Do you have an up-to-date privacy notice that clearly explains how you use patient and staff data?

Official wording from NHS England

Assertion 1.1: The organisation has a framework in place to support Lawfulness, Fairness and Transparency

Does your organisation maintain an up-to-date privacy notice that clearly explains how information is used?

If you use and share personal data then you must tell people what you are doing with their data. This includes what data is being collected and for what reason, how long it will be kept for, who you're going to share it with, how it will be kept secure and individual's rights under data protection legislation, for example, the right to access their information. This should be set out in writing in 'a privacy notice'. You should provide this information in a clear, open and honest way using language which is easy to read and understand, and in a range of formats as appropriate for different audiences. Your privacy notice should cover all data you process for example the data relating to the people you support and their relatives, staff, volunteers, members of the public. You may have more than one privacy notice, for example one for staff and another one for the people you support. An example privacy notice is available from British Medical Association (https://www.bma.org.uk/advice-and-support/ethics/confidentiality-and-health-records/gdpr-privacy-notices-for-gp-practices).