Information Governance / GDPR

Is there a robust system for logging, investigating, and reporting data breaches and near misses?

What we look for: Review the breach log. Good looks like all minor incidents (e.g., email sent to wrong person) are logged, investigated, and learning is shared. Fail: no log exists or failure to notify the ICO when required.

Evidence: Data breach log, incident reports, ICO notification records, post-incident reviews

Do all staff receive comprehensive training on data protection, confidentiality, and GDPR upon induction and annually?

What we look for: Sample the training matrix for 5-10 staff. Good looks like 100% compliance with annual IG/GDPR refreshers, plus checks during supervision. Fail: staff handling sensitive data without valid training.

Evidence: Training matrix, GDPR training certificates, induction checklists, spot check records

Are people who use the service provided with accessible privacy notices explaining how their data is used?

What we look for: Review the welcome pack. Good looks like clear, easy-to-read privacy notices explaining data sharing (e.g., with GPs/LAs) and individuals' rights. Fail: no privacy notice or heavily jargon-filled text.

Evidence: Service user guide, Privacy Notice, Consent forms, introductory packs

Are comprehensive Information Governance and GDPR policies in place and reviewed annually?

What we look for: Review the core IG policies. Good looks like policies that are tailored to domiciliary care, up-to-date with current legislation, and accessible to staff. Fail: generic, out-of-date policies.

Evidence: Data Protection Policy, GDPR Policy, Subject Access Request Procedure, Information Sharing Policy

Has the provider successfully completed and published an annual Data Security and Protection Toolkit (DSPT)?

What we look for: Check the DSPT status online or ask for the certificate. Good looks like 'Standards Met' or higher within the last 12 months. Fail: unpublished DSPT or missing action plans for unmet standards.

Evidence: DSPT publication certificate, DSPT action plan, DSPT submission confirmation

Are physical records (e.g., paper care plans, staff files) stored securely to prevent unauthorized access?

What we look for: Walk around the office. Good looks like locked cabinets for staff/client files and a clear desk policy. Ensure care plans left in clients' homes are kept respectfully. Fail: loose files left out.

Evidence: Office security walkaround, locked filing cabinets, clear desk policy, archived record storage

Are digital care records, mobile devices, and systems protected by robust access controls and passwords?

What we look for: Check how digital systems are accessed. Good looks like unique logins (no sharing), complex passwords, and remote wipe capabilities for staff phones. Fail: shared generic logins or unlocked PCs.

Evidence: IT security policy, mobile device management (MDM) software evidence, password policy, staff leaver checklist

Are records retained for appropriate legal timeframes and destroyed securely when no longer needed?

What we look for: Review the retention schedule and disposal methods. Good looks like clear timelines (e.g., care records kept for 3 years post-discharge) and use of cross-cut shredders or secure waste contractors. Fail: hoarding old files indefinitely.

Evidence: Data Retention Schedule, confidential waste bins, certificates of secure destruction