September 21st 2021
Havering Care Homes operates two purpose-built nursing homes in East London. The group has used the Data Security and Protection Toolkit (DSPT) to assess and improve how they store and share information.
Initial hesitancy
Havering Care Homes had tried to use the old Information Governance Tool in the past – but they found it cumbersome and unhelpful. So they were hesitant to try the Data Security and Protection Toolkit but as Mike Armstrong, their Managing Director explains: “The revamped Data Security and Protection Toolkit is so much better. It feeds you information in bite-sized pieces and it’s supported by really clear guidance – all in a language that makes sense to social care providers.”
Equal access to health and care information
This small, privately-owned care group did not have a secure email system, so one of the main drivers for using the DSPT was to open up access to NHSmail.
Since 1 July 2021, care providers need to have reached at least Approaching Standards on the DSPT in order to be able to access NHSmail for the first time.
“It’s opened up another world for us,” says Mike. “We are now able to transfer information including really sensitive data and images, to our GPs and pharmacies directly using the NHSmail system. It’s so much more efficient and secure.”
As Havering Care Homes have reached Standards Met on the DSPT, they can also access NHS systems such as GP Connect which allows authorised nurses to view information held by a GP practice about a resident.
For Havering Care Homes, the DSPT is the key to opening equality of access to information between health and social care.
“Being able to appropriately and securely access the same information about the people that we mutually support is just crucial to improving the quality of care,” says Mike. “If you think about it, many of our residents will come via the hospital – but the discharge information is limited to that particular incident. In order to provide the most appropriate care as quickly as possible, we need to know so much more about them. Being able to access the GP records speeds all of that up and reduces the need to constantly ask questions about their history.
“Because we have been able to demonstrate to our NHS colleagues that we have good data protection systems in place by reaching Standards Met on the DSPT, they trust us to have access to that data. We can go straight to the record.”
And the nursing home staff are seeing the benefits of a wider range of digital and data systems. Remote monitoring, GP Connect, Co-ordinate My Care (at end of life) and the use of NHS numbers are all improving decision making about care based on better information.
The group has gone that step further and introduced Cyber Essentials technical controls to protect against common cyber attacks. If a care service indicates that they have Cyber Essentials Certification in place, several of the DSPT questions will be automatically completed. You don’t have to enter all of the same information into the different systems.
Challenging assumptions
Havering Care Homes also used the DSPT to check that they were on the right side of data protection legislation.
“We wanted to see if our data protection policies were robust enough”, says Mike. “And while we had good systems in place, we also identified some gaps. So now we have a clear process log and an information assets register. I wouldn’t have thought about those things before, but now we have them in place it helps to reassure our commissioners that we have worked so hard to reduce the risk of loss or misuse of the often sensitive data that we hold.”
Havering Care Homes were confident that their IT and paper records systems were secure before they used the DSPT. What they discovered was that although their policies and procedures were robust, the mindset of some staff needed to change.
“The DSPT makes you stop and think,” says Mike. “For example, it became apparent that some staff assumed that digitally stored information isn’t actually transferred. But of course it is shared digitally – it’s just not moved. So our knowledge and practice has really improved, as well as our paperwork and procedures.”
Leadership is key
One of the key lessons that Mike learned is that leadership is key: “If you, as a leader, take data protection seriously, then your staff will too. You need to point out the risks and the benefits: explain the reputational and financial risks of a cyber attack – as well as the huge benefits of being able to access information quickly.”
Further information
The Data Security and Protection Toolkit is an annual self-assessment of a care providers’ data and cyber security arrangements.
The freely-available Better Security, Better Care programme support care providers to review and improve their data protection and cyber security arrangements, by using the Data Security and Protection Toolkit. Find your local support partner.
Find out more about Havering Care Homes.
Book a place at our webinars on data protection, cyber security and shared records.
View all case studies