Facilitator Handbook 2005 - PRIMIS

Information Governance
PRIMIS Facilitator Handbook
Information Governance
Background
Information Governance is a broad-based approach to looking at all aspects of how
information is processed by NHS organisations – how it is Held, Obtained, Recorded, Used
and Shared (HORUS). And just like other governance initiatives, e.g. research, corporate and
clinical governance, information governance is about setting standards – standards for
handling information in a confidential and secure manner. These standards are derived from
law, policy and agreed best practice, such as:
• the Common Law Duty of Confidence
• the Data Protection Act 1998
• the Freedom of Information Act 2000
• the NHS Code of Conduct for Confidentiality
• the Caldicott Report 1997
• Information Security Management – BS7799
• records management – HSC 1999/053
• a strategy for information quality assurance
Broadly speaking, information governance can be divided into five main components:
confidentiality and consent
data protection
IM&T security
records management
information quality assurance
Confidentiality and Consent
Under the common law duty of confidence, patient information is generally held under legal
and ethical obligations of confidentiality. Information provided in confidence should not be used
or disclosed in a form that might identify a patient without his or her consent. There are a
number of important exceptions, but these obligations apply in most circumstances.
Data Protection
The Data Protection Act 1998 is built around a set of enforceable principles. These are
intended to protect personal privacy, to encourage good practice in the handling of personal
information, and to give individuals a right of access to information about themselves, for
example to their own health or financial records. The Data Protection Act applies to all bodies
that process personal information, not only to public authorities.
PRIMIS 55