Job responsibilities
Key operational results areas
- Work with the DPO to ensure the completion of the Trusts Data Security and Protection Toolkit assessment, collating evidence, and undertake compliance audits.
- To advise on and provide updates to IG and cybersecurity e-learning training to ensure staff have access to up to date and relevant IG and Data security and protection training.
- To ensure the development and delivery of the UK GDPR compliance action/improvement plans, monitor progress and report.
- To ensure the Trust's contractors and support organisations have adequate IG arrangements in place.
- To ensure the development of local information sharing agreements as required.
- To provide support/undertake date privacy impact assessments.
- To ensure fair processing notices are adequate for flows of personal confidential information.
- To support the Trusts Information Asset Owners in information asset management and assist with undertaking risk assessments.
- To support the management and response to information security incidents.
- To maintain on-going personal development and knowledge of data protection laws, issues and developments.
- Freedom to take actions as the lead specialist, based on own interpretation of policy, to conduct complex investigations into suspected or actual breaches of data protection and security and provide formal written reports advising how legislation and or policy should be interpreted directly to the Information Asset owner, Human resources business partner and service leads. These cases could lead to disciplinary action being taken against staff
- Participate in relevant internal and external working groups/projects, services and initiatives to provide information and analytical advice and expertise.
- Liaise with senior managers of stakeholder organisations, NHS cyber security teams, the Counter Fraud Service, the Police and external organisations, as required, when investigating incidents.
- Investigations into abuse of IT services such as internet and email may occasionally expose the post holder to distressing images and require the post holder to act as a professional witness in disciplinary hearings etc.
- The alignment of digital and operational processes with legislative, NHS and business security requirements.
- Work with the wider digital team in the Identification and management of data protection and data security risks ensuring that digital and operational services maintains compliance in line with the overall Trust corporate governance framework, designing and maintaining appropriate data protection and data security controls and plans with procedures for their operation and maintenance
- Work with services and digital teams to Identify and classify information assets and the level of control and protection required.
- Ensuring that the confidentiality, integrity and availability of trust information is maintained and the public trust in the organisation is promoted and maintained.
- Ensuring that all access to services by external partners and suppliers is subject to contractual agreements and appropriate responsibilities documented.
- Be responsible for a high standard of work supporting the delivery of Information Governance to quality standards and in a cost-effective manner. Maintain documentation and associated plans with regular team meetings to monitor progress and resources.
- Overseeing team members to deliver the requirements listed above; engage and liaise with key stakeholder, in particular:
- To support the delivery of day-to-day activities and projects
- Support the development and maintenance of a high performing IG team
- Advocate Data protection and cyber security during all interactions with staff across all roles and levels within the trust.
- Act as Information asset administrator for IG related assets including the Trusts Information asset register.
Customer care for patients and/or service users
- To act as a champion for patients and their interests in relation to data security and protection
- To ensure all staff and occasional public and patient contact with the office is of the highest professional standard
Leadership and management
- To provide line management for the IG team
- Be visible and available to provide support and guidance or the team and wider organisation staff . This will require on site working with a minimum of 2 days per week on site if a hybrid working pattern is adopted.
- Responsible for undertaking appraisal and personal development for staff within the team
- To support, motivate and develop staff within the team to ensure that they are able to deliver the trust and team objectives
- Liaise with other Managers to share best practice
- Plan, organise, deliver, and review regular IG and ad hoc stakeholder awareness workshops and training sessions on Data security and data protection that raise the awareness of staff of information governance issues and ensure their compliance with policies and procedures, ensuring the collaboration of Human Resources, Training, Data Protection and Information Governance Lead. Take personal responsibility for delivering some of these awareness training programmes. Develop materials to enable others to deliver training in a standard manner
Communications and working relationships
- The post holder will be a contact point in the organisation for IG and provide advice to IAOs, IAAs and liaise with the DPO, Caldicott Guardian and SIRO.
- Provide advice and take action, where necessary, in response to Audit findings and recommendations in respect of information governance.
- Work internally in the development and implementation of IG policies and procedures.
- Act as a consultant to projects, advising on matters relating to information governance & security.
- To work with the Associate CIO for IG and health records (DPO) to ensure that the Trust fully complies with relevant legislation, agreed policies and procedures.
- To deputise for the Associate CIO for IG and health records (DPO) as required in representing the Trust both on internal and external user groups ensuring that the Trust's priorities are effectively communicated, promoted and implemented.
- Ensure that Trust staff know how to report any data protection and data security breaches, incidents, malfunctions and suspected system weaknesses and threats.
- Management of IT security policies, and supporting set of policies, and their controls including their development and review and facilitation of their ratification
- Responsible for proposing and drafting changes, implementation and interpretation to policies and guidelines.
- Ensure that IT security and IG policy is enforced and communicated to all parties.
- Where necessary to liaise with external organisations on IT/cyber security matters, drafting and implementing joint policies and procedures and ensuring external network connections adhere to all appropriate security policies.
- Identify areas within the trust that are inadequately covered by IT/cyber security policies and procedures and, in consultation with operational manager IT specialists, and Data Protection Officer, develop new policies and procedures to cover these areas. Support Digital senior leads in presenting these to the relevant Boards or other approval bodies.
- The post holder will need to maintain a good knowledge of emerging policies from government departments. This will assist in the thinking and definition of the strategy discussions for the network and stakeholders.
Research and development
- Develop and implement ad-hoc audit programmes to test system and data security measures, review findings and improve those system and data security measures
- Plan, develop and evaluate methods and processes for gathering, analysing, interpreting and presenting data and information
