG leads working group that all staff were fully trained.

7) Ensure that new or proposed changes to organisational

processes or information assets are identified and risk

assessed, considering any impact on information quality

and identifying any new security measures that may be

required.

Privacy Impact Assessments were a standing agenda item for

the IGMT Committee meetings and the Committee received

updates of completed and ongoing assessments. The IG

working group also assured the Committee that an information

asset register was completed annually and risk assessed as

part of the IG toolkit work programme.

8) Provide oversight and monitoring of provider IG Toolkit

compliance on behalf of the CCGs, advising the relevant

Quality Scrutiny Panels regarding any areas of concern.

Provider IG Toolkit compliance is monitored through the

reporting of incidents and quality monitoring of contract

performance.

11

9) Ensure that all locally-developed clinical information

systems are accredited and signed off by the IM&T Clinical

Safety Officer as laid out by statute and the relevant Data

Set Change Notices.

The IGMT Committee prepared to decommission GP System

of Choice (GPSOC) systems for redundant practices in

2015/16.

10) Receive regular compliance reports on the processing of

Freedom of Information requests; determining exemptions

as appropriate.

The IGMT Committee received quarterly reports on compliance

of processing Freedom of Information requests. Compliance

with responding to Freedom of Information requests within

required timeframes for 2015/16 was 95%.

11) Develop an information governance training programme

and monitor the progress of the staff training and

awareness in line with the National Department of Health

requirements.

The IG Leads working group monitored progress against the

IG work plan which included all CCG staff completing annual

information governance training. The IG working group

reported to each IGMT meeting.

12) Support the Caldicott function, working with the Caldicott

Guardian to ensure work related to confidentiality and data

protection is appropriately carried out and any risks

reported appropriately.

The Caldicott Guardians were members of the IGMT and

support was provided to key roles through the Committee and

attendance at the meetings.

13) Work with independent contractors and commissioned

services to ensure their compliance with the Information

Governance Toolkit.

NHS England is responsible for ensuring that GP practices

have completed their IG toolkits, however, the CCGs

commissioned IG support for practices through the contract

with GEM CSU and Nottingham City CCG.

12

Information Management and Technology

The Director of Outcomes and Information is the CCGs’ Lead for Information Management and Technology and manages the

contract with NHIS to provide IM&T systems and support.

Table 2 – Information Management and Technology Objectives and Outcomes

Objective

Outcome

1) Promote new technologies across the CCGs to ensure

quality of patient services.

The IGMT Committee identified new technologies and

highlights as appropriate to the Governing Bodies through the

Highlight Report. The IT Refresh Programmes for GP Practices

and CCGs implemented the necessary upgrades for hardware,

operating system and software applications to ensure

compliance with minimum standards.

2) Develop the CCG’s IM&T Strategy ensuring it is congruent

with both national and local strategy, and complements the

business plans of individual Clinical Commissioning

Groups; providing Governing Body assurance on the plan.

The IGMT Committee approved the IGMT Strategy in January

2016. The strategy describes how Information and Technology

will support NHS Nottinghamshire Clinical Commissioning

Group’s future vision for a digitally mature health care profile

over the next five years.

13

3) Ensure that the individual CCGs’ components of the

programme are delivered in accordance with the timescales

and milestones laid out in a project plan.

The IGMT Committee received a project update report from

NHIS detailing progress with all IM&T Projects at every

meeting. The report provides an overview of achievement for

each project and a breakdown by practice of progress. The

IGMT Committee also received overviews of several projects

as presentations at the start each meeting throughout 2015/16.

4) Act as the Project Assurance mechanism for any significant

IM&T investment within the CCGs ensuring that the

appropriate rigour has been applied to the case for change,

specification, procurement, implementation and

mobilisation of such investment plans.

The IGMT Committee received a project update report from

NHIS detailing progress with all IM&T Projects at every

meeting. The report provides an overview of achievement for

each project and a breakdown by practice of progress. The

IGMT Committee also received overviews of several projects

as presentations at the start each meeting throughout 2015/16.

5) Ensure that the CCGs have mechanisms and plans in place

to raise the basic competencies and skills of the

commissioning organisation in order to base decisions on

knowledge and information.

The IG working group monitored progress against the IG work

plan which included all CCG staff completing relevant annual

training. The IG working group reported to each IGMT meeting.

6) Agree the relative priority of IM&T investment projects

where flexibility exists outside of any national programmes.

An extra IGMT meeting was held in December 2015 for

selected members to agree the IT project priorities for 2016/17

this was based project priority, timescales and funding

available and linked to those priorities in the CCGs’ corporate

plans.

14

7) Provide assurance to the Governing Bodies that sufficient

attention is being placed on data quality of both mandated

and local datasets generated by the CCGs and their

providers.

The IGMT Committee received quarterly data quality reports

providing assurance of the quality of local datasets. Assurance

was provided to the CCGs’ Governing Bodies via the

Committee Highlight Report.

8) Ensure the CCGs are able to maximise all clinical and non-

clinical benefits from planned and existing information

systems and IT infrastructure.

Through a number of the 2015/16 projects the realisation of

benefits from clinical systems has been achieved with no

additional software costs. For example, the creation and

implementation of a single SystmOne unit to support federated

access to patient records for clinicians working outside of their

normal practice environment.

9) Facilitate development and local implementation of health

informatics policies ensuring they are consistent with

national and local strategy.

The IGMT Committee agreed all information management

policies due for review in 2015/16. Appendix 2 lists all the IG

and IM&T policies and their status.

10) Receive reports relating to the Nottinghamshire Health

Informatics Service (NHIS), its services, the performance of

the SLA between the NHIS and CCGs and progress

against specific projects.

The IGMT Committee received performance reports from NHIS

at every meeting. The report included achievement against the

Service Level Agreement key performance indicators.

11) Monitor and review data and hardware security

arrangements.

The IGMT Committee reviewed hardware security

arrangements throughout 2015/16, this included reports

regarding GP refresh and GP server from NHIS.

15

12) Ensure appropriate business continuity arrangements are in

place relating to information technology.

The IG working group monitored progress against the IG

workplan for the IG toolkit which included business continuity

of information technology. The IG working group reported to

the each IGMT meeting.

Data Management

The Director of Outcomes and Information is the CCGs’ Lead for Data Management.

Table 3 – Data Management Objectives and Outcomes

Objective

Outcome

1) Enable data sharing across care settings for direct patient

care through GP Repository for Clinical Care (GPRCC).

Positive meetings with various stakeholders.

User Interface available and split into three views to suit needs

and appropriate access rights for different users

2) Create an electronic framework for managing and auditing

Data Processing and Data Sharing Agreements/ Contracts.

Including eSigning of basic agreement with Schedules that

can be updated electronically (e.g. for new Read Codes to

be extracted for the GP Repository for Clinical Care

An integrated tool encompassing Privacy Impact Assessments

(PIAs), Equality & Diversity Impact Assessements (EIA), and

Quality Impact Assessments (QIAs) has been developed and

is in final testing.

A generic Data Processing Contract template has been drafted

16

(GPRCC) without requiring a signature each time. and an automatic document compiler has been built and

tested. A data structure for managing electronic contracts has

been designed and is currently being built.

Content updated to reflect changes in GPRCC specification

(e.g. inclusion of patient name). Sample contracts generated

3) Ensure functions support budget monitoring and financial/

contract management. Broaden the number of contracting

processes that we report on developing interactive

interfaces and regular reports that reduce the amount of

bespoke work that analysts need to do

Initial version of analysis engine released with NUH data -

positive feedback from South County Finance team, resulting

in tweaks to UI and validation rules. Circle Treatment Centre

data added.

First cut of M3 data loaded to development cube. Reporting

schedule agreed with Finance. Business rules for more fully

automated processing being developed

Choose & Book (C&B) referrals cube and module released.

This is integrated with the Referrals log so that practices using

the referrals log can see clinical data about C&B referrals.

4) Remove the barrier of remembering usernames and

passwords that prevents more frequent access by end

users for eHealthscope. Allow CHP users (on a different

domain) to access eHealthScope.

Trial Smartcard mechanism in place

5) Enable secure access to eHealthScope across N3 sites.

Creating a safe environment in which healthcare providers

User roles and permissions on all eHealthScope servers

checked and cleansed.

17

can contribute data in the knowledge that transfer, storage

and access to the data will be secure

Reporting permissions separated from standard event

permissions to give greater ability for non-clinical staff to see

aggregate data.

6) Make it easier for practices to search for problems in

eHealthScope and create a pushed report that highlighted

areas where they may be performing well or that need

investigation.

Choose and Book data automatically integrated with practice’s

own recording of data using the referral log.

Aggregate reports made available to analysts to show use of

eHealthScope (broken down by each function in

eHealthScope) by each practice with the aim of providing help

where usage is low.

7) Create an assessment of available tools for benchmarking

against other CCGs to compare admissions, A&E, OPD

and mortality rates across UK. Compare GP performance

across UK.

Positive initial meeting with HED team, exploring opportunities

to collaborate with eHealthScope.

QoF process fully overhauled and updated in eHealthscope.

Currently, the challenges of processing the whole country

outweigh potential benefits locally, but we will review when the

eHealthscope data cubes have been developed.

8) Provide a mechanism for providers to upload data into our

data-warehouse with near provider data quality testing and

pseudonymisation at source. Improve efficiency by

reducing personnel required to manually import data.

Development of eHealthScope user interface to allow file

upload on demand by the data provider.

Contracts in place for enterprise reporting facility to extract

data from SystmOne and EMISWeb

9) Move eHealthScope onto a modern platform increasing Data refresh of all eHealthScope data to reflect merged

18

maintainability, robustness, speed, data security. practices, changes in practice contracts

QoF process overhauled and translated from Access into SQL.

2013/2014 data importated into eHealthScope.

Commenced development of an admissions cube to replace

the ‘old eHealthScope’ DSR calculation mechanism.

City and County Accounts merged into a cube and now

reported via a single, common interface.

10) Develop procedures and tests to mitigate against the

potential for errors to be introduced in other modules each

time changes are made.

Test database of each data statement as a resource for

automatic testing built

11) Increase the range of tools for clinicians to help manage

care of patients particularly where that involves data from

other providers.

Formal release of the Screening Register (with Bowel Cancer

data).

Agreement with CityCare for daily caseload data to be shared.

Agreement with NUH for weekly admissions and readmissions

data to be shared.

12) Work with County social services and then City services to

establish indicators that social services can share (patients

who are falling, are socially isolated) which predict patients

at risk of admission

Initial meeting to scope options

Agreement to standardise coding

19

5. Work Programme 2016/17

Key areas of work for the IGMT Committee in 2016/17 will include:

Continued progression of the implementation of the necessary changes to ensure

compliance with changes in statutory legislation. This will be built on the

successes seen during 2015/16 and address any new legislation or Regulations

published during 2016/17.

Continued review of Cyber Security to ensure CCGs and GP Practices are well

placed to mitigate any risk associated with malicious attempts to breach security

arrangements.

Monitoring the CCGs’ progress of completion of the Information Governance

Toolkit.

Maintaining an information governance risk register for the CCGs.

Receiving quarterly data quality reports on SUS data submitted by trusts relating

to their patients.

Following the progress of all local IT projects and agreeing a range of policies

and procedures.

Agreed relevant information governance, information management and

information technology policies with amendments as necessary reflecting

changes in legislation or local ambition.

Maintain the contract management arrangements with Nottinghamshire Health

Informatics Service (NHIS) in order to demonstrate improvements to the delivery

of services to the agreed standards.

Support application of the IGMT Strategy, including implementation of a

Community-wide Care Portal allowing access into patient records for secondary

care, community services and primary care and development of the Digital

Roadmap across Nottinghamshire.

20

Appendix 1 – IGMT Committee attendance breakdown

Name, Title, designation

Da

te

22

/05

/20

1

5

Date

24

/07

/20

1

5

Date

25

/09

/20

1

5

Date

27

/11

/20

1

5

Date

22

/01

/20

1

6

Date

18

/03

/20

1

6

To

tal/

po

ss

ible

Andy Hall, Director of Outcomes and Information and Senior

Information Risk Owner (SIRO) Rushcliffe CCG (Chair)

6/6

Alexis Farrow, Head of Information Governance, GEM Deputy 5+1D/6

Paul Gardner, Head of Information Governance, Nottingham City

CCG

6/6

Petra O’Mahony, Freedom of Information Lead, GEM

Until 31st December 2015

A A A N/A N/A 1/4

Nichola Bramhall, Caldicott Guardian South CCGs A Deputy 4+1D/6

Ei-Cheng Chui, Caldicott Guardian Newark and Sherwood CCG

(Deputy Chair)

Until 27/11/2015

A A N/A N/A 2/4

Mike O’Neil, General Practitioner Nottingham West CCG and

Senior Information Risk Owner (SIRO) Nottingham West

6/6

Hazel Buchanan, Senior Information Risk Owner (SIRO)

Nottingham North and East

Deputy 5/6

21

Elaine Moss, Caldicott Guardian Mansfield and Ashfield CCG and

Newark and Sherwood CCG

Deputy Deputy Deputy Deputy Deputy Deputy 6D/6

Sarah Bray, Senior Information Risk Owner (SIRO) for Mansfield

and Ashfield CCG and Newark and Sherwood CCG

From 8th June 2016

N/A Deputy Deputy Deputy Deputy 1+4D/5

Paul Morris, Governing Body Lay Members of Newark &

Sherwood CCG

A A 4/6

Dr Sean Ottey, General Practitioner Rushcliffe CCG A A A A A 1/6

Jaki Taylor, Head of Transformation A 5/6

Eddie Olla, Director of Health Informatics at NHIS A A 4/6

Marcus Pratt, Interim Senior Information Risk Owner (SIRO) for

Mansfield and Ashfield CCG and Newark and Sherwood CCG

Until 22/05/2015

Deputy N/A N/A N/A N/A N/A 0/1

George Ewbank, Clinical Safety Officer

Until 26th May 2015

N/A N/A N/A N/A N/A 1/1

22

Appendix 2 – Policy Matrix

Ref Name of Policy Lead Approval

Date

Approving

body

Review

Date

Previous

version

IG01 Information Security Policy Paul Gardner 28/11/2014 IGM&T 01/11/2016 15/03/2013

IG02 Information Sharing Protocol Paul Gardner 26/09/2014 IGM&T - NOTED 01/08/2016 22/11/2013

IG06 Safe Haven Procedure Paul Gardner 23/01/2015 IGM&T 23/01/2017 28/03/2014

IG07 Information Governance Policy Paul Gardner 26/09/2014 IGM&T 26/09/2016 15/03/2013

IG08 Data Quality Policy Andy Hall 24/07/2015 IGM&T 24/07/2016 15/03/2013

IG09 Information Asset Register Procedure Paul Gardner 25/07/2014 IGM&T 01/07/2016 15/03/2013

IG10 Access to patient information and use of

smartcards NHIS 27/11/2015 IGM&T 27/11/2017 15/03/2013

IG11 Confidentiality and Data Protection Policy Paul Gardner 23/01/2015 IGM&T 23/01/2017 22/11/2013

IG12 Electronic Remote Working Policy NHIS 23/01/2015 IGM&T 23/01/2017 15/03/2013

IG14 Freedom of Information and Environmental

Information Regulations Policy Paul Gardner 25/07/2014 IGM&T 01/07/2016 15/03/2013

IG18 Internet and Electronic Mail Policy Paul Gardner 28/11/2014 IGM&T 28/11/2016 15/03/2013

IG21 Records Management Policy Paul Gardner 25/07/2014 IGM&T 01/07/2016 15/03/2013

IG24 Information Lifecycle Management Policy Paul Gardner 25/07/2014 IGM&T 01/07/2016

IG27 Information Risk Policy Paul Gardner 27/11/2015 IGM&T 01/11/2016 28/11/2014

IG31 Subject Access Request Procedure Paul Gardner 23/01/2015 IGM&T 23/01/2017 28/03/2014

23

IG32 Network Security Policy NHIS 18/03/2016 IGM&T 01/09/2017 27/03/2015

IG33 Information Governance Management

Framework Paul Gardner 25/09/2015 IGM&T 25/09/2016 26/09/2014

IG40 Privacy Impact Assessment Paul Gardner 25/09/2015 IGM&T 25/09/2016 27/09/2013

IG41 Confidentiality Audit Procedure Paul Gardner 23/01/2015 IGM&T 23/01/2017 22/11/2013

24

Appendix 3 – IG Risk Register at March 2016