Page 1 of 5
Information Governance Policy
Responsible Officer Ben Bennett, Business Planning & Resources Director
Author Julian Lewis,
Governance Manager
Date effective from August 2009
Date last amended August 2009
Page 2 of 5
1 Summary
1.1 Information is a vital asset, both in terms of the Institute business and the efficient management of services and resources. It plays a key part in the Institute’s governance, service planning and performance management.
1.2 It is therefore of paramount importance to ensure that information is efficiently managed, and that appropriate policies, procedures and management accountability and structures provide a robust governance framework for information management.
1.3 This policy sets out the standards to be applied for effective information governance.
2 Principles
2.1 The Institute recognises the need for an appropriate balance between openness and confidentiality in the management and use of information. NICE fully supports the principles of corporate governance and recognises its public accountability, but equally places importance on the confidentiality of, and the security arrangements to safeguard, both personal information about staff and those we do business with and commercially sensitive and other confidential information. NICE also recognises the need to share personal and confidential information with other stakeholders and other organisations with whom we do business in a controlled manner consistent with the interests of the confidentiality and, in some circumstances, the public interest.
2.2 The Institute believes that accurate, timely and relevant information is essential to deliver the highest quality guidance. As such it is the responsibility of all staff to ensure and promote the quality of information and to actively use information in decision making processes.
3 Standards for information governance
3.1 There are four interlinked standards for the information governance policy: Openness Legal compliance Information security Quality assurance 3.2 Openness
3.2.1 Non-confidential information on the Institute will be available to the public via the Institute’s website, in line with the Institute’s Freedom of Information Act publication policy.
Page 3 of 5
3.2.2 The Institute will establish and maintain policies to ensure compliance with the Freedom of Information Act.
3.2.3 Any individual will be able to have access their personal information in accordance with the Data Protection Act 1998.
3.2.4 The Institute will have clear procedures and arrangements for liaison with the press and broadcasting media and for handling queries from the public
3.3 Legal Compliance
3.3.1 The Institute regards all identifiable personal information relating to staff or individuals with whom we do business as confidential except where such information is in the public domain or otherwise disclosable under the Freedom of Information Act 2000.
3.3.2 The Institute will establish and maintain policies to ensure compliance with the Data Protection Act 1998 and the common law of confidentiality.
3.3.3 The Institute will establish and maintain policies for the controlled and appropriate sharing of personal data with other agencies, taking account of relevant legislation and guidance from the Information Commissioner’s Office.
3.4 Information Security
3.4.1 The Institute will establish and maintain policies for the effective and secure management of its information assets and resources within the IT network.
3.4.2 The Institute will promote effective confidentiality and security practice to its staff through policies, procedures and training.
3.4.3 The Institute will establish and maintain incident reporting procedures and will monitor and investigate all reported instances of actual or potential breaches of confidentiality, loss of personal data and security incidents.
3.5 Information Quality Assurance
3.5.1 The Institute will establish and maintain policies and procedures for information quality assurance and the effective management of records.
3.5.2 Managers are expected to take ownership of, and seek to improve, the quality of information within their services.
3.5.3 Wherever possible, information quality should be assured at the point of collection.
Page 4 of 5
3.5.4 Data standards will be set through clear and consistent definition of data items, in accordance with national standards.
3.5.5 The Institute will promote information quality and effective records management through policies, procedures/user manuals and training.
4 Responsibilities
4.1 The Senior Information Risk Officer has ultimate responsibility for the Institute’s policy in respect of Information Governance, taking into account legal and NHS requirements.
4.2 The Governance Manager is responsible for overseeing Information Governance on a day to day basis, developing and maintaining policies, standards, procedures and guidance, coordinating work across the Institute and generally raising awareness of best practice in information governance.
4.3 Managers within the Institute are responsible for ensuring that the policy and its supporting standards and guidelines are built into local processes and that there is on-going compliance.
4.4 All staff, whether permanent, temporary or contracted, and contractors are responsible for ensuring that they are aware of the requirements placed on them and for ensuring that they comply with these on a day to day basis.
5 Assurance
5.1 All information governance policies and procedures will be subject to periodic audit to provide assurance to the Senior Management Team and Audit Committee that they are fit for purpose
6 Review
6.1 This policy will be reviewed every three years.
Related policies
Data Protection Policy Information Security Policy Records Management Policy Incident reporting policy Protective Marking Policy Information Charter
Page 5 of 5 Appendix A - Version Control Sheet
Version Date Author Replaces Comment
