Staff and Others with Access to Information. Each organisation must have in place internal operational policies and procedures that will facilitate the effective processing of personal information which is relevant to the needs of the organisation, its managers, staff and users. Staff contracts must contain appropriate confidentiality clauses that detail possible consequences of unauthorised or inappropriate disclosure of personal information. Staff should be made aware of the DPA offences outlined in Appendix A. Each organisation must ensure that all relevant staff receives training, advice and ongoing support in order to be made aware, and understand the implications of: - This GISPA and SISAs. This should include any associated procedural requirements arising from their implementation; - The law which applies generally and in relation to the performance of the specific statutory powers and functions of the participating organisation concerned; - Any Codes of Practice or other associated legislation, regulations and guidance. Each organisation must have in place disciplinary procedures which could be invoked if a member of staff intentionally breached the confidentiality of a service user or intentionally shared information in a manner that is incompatible with current Data Protection legislation. Where a partner organisation relies on a third party to process personal information on their behalf, the organisation must have an appropriate contract in place.
Staff and Others with Access to Information. Each organisation must have in place internal operational policies and procedures that will facilitate the effective processing of personal information which is relevant to the needs of the partners, its managers and practitioners, and compliance with Caldicott Principles.
Staff and Others with Access to Information. Each organisation must have in place internal operational policies and procedures that will facilitate the effective processing of personal information which is relevant to the needs of the partners, its managers and practitioners. Staff contracts must contain appropriate confidentiality clauses that detail possible consequences of unauthorised or inappropriate disclosure of personal identifiable information. Each organisation must ensure that all relevant staff receive regular training, advice and ongoing support in order to be made aware, and understand the implications, of: This ISP and the operational protocol. This should include any associated operational requirements arising from their implementation; The law which applies generally and in relation to the performance of the specific statutory powers and functions of the participating partner concerned; The Data Protection Act, the Human Rights Act and the Common Law Duty of Confidentiality; Codes of Practice and any other associated regulations and guidance. Each organisation must have in place disciplinary procedures which may be invoked if a member of staff is found to have breached the confidentiality of a prisoner or to have shared information in a manner in contravention of this ISP. Where a partner relies on a third party to process personal information the organisation must have in place appropriate contractual data processing and confidentiality agreements. Each organisation must consider and document the impact on individuals’ privacy before developing any new IT system or changing the way they handle personal information. MANAGING THE AGREEMENT Structure of the Agreement The information sharing agreement is in two parts: Information Sharing Protocol (ISP) – sets out the high level basis of the agreement including the legal basis, the structure and management of the partnership and the partners’ responsibilities. This part is of most relevance to the senior management of the partner organisations. Operational Protocol– sets out the details of what data is being shared, how it is shared, who is allowed access to it and what safeguards are in place to keep it secure. This part is of most relevance to the operational staff who exchange information on a day to day basis. The Information Sharing Protocol will be signed by senior representatives of the partners. The Operational Protocol, will be a separate working document for operational staff. It is anticipated that the Operational Protocol may...
