Does your practice have up-to-date data protection and cyber security policies that follow national guidance?

Official wording from NHS England

Assertion 1.3: Accountability and Governance in place for data protection and data security

Does your organisation maintain up-to-date data protection and cyber security policies aligned with best practice and national guidance?

You should have policies in place detailing your organisation's principles and procedures for data protection and cyber security. These should be updated every three years as a minimum. There is no set number of how many policies your organisation has to have on these topics as the different sizes and complexity of organisations means that some will have one all-encompassing policy, whilst others may have multiple policies. As a minimum your policy/policies should cover: Data protection and confidentiality: how the organisation complies with UK GDPR and the Caldicott Principles, including data breach management, risk assessment, data subject rights, and data protection by design and default. Records management: defines how records will be safeguarded from their creation to disposal, including accuracy, access, retention and disposal. Cyber security: defines protocols for example password management, device and network security, backups, and technical security controls. If relevant, remote working and bring your own device: rules for staff accessing records or emails from home/whilst out of the office or on their own personal devices. Policy templates are available from Digital Care Hub (https://www.digitalcarehub.co.uk/data-security-protecting-my-information/data-security-and-protection-toolkit/template-policies/).