Introduction

The following procedure ensures that we consistently manage any data breaches that impact personal identified information, ensuring we notify the relevant stakeholders in a timely manner and take any learning from the incident.

Types of breach

An incident is an event or action which may compromise the confidentiality, integrity or availability of systems or data, either accidentally or deliberately, and has caused or has the potential to cause damage to data subjects.

An incident includes but is not restricted to:

1. Loss or theft of personal data or the equipment on which the data is stored e.g. laptop, memory stick, smartphone, or paper record

1. Theft or failure of equipment on which personal data is stored

1. Unauthorised use of or access to personal data

1. Attempts to gain unauthorised access to personal data

1. Unauthorised disclosure of personal data

1. Website defacement

1. Hacking attack

Reporting an Incident

Any person using personal data on behalf of GP-Billing is responsible for reporting data breach incidents immediately to an Executive Director.

The report should contain the following details:

1. Date and time of discovery of breach

1. Details of person who discovered the breach

1. The nature of the personal data involved

1. How many individuals’ data is affected

Containment and Recovery

The Executive Director will first ascertain if the breach is still occurring.  If so, appropriate steps will be taken immediately to minimise the effects of the breach.  An assessment will be carried out to establish the severity of the breach and the nature of further investigation required, using the table below as a guide: 

 
Consideration will be given as to whether the police should be informed.  Advice from appropriate experts will be sought if necessary.  A suitable course of action will be taken to ensure a resolution to the breach.

Investigation and Risk Assessment

An investigation will be carried out without delay and where possible within 24 hours of the breach being discovered. The Executive Director will assess the risks associated with the breach, the potential consequences for the data subjects, how serious and substantial those are and how likely they are to occur.

The investigation will consider the following:

1. The type of data involved and its sensitivity

1. The protections in place (e.g. encryption)

1. What has happened to the data

1. Whether the data could be put to illegal or inappropriate use

1. Who the data subjects are, how many are involved, and the potential effects on them

1. Any wider consequences

Notification

The Executive Director will decide with appropriate advice who needs to be notified of the breach.  Every incident will be assessed on a case-by-case basis.  Consideration will be given to notifying the Information Commissioner, or Data Controller, if many people are affected or the consequences for the data subjects are very serious.

Guidance on when and how to notify the ICO is available on their website:

www.ico.org.uk/media/1536/breach_reporting.pdf

Notification to the data subjects whose personal data has been affected by the incident will include a description of how and when the breach occurred, and the nature of the data involved.  Specific and clear advice will be given on what they can do to protect themselves and what has already been done to mitigate the risks. 

In most cases, it would be more appropriate for GP-Billing to inform their clients of the breach, including all relevant details that will allow data subjects to protect themselves. Notification to clients should occur as soon as possible and within 2 hours of confirmation of the breach.

The Executive Director will keep a record of all actions taken in respect of the breach.

Evaluation and Response

Once the incident is contained, the Executive Director will carry out a review of the causes of the breach, the effectiveness of the response, and whether any changes to systems, policies or procedures should be undertaken.   Consideration will be given to whether any corrective action is necessary to minimise the risk of similar incidents occurring. 

Further Reading

For NHS clients:

https://www.dsptoolkit.nhs.uk/Help/incident-reporting

Procedure Review

This procedure has been approved by an Executive Director and must be reviewed by 1^st December 2023