Categorise and report the incident as described as per ‘recording and reporting’ requirements 2. Procedures for recording incidents A record of all incidents, including near-misses, should be made by completing a copy of the information security incident report form. Incidents should be classified in the log according to severity of risk to patients and the optical practice using the following incident classification system described below. For consider the likely impact if the breach had occurred. Incident Classification: Insignificant: Minimal discernible effect on patients or the optical practice. Minor: Minor breach, for example data lost but files encrypted, less than 5 patients affected. Inconvenient to the optical practice but manageable. Moderate: Moderate breach, for example unencrypted clinical records lost, up to 20 patients affected. Potential for damage to the optical practice’s reputation. Major: Serious breach, for example unencrypted clinical records lost, up to 1,000 patients affected or particular sensitivity. e.g. mental health status Potential for damage to the optical practice’s reputation and/or local media coverage. Critical: Serious breach in terms of volume of records, for example over 1,000 patients affected or particular sensitivity of records. Damage to the reputation of the NHS and the optical practice profession. Potential for national media coverage. 3. Procedures for reporting incidents Incidents should be reported to the optical practice Information Governance lead. The Information Governance lead will determine whether there is also a need to report the incident to others depending on the type and likely consequences of the incident, e.g. inform the Police, the PCT, the optical practice’s insurer etc. Although there is no legal requirement to do this, where there is high risk of harm to patients, it is considered best practice to also inform the Information Commissioner. Document name: [Insert Company Name]: Information security assurance – role-based access Date created: Author: Approved by:
Requirement 322: Information Security Assurance – Data Transfer Describe the nature of the information flow between the Optical practice and the external organisation, e.g. data item, format, transfer method Identify the type and risk level of breaches of confidentiality Describe the measures taken to mitigate the risk of breaches in confidentiality of information that is passed between the optical practice and the external organisation Patient or Guardian Referral letter copies, Prescription copies, Patient Recall letters, patient record copies. Low Information only sent to Confirmed patient address by mail. NHS England NHS sight test vouchers and NHS optical vouchers Low Forms sent by recorded delivery or delivered by practice staff member CCG Payment forms for Community services Low Forms sent by recorded delivery or delivered by practice staff member HES Referral letters Low Sent by post, fax to safe Haven, or email using NHS Mail or encrypted email. GP Referral letters Low Sent by post, fax to safe Haven, or email using NHS Mail or encrypted email. Another optical practice Spectacle prescription copy, Contact lenses prescription Copy. Low Sent by post, fax to safe Haven, or email using NHS Mail or encrypted email. Telephone if patient identity can be verified and consent obtained. Glazing lab Spectacle prescription Low Minimum data sent, order Number or surname identifier Used. Wholesale supplier Contact lens prescription, Spectacle prescription Low Minimum data sent, order Number or surname identifier Used. Tertiary Ophthalmology Service
personal conversations is clearly very important but must be addressed through policies, procedures and staff training. Transfers within an Optical Practice Company: Transfers within an optical practice company do not need to be documented in this mapping exercise; however optical practice companies should ensure they meet their legal obligations including compliance with the Data Protection Act.