Do you make sure non-IT suppliers working on your premises (cleaners, contractors, other organisations renting space) can't access patient information they shouldn't?

Official wording from NHS England

Assertion 10.2: Basic due diligence has been undertaken against each supplier that handles personal information

Does your organisation have appropriate information security policies and assurance in place to ensure that non-IT suppliers (for example, cleaning/facilities staff, contractors, HR or other back-office staff, or organisations renting space) do not have inappropriate access to information when working on your premises. Including controls over access to both physical and digital records, systems and sensitive areas. Where access to information is given, non-IT suppliers should have a contractual obligation to only use it for the purposes authorised by you.

Assurance could include checking that a supplier has relevant policies on data handing and secure behaviour, reviewing their data handling commitments in a contract, or confirming that supplier staff do not have unsupervised access to areas where patient records are stored. Please provide details in the comments box.