13. Fail to 3 3 9 Medium Policy & Procedures CAS Assessment - Ensure regular DoHRCS implement Information Records Management update on Data Apr -Mar robust information Governance / Records /ICT/Governance (I) & Protection and 2016 governance Mgt (E) Information refresher training is process. CA Standard Governance Group available. Audit Control Report (I) Service Risk Risk Register/ Action Reporting & Review (I) Plans GAC Audit Control Risk Owner Review (I) other CA Dir of HRCS A range of IG policies Standards Assessment Dirs renewed and agreed at (I) & (E) Mid-Year August, September & Assurance Statement / October 2013 Board GS (I) GAC Report (I) meetings. CX Review of Dirs Objectives (I) New IGMG sub-group New draft Information Action plan being DoHRCS BSO self-assessed as Type of risk: established to review Management Controls implemented and Apr -Mar Substantive Legislative / the new standard and Assurance Standard evidence gathered 2016 Compliance for Regulatory & compare with the has been issued by on ongoing basis. 15 in line with Performance current standard. DHSSPS who have Regular progress DHSSPS Management asked HSC reports to SMT. expectations. Assessment by Internal organisations for BSO to carry out Audit February 2014 comments. periodic checks of files and development of in transit. action plan. Audit planned for Autumn 2013 (I) Audits of record Internal Audit management policies Regular progress assessment of the underway as part of IG reports to SMT/Board Information Improvement Plan regarding action plans Management Controls to March 2016). (I) Assurance standard is due to be completed IG update to new Autumn 2015. Business Committee (Aug 2015). Transfer of BSO to information as (a) Guidance to be communicate a conduit sought from ICO on with Info Owners organisation how to manage to advise that all (especially sensitive medical medical to medical files information in transit be checked before
13. Fail to implement robust information governance process. Risk Owner Dir of HRCS Dirs Type of risk: Legislative / Regulatory & Performance Management Transfer of information as a conduit organisation (especially medical files 3 3 9 Medium Policy & Procedures Information Governance / Records Mgt CA Standard Audit Control Risk Register/ Action Plans A range of IG policies renewed and agreed at August, September & October 2013 Board meetings. New IGMG sub-group established to review the new standard and compare with the current standard. Assessment by Internal Audit February 2014 and development of action plan. Audits of record management policies underway as part of IG Improvement Plan to March 2016). (a) Guidance to be sought from ICO on how to manage sensitive medical information in transit CAS Assessment - Records Management /ICT/Governance (I) & (E) Information Governance Group Report (I) Service Risk Reporting & Review (I) GAC Audit Control Review (I) other CA Standards Assessment (I) & (E) Mid-Year Assurance Statement / GS (I) GAC Report (I) CX Review of Dirs Objectives (I) New draft Information Management Controls Assurance Standard has been issued by DHSSPS who have asked HSC organisations for comments. Audit planned for Autumn 2013 (I) Regular progress reports to SMT/Board regarding action plans (I) IG update to new Business Committee (Aug 2015). Ensure regular update on Data Protection and refresher training is available. Action plan being implemented and evidence gathered on ongoing basis. Regular progress reports to SMT. BSO to communicate with Info Owners to advise that all medical to be checked before DoHRCS Apr -Mar 2016 DoHRCS Apr -Mar 2016 BSO self-assessed as Substantive Compliance for in line with DHSSPS expectations. BSO to carry out periodic checks of files in transit. Internal Audit assessment of the Information Management Controls Assurance standard is due to be completed Autumn 2015. 15
Corporate_RA_Report_Oct_2015.docx