April 1st 2009 to March 31st 2010

Information GovernanceComplianceInformation Governance allows organisationsand individuals to ensure that personalinformation is handled legally, securely,efficiently and effectively, in order to deliverthe best possible care. It additionally enablesorganisations to put in place procedures andprocesses for their corporate information thatsupport the efficient location and retrieval ofcorporate records where and when needed, inparticular to meet requests for information andassist compliance with Corporate Governancestandards.The Information Governance Committeeidentifies and manages information risks,which reports to the Healthcare GovernanceCommittee. The Deputy Chief Executive, who isalso the nominated Board Lead for InformationGovernance Risk and the Senior InformationRisk Owner for the Trust, chairs the InformationGovernance Committee.Compliance with Information Governancestandards is monitored using the InformationGovernance Toolkit and during 2009-10 theTrust achieved a rating of 87% compliance.In addition to the Toolkit the Trust is requiredto assess and report information risks anddata losses. During 2009/10 the Trust has beenworking to improve incident reporting andawareness of information security issues. Anumber of methods have been used includingan ongoing information flow mappingexercise supported by ward and departmentalinformation security and confidentiality reviews.System Administrators have been undertakinginformation risks assessments for individual coresystems to identify and manage informationrisks.During the financial year 2009-2010 the Trusthad 28 information security related incidentsreported all of which were rated at a level 0.Whilst the severity rating of these incidentswas rated at 0 all were thoroughly investigatedand reported upon. Note: Information Securityincidents are rated on a scale from 0-5, incidentsclassified as a severity rating of 3-5 are reportedas a serious untoward incident and reported toMonitor and the Information Commissioner.The table below provides a summary.Table 1: Summary Of Other Personal Data Related Incidents In 2009-10Category Nature of Incident TotalILoss of inadequately protected electronic equipment, devices or paperdocuments from secured NHS premises.0IILoss of inadequately protected electronic equipment, devices or paperdocuments from outside secured NHS premises0IIIInsecure disposal or inadequately protected electronic equipment, devicesor paper documents7IV Unauthorised disclosure 2V Other 19Annual Report and Accounts April 1st 2009 to March 31st 2010 43