confidentiality, data protection, information security management and information quality. Failure to maintain confidentiality may lead to disciplinary action, up to and including dismissal. 7. Communications Plan 7.1 The BSO will develop and maintain a communications plan to ensure that all stakeholders are adequately informed about confidentiality and the way their information is used and shared and their rights as data subjects. In particular this will cover how they may access their personal data and how they may exercise those rights when consent is required to use their data for non-healthcare purposes. 8. Information Risk Roles and Responsibilities See Annex A for the BSOal Chart 8.1 The BSO Board The is responsible for ensuring that the information governance function is appropriately managed in a manner which complies with relevant legislation and standards. 8.2 The Chief Executive The Chief Executive as the Accountable Officer for the BSO has overall accountability and responsibility for Information Governance in the BSO. They are required to provide assurance through the Statement of Internal Control that all risks, including those relating to information, are effectively managed and mitigated. 8.3 The Senior Information Risk The Director of Human Resources and Corporate Services at the BSO is the Senior Information Risk Owner (“the SIRO”). The SIRO has overall responsibility for managing information risk across the BSO and is the owner of the Information Asset
If risk is not accepted, complete risk mitigation (action) plan: Action to reduce risk Responsibility Timescale Revised risk score Evaluating Information Risk / Risk rating for Information Risk Assessments A simple approach to quantifying risk is to define qualitative measures of consequences and likelihood such as the exemplars given below. This allows construction of a risk matrix which can be used as the basis of identifying acceptable and unacceptable risk. In order to prioritise actions, it is necessary to evaluate the level of risk presented by each of the identified hazards. This is done using a simple rating system (1-5). First, for each of the hazards/risks decide how likely it is to happen (Likelihood) and how serious the consequences are most likely to be (Severity) from the following guide, taking into account the measures already in place. RISK SCORE LEVEL ACTION AND TIMESCALE INSIGNIFICANT Slight damage to property or equipment, Slight delay in service provision, an element of financial loss, minor clinical incident – no immediate effect on patient safety or patient care, potential breach of confidentiality where less than 5 people affected or risk assessed as low, e.g. files were encrypted. No action is required to deal with trivial risks, and no documentary records need to be kept. Slight damage to property or equipment, Slight delay in service provision, an element of financial loss, minor clinical incident – no immediate effect on patient safety or patient care, Loss of availability to authorised users, Serious potential breach of confidentiality e.g. No further preventive action is necessary, but consideration should be given to more solutions, or improvements that impose no additional cost burden. Monitoring is required to ensure that the controls are maintained.