Access and Security Procedures. Partners to the Tier Zero will ensure that personal information is transferred and shared in a secure manner. Any electronic transfer or other risk media are the subject of local Data Sharing Agreements (Tier Two), and organisational Safe Haven Policy and procedures. Staff either representing the partners or who will facilitate this Tier One or related local Data Sharing Agreements (Tier Two) shall be identified by name. Those responsible for information sharing at an operational level shall also be named as part of any individual local agreements. Furthermore, it is the responsibility of the partner organisations to ensure that such information is always kept up to date. Staff representing the partners to the Tier Zero should only have access to personal information on a ‘need to know’ basis in order to perform their duties in connection with one or more of the defined purposes. Information must be used for the purpose for which it was obtained and only if it is appropriate and necessary to do so. Partners will take all reasonable care to both safeguard and protect the physical security of information technology and the data contained within it. They will ensure that mechanisms are in place to address the issues of physical security, security awareness and training, security management, systems development and system specific security policies. Evidence must be in the form of a local Strategy and/or an Information Security Policy. Formal adoption will follow the signing of the Tier Zero by a responsible person for each of the respective organisations. The Tier One will be freely available to any representative of any organisation that shares personally identifiable information with the partner organisations. Copies of the Tier Zero, Tier One and Tier Two will be lodged with the Cheshire and Merseyside STP Share2Care Programme Office. The Tier Zero must be supplemented by individual local Tier Two agreements pertinent to any specific information sharing arrangements. It is recommended that all these agreements/tiers be displayed on the organisation’s website for the information of staff and public alike. Also for public scrutiny to supplement information already provided to the general public on matters of information sharing.
Access and Security Procedures. (a) You agree to comply, and to cause your Designees to comply, with Access Methods that we or our Suppliers may issue or require from time to time for use of the Site and access to the Services and the Information, which may require you to establish a user name and password in order to use the Site. You are solely responsible for any use and unauthorized use of the Site and access to the Services caused by your or your Designee’s acts or omissions or arising by or through you or such Designee, including without limitation, (a) for ensuring that the Services and your Access Methods are provided to and used by only you and your Designees and (b) for any and all use and/or misuse of the Site or the Services by your Designees or any other person who accesses the Services or the Site using your Access Methods or Device, whether or not you have authorized them to do so. You may access the Site and the Services only through acceptable Access Methods.
(b) At our reasonable request, you shall provide us with a list of your Designees and their countries of domicile. If any Designee ceases to be associated with your organization or no longer requires access to the Site, or if your Access Methods have been lost, stolen or compromised, you will promptly notify us in writing immediately so that we may cancel relevant Access Methods. You agree to notify us immediately if you become aware of any disclosure, loss, theft, or unauthorized use of Client Information, your Device or other security tools or any loss, theft or unauthorized use of your Device. All transmissions generated by use of your Access Methods will be deemed authorized by you and made by you or your Designee whether or not we acknowledge receipt of such transmission. You agree to notify us immediately in the event that you learn or have reason to believe that any person to whom you have given access to the Site or the Services has violated or intends to violate the terms of this Agreement, and you agree that you will cooperate with us in investigating any unauthorized access or attempted access to the Site or the Services and in seeking injunctive or other equitable relief. You agree to discontinue use of the Site or the Services upon our request. We may restrict your access to the Site or the Services at any time for security or any other reasons or noncompliance with the terms of this Agreement, without liability to us or our Suppliers.
(c) Access to the Site and the Services may require transmission of ...
Access and Security Procedures. 6.1 The Project Sponsors will ensure that they have policies and procedures in place, which establish and maintain good security standards for information systems containing service user personal information. These policies and procedures will promote best practice in the management and operation of the systems and ensure that only properly authorised staff access personal information for appropriate purposes.
6.2 This document is not intended to replicate the provisions of the policies and procedures referred to above. However in storing and sharing information attention is drawn to the following:
(i) Paper records must be stored in locked cabinets in secure rooms. Keys must be kept securely and only be held by staff who require regular access to the records.
(ii) Computer equipment that can be used to gain access to service user personal information must be kept in secure locations with appropriate levels of password protections. Passwords must not be divulged to others.
(iii) Information stored on computer must be regularly backed up, with the back up copies stored in secure locations away from the computer.
6.3 The Project Sponsors will make sure that service users personal information is shared in a secure manner, in particular:
(i) Before sharing information by telephone the identify and authenticity of the recipient must be established.
(ii) Written communications should be transferred in a sealed envelope addressed to the designated recipient. The envelope should be marked ‘Personal and Confidential to be opened by the addresses only’. The designated recipient should be already to the despatch of the information and should make arrangements within their own organisation to ensure that the envelope is delivered to the unopened and that it is received within the expected timescale.
(iii) Transfer by fax must only be considered where there is no appropriate alternative available. It is the responsibility of the sender to make sure that the information is sent to the right fax machine. It is the responsibility of the recipient to retrieve the information from the fax machine from the fax promptly. The fax should be marked ‘Personal and Confidential – for the attention of (name of recipient) only’. The designated recipient should be alerted prior to dispatch of the information and should make arrangements to be available to receive the fax personally.
(iv) E-mail must not be used for the sharing of sensitive personal data until such time as appropriate ...
Access and Security Procedures
