EPR Information Governance Lead

Job description

Job responsibilities

Key Responsibilities:

The postholder will act as the Information Governance lead and subject matter expert within the EPR Programme, providing strategic and operational oversight of all data protection and confidentiality matters. They will ensure that information governance principles are embedded across all programme workstreams, supporting the safe and compliant implementation of the new EPR. This includes advising on data protection by design, managing privacy risks, assuring supplier compliance, and supporting the Trusts statutory obligations under the UK GDPR and Data Protection Act 2018. The role will also promote a culture of good information handling practices across the organisation, working closely with clinical, operational, and technical teams to enable the effective and lawful use of information within the new digital environment.

1. Information Governance Leadership

Support the DPO by leading on all IG-related activities across the EPR Programme lifecycle, from procurement and design to go-live and post-implementation.

Provide specialist advice and assurance to the EPR Programme Board, SRO, and Programme Director on IG and data protection risks, controls, and mitigations.

Develop and maintain programme-level IG artefacts including:

Data Protection Impact Assessments (DPIAs)

Data Sharing / Processing Agreements

Privacy Notices and Records of Processing Activities

IG Risk Registers and Mitigation Plans

Embed data protection by design and by default principles in all new workflows, integrations, and supplier relationships.

Ensure all IG artefacts gain appropriate internal approval

2. Data Protection Compliance

Ensure that the EPR Programme aligns with UK GDPR, the Data Protection Act 2018, and NHS guidance.

Support the DPO in monitoring and evidencing compliance, and ensure all relevant activities are reflected in the Trusts Data Security and Protection Toolkit (DSPT).

Review and assure supplier contracts to ensure robust data processing clauses and lawful data sharing arrangements.

Lead on the management of IG incidents and support Root Cause Analysis (RCA) in relation to the programme.

3. Liaison and Partnership

Act as the key point of contact for all IG and data protection matters within the EPR Programme.

Work collaboratively with:

The Trusts DPO, SIRO, and Caldicott Guardian

Digital Security and Clinical Safety Officers

Legal and Procurement teams

Third-party suppliers (e.g., system vendors, integration partners)

Information Governance and Records Management teams across SLaM and the wider South London Partnership (SLP)

Ensure alignment with regional and national data protection standards and share best practice with other Trusts undertaking EPR implementations.

4. Assurance and Reporting

Develop and maintain programme-level IG dashboards and reports for governance forums (e.g. Programme Board, SIRO reports, and Trust Information Governance Group).

Provide expert input into programme risk registers and contribute to external assurance reviews (e.g., IG audits, compliance inspections).

Liaise with the Information Commissioners Office (ICO) where necessary, supporting the DPO in formal submissions.

5. Policy, Training, and Culture

Support the update and development of relevant Trust policies relating to data protection, confidentiality, and records management as they pertain to the EPR.

Promote an open and informed culture around data protection and IG awareness within the EPR Programme and wider clinical teams.

Develop and deliver IG training materials specific to the new EPR and associated change programmes.

Support embedding of the Caldicott and confidentiality principles within the systems design and rollout.

Person Specification

Qualifications

Essential

• Degree or equivalent experience. BCS Practitioner Certificate in Data Protection or equivalent.

Desirable

• MSc in Information Governance / Law / Health Informatics. Professional registration with IAPP or BCS.

Knowledge and skills

Essential

• Extensive knowledge of Information Governance and Data Protection within the NHS, including GDPR, DPA 2018, Caldicott Principles, DSPT. Experience leading IG in a large NHS digital transformation or EPR implementation. Experience interpreting complex legislation and applying it to digital and clinical workflows.
• Proactive, collaborative, and diplomatic. High integrity and commitment to confidentiality. Comfortable working in a complex and changing environment.
• Excellent interpersonal and influencing skills across technical and clinical teams. Strong analytical and report writing skills. Ability to manage competing priorities and deliver to tight deadlines.
• Extensive operational expertise and knowledge in Information Governance and Information Security principles and practices
• Knowledge and understanding of the NHS Data Security and Protection Toolkit
• Substantial management experience at a senior level
• Able to demonstrate a track record of achievement at a senior level
• Ability to provide and receive highly complex, highly sensitive or highly contentious information, where developed persuasive, motivational, negotiation, training, empathic or re-assurance skills are required.
• Ability to present complex, sensitive or contentious information to a large group
• Ability to make judgements on multi-stranded or complex IM&T problems which may have no precedent or where there are conflicting opinions
• Ability to manage, motivate and develop staff
• Collaborative approach and good team working

Desirable

• Previous experience of working directly with EPR systems (e.g., Cerner, Epic, RiO, CareNotes (ePJS)). Experience of multi-Trust or regional IG collaboration.
• Experience of line managing IG or data protection staff.

Disclosure and Barring Service Check

This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.

Certificate of Sponsorship

Applications from job seekers who require current Skilled worker sponsorship to work in the UK are welcome and will be considered alongside all other applications. For further information visit the UK Visas and Immigration website (Opens in a new tab).

From 6 April 2017, skilled worker applicants, applying for entry clearance into the UK, have had to present a criminal record certificate from each country they have resided continuously or cumulatively for 12 months or more in the past 10 years. Adult dependants (over 18 years old) are also subject to this requirement. Guidance can be found here Criminal records checks for overseas applicants (Opens in a new tab).

Employer details

Employer name

South London and Maudsley NHS Foundation Trust

Address

IOPPN

Lewisham sites

Denmark Hill

SE5 8AD

Employer's website

https://www.slam.nhs.uk/ (Opens in a new tab)