DSP & IG Board Training

Who is responsible for reporting an incident on Datix when it has occurred?

• The Caldicott Guardian

• The Police

• The person who identified the incident

• The patient

Answer explanation

The person who identified the incident should report it on Datix or tell their line manager to ensure it is reported

Who is responsible for providing advice and guidance to the Trust in all matters related to Data Security & the GDPR

• The DPO

• The SIRO

• Receptionists

• Information Asset Owners

Answer explanation

The DPO has specific responsibilities in line with Article 39 of the UK GDPR for data protection compliance, data protection policies, awareness raising, training and audits. The DPO has expert knowledge of data protection law and practices.

Which role ensures that personal information is legally, ethically & appropriately shared?

• Ward Clerks

• The Chief Executive

• The SIRO

• The Caldicott Guardian

Answer explanation

A Caldicott Guardian is a senior person responsible for protecting the confidentiality of people's health and care information and making sure it is used properly. All NHS organisations and local authorities which provide social services must have a Caldicott Guardian.

Who has the delegated responsibility for the management of information risk?

• The Director of Governance

• The SIRO

• The risk owner

• The DPO

Answer explanation

The SIRO will provide an essential role in ensuring that identified information security risks are followed up and incidents managed and should have ownership of the Information Risk Policy and associated risk management strategy and processes.

Which of these is a secure email transaction?

• NHS.Net to NHS.Net

• NGH.NHS.UK to NHS.Net

• NHS.Net to yahoo.com

• NGH.NHS.UK to gmail.com

Who is the most likely to be targeted by a Whaling attack?

• A Receptionist

• A Patient

• A Board Member

• A Nurse

What is the maximum fine possible to be administered under the GDPR?

• €20m or 4% of annual turnover (whichever is greater)

• £30,000

• £4,000,000

Answer explanation

The UK GDPR and DPA 2018 set a maximum fine of £17.5 million or 4% of annual global turnover – whichever is greater – for infringements. Th EU GDPR sets a maximum fine of €20 million (about £18 million) or 4% of annual global turnover – whichever is greater – for infringements.

When an external consultancy firm has offered to conduct significant service improvements by reviewing large patient data sets, what 3 things are necessary before proceeding to be GDPR compliant.

• Data Protection Impact Assessment (DPIA)

• An NGH email account

• Full access to the data

• A Contract with the consultancy firm

• Information Sharing Agreement (ISA)

Answer explanation

Always introduce the IG Team at the infancy of a project to ensure the team supports in a timely manner

Which is the newest Caldicott Principal released in December 2020?

• The duty to share information for individual care is as important as the duty to protect patient confidentiality

• Comply with the law

• Access to confidential information should be on a strict need-to-know basis

• Inform patients and service users about how their confidential information is used

Answer explanation

Principal 8: A range of steps should be taken to ensure no surprises for patients and service users, so they can have clear expectations about how and why their confidential information is used, and what choices they have about this. These steps will vary depending on the use: as a minimum, this should include providing accessible, relevant and appropriate information - in some cases, greater engagement will be required.

How quickly must a Serious Data Security Incident be reported to the Information Commissioners Office (ICO) from the point it is identified

• 72 days

• 72 hours

• 72 minutes

• 2 weeks

Answer explanation

By law, you've got to report a personal data breach to the ICO without undue delay (if it meets the threshold for reporting) and within 72 hours.