Data security awareness

Question 1

Effective information management enables teams to use their time, resources and expertise effectively to make decisions and to fulfil their roles. what are the 5

Answer 1

• collection
• sharing
• usage
• archiving
• disposal

Question 2

what sets regulations on the minimal time info must be kept before disposale

Answer 2

records management code of practice

Question 2

what does ICO stand for and what is their duty

Answer 2

• information commissioners office
• regulate and enforce data protection law in UK
• Offer advice and guidance, promote good practice, carry out audits, consider complaints, monitor compliance and take enforcement action, such as issuing fines, where appropriate.

Question 3

What are the 3 types of personal data

Answer 3

• personal data
• special category
• confidential

Question 4

define personal data

Answer 4

• info relating to living individual who can be identified from that e.g name or number

Question 5

define special category data

Answer 5

• info that needs more protection because its more sensitive
• e.g race, genetic data, biometric data, health data (sexual orientation)

Question 6

define confidential data

Answer 6

• info collected for provision of health and social care services where people can be identified and would expect it to be kept private
• e.g diagnosis, treatment, address

Question 7

confidential info is subject to legal and professional duty of confidentiality

Question 8

general principle that confidential info shouldn’t be shared for purposes other than direct care of individual with exceptions of?..

Answer 8

• individual has consented to sharing
• required to share by law/ permitted by law
• overriding public intrest

Question 9

maintaining confidentiality is responsibility of all staff working in health and care

Question 10

what is pseudonymisation/pseudonymised data

Answer 10

• security technique used to protect personal data.
• Pseudonymised data is information which has had identifiers replaced by one or more artificial identifiers, or pseudonyms, such as a hospital number.
• Pseudonymised data is still considered personal data.

Question 11

what is anonymised data

Answer 11

• Truly anonymised information or data cannot identify or re-identify an individual (directly or indirectly), either on its own or when combined with other information

Question 12

In most cases, it may be acceptable and appropriate to publish or share truly anonymous information, but you should check with your information governance team to make sure

Question 13

who has to follow data protection principles

Answer 13

Everyone responsible for using personal data has to follow strict rules specified under data protection law.

Question 14

what are the 7 data protection principles

Answer 14

1. lawful, fair and transparent
2. purpose limitation
3. data minimisation
4. accurate and kept up to date
5. storage limitation
6. security, integrity and confidentiality
7. accounted for

Question 15

whats meant by . lawful, fair and transparent

Answer 15

• Ensure you have a valid legal reason to use people’s information
• cant use if detrimental to individual
• acted in accordance with other laws or as expected
• be clear, open and honest

Question 16

what is meant by purpose limitation

Answer 16

• You must be clear from the outset about the purpose for using the information.

-only use the personal data for another purpose where this is compatible with your original purpose, or you get consent, or you have a clear obligation or function set out in law.

-You must inform people if you are going to use their information in a new way.

Question 17

whats meant by data minimisation

Answer 17

• You must ensure the personal data you are processing is:
• adequate: sufficient to properly fulfil the stated purpose
• relevant: has a rational link to that purpose
• not excessive: you do not use more than you need for that purpose.
• Only use or share the minimum amount of personal data necessary to achieve the intended purpose

Question 17

whats meant by accurate and kept up to date

Answer 17

• You should take all reasonable steps to ensure the personal data you hold is not incorrect or misleading
• You may need to keep the personal data updated, although this will depend on what you are using it for
• If you discover that personal data is incorrect or misleading, you must take reasonable steps to correct or erase it as soon as possible
• You must carefully consider any challenges to the accuracy of personal data

Question 18

whats meant by storage limitation

Answer 18

• You must not keep personal data for longer than you need it
• You need to think about, and be able to justify, how long you keep personal data. This will depend on your purposes for holding the data
• You should also periodically review the data you hold, and erase it when you no longer need it
• You must carefully consider any challenges to your retention of data
• You can keep personal data for longer if you are only keeping it for public interest archiving, scientific or historical research, or statistical purposes
• You should manage personal data in line with your organisation’s records or information management procedures and guidance and the Records Management Code of Practice for Health and Social Care

Question 18

whats meant by security, integrity and confidentiality

Answer 18

• You and/or your organisation must ensure that appropriate security measures are in place to protect the personal data held by your organisation or any other third party working on behalf of your organisation.
• Where your organisation is using or sharing personal data which may involve a high risk to individuals, including processing large volumes of health and care information, you will need to carry out a data protection impact assessment (DPIA) to identify and explain how you are managing those risks.

Question 19

define DPIA and when is it used

Answer 19

data protection impact assessment
- if theres a high risk associated with using or sharing personal data

Question 20

whats meant by accountability principle

Answer 20

• The accountability principle requires your organisation to take responsibility for what you do with personal data and how you comply with the other principles.

Question 21

what are the 9 rights of an individual associated with the data protection law

Answer 21

• informed
• access
• rectification
• erasure
• restirction
• data protability
• object
• automated decision making and profiling
• raise a concern

Question 22

what is a personal data breach

Answer 22

- breaches of security which lead to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Question 23

what steps can be taken to avoid personal data preach

Answer 23

- Read and comply with your organisation's policies on: Data protection Records management Security management - Complete relevant training and put your learning into practice - Apply core data protection, security, records management and confidentiality principles in your day-to-day processing of data -Use relevant best practice guidance -Assess the risks of your data use by completing a data protection impact assessment (DPIA) - Use relevant best practice guidance

Question 24

what 3 main areas can data security be broken down into

Answer 24

1. confidentiality 2. integrity 3. availability

Question 25

what is confidentiality

Answer 25

- privacy and ensuring that information is only accessible to those who have a legitimate reason to see it.

Question 26

what is integrity in terms of data

Answer 26

- information being accurate, up-to-date and reliable.

Question 27

what is availability in terms of data

Answer 27

- information being there when it is needed: to support care, to pay staff wages, or for any other legitimate purpose.

Question 28

what is SCR

Answer 28

summary care record - electronic record of ppls info sourced from GP record - can see medication and medical history etc

Question 29

what is social engineering

Answer 29

- those who want to steal data, such as health and care records, either digital or physical, by using tricks or deception to manipulate people into giving access to that data and other valuable information.

Question 30

what are 4 ways people may gain ur trust to undergo social engineering

Answer 30

- preparation (finding number or info through social networking sites) - in office (asking to hold door cuz they didnt bring key) - on phone ( can call and pretend to be fellow employee or police etc) - online ( fun quizzes to find out more about u, emails etc)

Question 31

what are 3 ways hackers can get ur info via email

Answer 31

1. click on link ( and u enter ur information etc) 2. open attachment (runs malicious code on ur computer giving them access) 3. unknowingly install malware ( steal data thru this or lock it and ask for ransom)

Question 32

what is phishing

Answer 32

to force users to make a mistake for, example, by imitating a legitimate company’s emails or by creating a time-limited or pressurised situation

Question 33

Phishing email attachments or websites might ask you to enter personal information or a password, or they could start downloading and installing malware. Do not install any new software unless you are advised to do so by your line manager, ICT department or provider.

Question 34

what should you do if u think you've received phishing emails etc

Answer 34

you must contact your manager and ICT department or provider for advice immediately

Question 34

what are some signs of a phishing email

Answer 34

- incorrect sender name - multiple receivers of the same email - spelling gramma etc - asking for personal info - asking to download stuff (esp when they wouldn't usually ask for that) suspicious attachments - links

Question 35

what is malware

Answer 35

- can reside on computer without detection making it easier for someone to be active on ur system without u knowing

Question 36

what are macros

Answer 36

- series of actions a program performs to work out some formulas - your computer will disable macros by default as they can be programmed to install malware

Question 37

how do u protect ur system from malware

Answer 37

- up-todate antivirus software installed

Question 38

malware can make computers run slow or perform unusually

Question 39

what are 2 forms of good practice for data safety

Answer 39

- vigilant on websites declared as untrusted - strong passwords and different passwords on different sites

Question 40

what are safety measures to take on ur wifi

Answer 40

- Change default passwords - Use encryption - WPA2 is a type of encryption used to secure the vast majority of Wi-Fi networks - Use password managers - Disable auto connect to unknown Wi-Fi networks - Update phones and devices with latest patches

Question 41

Staying safe online: - Passwords protect your device - Use personal hotspot for internet access - Keep belongings close by - Do not assume Wi-Fi hotspots are secure - Sit where you are not overlooked or use a privacy screen on your laptop - back against the wall is best - Keep paperwork or documents to a minimum - Do not discuss confidential data on the phone where you may be overheard

Question 42

Press the Windows key + L on your keyboard to quickly lock your laptop or PC.

Question 43

Do not use unauthorised USB drives and mobile devices and avoid plugging in any non-approved devices to charge via USB cable.

Question 44

Using untrusted USB drives on your work computer can introduce malicious software and allow an attacker access to your network.

Question 45

what are 3 principles part of the clear desk policy

Answer 45

- Do not leave information such as documents that identify someone or financial details in unsecure locations - Having a clear desk ensures that you are not potentially leaving sensitive information lying around, raising the risk of a breach - A clear desk policy reduces the risk of data loss by ensuring no confidential or commercial information is left unattended throughout the workplace

Question 46

what are 3 things you must be wary of when working from home on video calls

Answer 46

- blurring backgrounds incase of sensitive info on walls - mindful of conversations in shared house going on - mindful to treat home workspace as much as work as possible

Question 47

what is the purpose of Caldecott principles

Answer 47

- intended to guide organisations on the use of confidential information within health and social care organisations and when such information is shared with other organisations or individuals

Question 48

what are caldicott guardians

Answer 48

senior people within an organisation who protect the confidentiality of people's information by considering the ethical and legal aspects of data sharing

Question 49

- justify purpose for use of confidential info - dont use confidential info unless necessary - use min necessary info - access to confidential info should be on strict need to know basis - everyone with access to confidential info should be aware of their responsibilities - comply with law - duty to share info can be as important as the duty to protect confidentiality - inform patients and service users about how their info is used

Question 50

what are the 3 techniques to follow when informing people their data is used

Answer 50

- explain (how and point to add info) - choices (let them know their choices in how info is used+ how it affects them) - meet expectations (only use data in ways they'll expect or in ways it'll help)

Question 51

when do u have legal duty to share information

Answer 51

- it it'll assis in care of individual concerned and - if its reasonable to believe the concerned individual understand why its shared

Question 52

3 checkpoints when sharing patient info is?

Answer 52

1. check patients ok and comfortable with info shared 2. ensure data protection, record keeping and security best practice is met 3. respect objections

Question 53

what is NDG

Answer 53

national data guardian - advises and challenges the health and care system to help ensure that people's confidential information is safeguarded securely and used properly.

Question 54

what is the national data opt-out

Answer 54

- allow people to choose whether their confidential information is used for research and planning purposes

Question 55

what are the 3 types of personal data breaches

Answer 55

- confidentiality breach (unauthorised or accidental disclosure of, or access to, personal data) - integrity breach (unauthorised or accidental alteration of personal data.) - availability breach (accidental or unauthorised loss of access to, or destruction of, personal data.)

Question 56

make sure that all correspondence containing personal data is always addressed to a named person

Question 57

give some examples of cyber and non-cyber incidents

Answer 57

cyber = brute force, malware, phishing, ransomware etc non-cyber = altering data, wrong recipient, loss and theft of info, insecure disposal of paperwork etc

Question 58

assess the risks of posting paper records which include personal data and use this method only where it is absolutely necessary, secure and appropriate to do so. Consider using tracked or recorded delivery

Question 59

Only send case notes and other bulky material in robust, approved packaging, never in dustbin sacks, carrier bags or other containers. Don’t leave the packages unattended unless they are securely stored, when waiting for collection.

Question 60

what are 5 things to consider when sending an email to patients

Answer 60

- if insecure check the service user understands risks - ensure everyone is content with sensitive and confidential info being kept secure - check everyone on copy list is a need to know on info being sent - check with line manager if u can send in that way - confirm accuracy of email addresses for all intended recipients

Question 61

If a request for information is made by phone you should, where possible, adhere to the following processes and procedures.

Answer 61

Confirm the name, job title, department and organisation of the person requesting the information Confirm that the reason for the information request is appropriate Find a contact telephone number that you know is correct for the organisation - such as the main switchboard number - so you can call back and ask for the named individual, to confirm that the caller is genuine Check whether the information can be provided. If in doubt, tell the person you will call them back Only provide the information to the person who requested it. Do not leave

Question 62

what are the 4 steps of the information management lifecycle

Answer 62

1. creation 2. use 3. retention 4. disposal decision (usually destruction)

Question 63

who is in charge of disposing devices

Answer 63

ICT department or provider

Question 64

When disposing of records, it is important to obtain a record of its disposal. This could be a certificate of destruction (so it is clear that the record has been destroyed, rather than misplaced), or an accession notice (when records are deposited with the local Place of Deposit or the National Archives, for long-term archival preservation).

Question 65

what is the freedom of information

Answer 65

Freedom of Information (FOI) Act 2000 [7] provides public access to information held by public authorities.

Question 66

The Freedom of Information Act requires every public authority to have a publication scheme, approved by the Information Commissioner’s Office (ICO), and to publish information covered by the scheme. The scheme must set out your organisation’s commitment to make certain classes of information routinely available, such as policies and procedures, minutes of meetings, annual reports and financial information.

Question 67

what are 2 duties of the organisation when asked for information under the freedom of information act

Answer 67

An organisation has 2 separate duties when responding to requests: - To tell the applicant whether they hold any information falling within the scope of their request - To provide that information, unless there is a legitimate reason not to disclose (where an exemption applies)