10 Data Security Standards

In 2017, the Department of Health and Social Care put in policy that all health and social care providers must follow the 10 Data Security Standards. These were developed by the National Data Guardian https://www.gov.uk/government/organisations/national-data-guardian

The standards are organised under 3 leadership obligations.

The 10 Data Security Standards

People


Ensure staff are equipped to handle information respectfully and safely, according to the Caldicott Principles.

Process


Ensure the organisation proactively prevents data security breaches and responds appropriately to incidents or near misses.

Technology


Ensure technology is secure and up to date.
1. All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes. 4. Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access data to personal confidential data on IT systems can be attributed to individuals. 8. No unsupported operating systems, software or internet browsers are used within the IT estate.
2. All staff understand their responsibilities under the National Data Guardian's Data Security Standards including their obligation to to handle information responsibly and their personal accountability for deliberate or avoidable breaches. 5. Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.9. A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.
3. All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit6. Cyber attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection. 10. IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian's Data Security Standards.
7. A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.