Categorise and report the incident as described as per and ‘recording reporting’ requirements 2. Procedures for recording incidents A record of all incidents, including near-misses, should be made by completing a copy of the information security incident report form. Incidents should be classified in the log according to severity of risk to patients and the optical practice using the following incident classification system described below. For consider the likely impact if the breach had occurred. Incident Classification: Insignificant: Minor: Moderate: Major: Critical: Minimal discernible effect Minor breach, for example Moderate breach, for Serious breach, for Serious breach in terms of on patients or the optical data lost but files example unencrypted example unencrypted volume of records, for practice. encrypted, less than 5 clinical records lost, up to clinical records lost, up to example over 1,000 patients affected. 20 patients affected. 1,000 patients affected or patients affected or particular sensitivity. e.g. particular sensitivity of mental health status records. Inconvenient to the Potential for damage to optical practice but the optical practice’s manageable. reputation. Potential for damage to Damage to the reputation the optical of the NHS and the practice’s reputation and/or local optical practice media coverage. profession. Potential for national media coverage. 3. Procedures for reporting incidents Incidents should be reported to the optical practice Information Governance lead. The Information Governance lead will determine whether there is also a need to report the incident to others depending on the type and likely consequences of the incident, e.g. inform the Police, the PCT, the optical insurer etc. Although there is no legal requirement practice’s to do this, where there is high risk of harm to patients, it is considered best practice to also inform the Information Commissioner. Document name: [Insert Company Name]: Information security assurance – role-based access Date created: Author: Approved by:
Categorise and report the incident as described as per ‘recording and reporting’ requirements 2. Procedures for recording incidents A record of all incidents, including near-misses, should be made by completing a copy of the information security incident report form. Incidents should be classified in the log according to severity of risk to patients and the optical practice using the following incident classification system described below. For consider the likely impact if the breach had occurred. Incident Classification: Insignificant: Minimal discernible effect on patients or the optical practice. Minor: Minor breach, for example data lost but files encrypted, less than 5 patients affected. Inconvenient to the optical practice but manageable. Moderate: Moderate breach, for example unencrypted clinical records lost, up to 20 patients affected. Potential for damage to the optical practice’s reputation. Major: Serious breach, for example unencrypted clinical records lost, up to 1,000 patients affected or particular sensitivity. e.g. mental health status Potential for damage to the optical practice’s reputation and/or local media coverage. Critical: Serious breach in terms of volume of records, for example over 1,000 patients affected or particular sensitivity of records. Damage to the reputation of the NHS and the optical practice profession. Potential for national media coverage. 3. Procedures for reporting incidents Incidents should be reported to the optical practice Information Governance lead. The Information Governance lead will determine whether there is also a need to report the incident to others depending on the type and likely consequences of the incident, e.g. inform the Police, the PCT, the optical practice’s insurer etc. Although there is no legal requirement to do this, where there is high risk of harm to patients, it is considered best practice to also inform the Information Commissioner. Document name: [Insert Company Name]: Information security assurance – role-based access Date created: Author: Approved by:
19%20-%20IGT%20Policy%20Bundle.docx