Incidents should be classified in the log according to the severity of risk to patients and the pharmacy using the following incident classification system described below. For consider the likely impact if the breach had occurred. You must document any personal data breaches, as even if they are not notified to the ICO. The ICO may inspect your records to verify you are keeping such records. Incident or personal data breach classification: Insignificant: Moderate: Major: Critical: (very low risk) (low risk) (Likely to result (Consider (Likely to result in a risk to the whether likely to in a high risk to rights and result in a high the rights and freedoms of risk to the rights freedoms of patients) and freedoms of patients) patients) Minimal risk Minor breach, Moderate Serious breach, Serious breach in for example data breach, for for example terms of volume effect on patients lost but files example unencrypted of records, for or the pharmacy encrypted, less unencrypted clinical records example over than 5 patients clinical records lost, up to 1,000 1,000 patients affected lost, up to 20 affected affected or patients patients affected or particular particular sensitivity sensitivity of records Not reported to Not reported to Reported to ICO Reported to ICO Reported to ICO ICO ICO No patients No patients Communication Communication Communication informed informed to patients to patients to patients likely considered considered Recorded as a Recorded as a Recorded as a Recorded as a Recorded as a personal data personal data personal data personal data personal data breach breach breach breach breach
Incidents should be classified in the log according to the severity of risk to patients and the pharmacy using the following incident classification system described below. For consider the likely impact if the breach had occurred. You must document any personal data breaches, as even if they are not notified to the ICO. The ICO may inspect your records to verify you are keeping such records. Incident or personal data breach classification: Insignificant: (very low risk) Minimal risk effect on patients or the pharmacy Not reported to ICO No patients informed Recorded as a personal data breach (low risk) Minor breach, for example data lost but files encrypted, less than 5 patients affected Not reported to ICO No patients informed Recorded as a personal data breach Moderate: (Likely to result in a risk to the rights and freedoms of patients) Moderate breach, for example unencrypted clinical records lost, up to 20 patients affected Reported to ICO Communication to patients considered Recorded as a personal data breach Major: (Consider whether likely to result in a high risk to the rights and freedoms of patients) Serious breach, for example unencrypted clinical records lost, up to 1,000 patients affected or particular sensitivity Reported to ICO Communication to patients considered Recorded as a personal data breach Critical: (Likely to result in a high risk to the rights and freedoms of patients) Serious breach in terms of volume of records, for example over 1,000 patients affected or particular sensitivity of records Reported to ICO Communication to patients likely Recorded as a personal data breach
Workbook-for-Community-Pharmacy-Part-3-Version-1.docx