DIG-POL-001: Information Security and Access Control Policy

At a glance

• Give each person access only to the health information they need for their job.
• Use a unique login and a strong password. Never share your login.
• Lock your screen when you leave the workstation.
• Report any suspected breach at once through the breach procedure.
• Review who has access every quarter and remove access when a person leaves.
• Stop and get help straight away if: you suspect patient information has been seen, copied or sent to the wrong person. Stop, and report it at once.

Step 1. Set access by role.

• Write an access list for each role: what information, what systems, what actions (view, change, export).
• Give access on the basis of the role, not the person.
• Use a unique login for each user.

Key point: Role-based access limits what a person can see to what their job needs.

Step 2. Protect logins and devices.

• Use a strong password and multi-factor login where the system allows.
• Lock the screen when you leave. Log out of shared devices.
• Keep devices encrypted where the hospital can do so (EC).

Key point: Most breaches start with a stolen or shared login.

Step 3. Review access every quarter.

• The IT lead and line managers review the list of users and their access.
• Remove access that is no longer needed. Remove access the same day a person leaves.
• Record the review date and the changes.

Key point: Access that is never reviewed grows until no one knows who can see the records.

Step 4. Monitor and log access.

• Keep logs of access to electronic records where the system allows.
• Check unusual access (for example, records of patients not under the person’s care) each month.

Key point: Logs show who looked at a record, which is essential when a breach is suspected.

Step 5. Keep paper records secure.

• Store paper records in locked cabinets with controlled keys.
• Track removal of records from the store.
• Destroy paper records only through the approved disposal process.

Key point: Paper breaches happen through records left on desks and in cars.

Step 6. Report any breach at once.

• Report to your line manager and the data protection lead immediately, using DIG-SOP-001.
• Do not try to investigate alone or delete anything.

Key point: Early reporting limits harm and is required by the breach procedure.