Annual Report and Accounts - The Great Western Hospital

14.4.6 Organisation Culture
The Trust operates a Being Open Policy and has mechanisms in place to promote a culture in which
staff are supported to be open with patients when things go wrong. The Trust also operates a
Whistle Blowing Policy which encourages staff to come forward with concerns.
During 2011/12 the requirements for reports to the Board and its Committees were reviewed which
included the introduction of quality impact assessments for all papers, with any areas of concern
highlighted and addressed. Equality and quality impact assessments were also introduced for
policies and Trust wide procedural documents, thus ensuring that equality and quality considerations
are core to the Trust’s overall policy framework and business.
14.4.7 Information Risk
Risks to information, including data confidentiality, integrity and availability, are managed and
controlled through an Information Governance Steering Group, which reports into the Audit, Risk and
Assurance Committee. The Trust has a Senior Information Risk Owner (SIRO) with responsibility for
the Information Risk Policy which defines an overall structured approach to the management of
information risk, in line with the Risk Management Strategy. A register of Information Assets is
maintained with senior managers identified as asset owners with for operational management of the
assets and ensuring the principal risks are identified, assessed and regularly reviewed, and they
provide annual assurance reports of the satisfactory operation and security of the information assets.
Where assessed as appropriate, risk treatment plans are actioned, additional controls are
implemented, and prioritised risks are escalated to the appropriate Risk Register. As Accounting
Officer I am committed to ensuring that immediate actions are taken where significant risks have
been highlighted.
A range of measures is used to manage and mitigate information risks, including: staff training,
privacy impact assessments, physical security, data encryption, access controls, penetration testing,
audit trail monitoring, departmental checklists and spot checks. In addition, a comprehensive
assessment of information security is undertaken annually as part of the Information Governance
Toolkit and further assurance is provided from Internal Audit and other reviews.
The effectiveness of these measures is reported to the Information Governance Steering Group. This
includes details of any personal-data-related Serious Incidents (SIs), the Trust’s annual Information
Governance Toolkit score, and reports of other information governance incidents, audit reviews and
spot checks.
14.4.8 Stakeholder involvement
As a foundation trust our membership is a resource for supporting risk management in the Trust. The
membership is represented by governors who attend regular formal meetings with the Board of
Directors and Trust staff. In particular the governors hold the Trust to account via various working
groups, such as the Patient Experience Working Group and the Finance Working Group which both
meet quarterly.
The governors contributed to the development of the Trust’s quality strategy through a patient safety,
quality and satisfaction working group. The strategy was developed in 2009/10 and is for five years
ending in 2015.
Page 167 of 211