Folder View

This policy describes how the Trust will ensure Clinical Safety with Clinical IT systems and maintain compliance with published standards DCB0129 & DCB0160

Cyber Security Strategy 2024-2026

Outlines those activities required to ensure Information is managed in a secure way.

To provide direction and support to all staff members on information technology security in accordance with business requirements, NHS guidance and relevant laws and regulations.Keywords: Security, Controls, Incident, Disposal, Breach, Governance.

The purpose of this document is to outline the agreed processes required (including any emergency processes required as part of the response to a major incident) to support the Electronic Staff Record (ESR) Interface within Cornwall Partnership NHS Foundation Trust (CFT) and Royal Cornwall Hospital Trust (RCHT) and Care Identify Management (CIM) itself across the Trusts. The document will also provide guidance to ensure that relevant applications continue to be operated safely and efficiently through future developments.The document is not intended to be an exhaustive review of all Human Resources (HR) and Registration Authority (RA) processes and procedures but rather will focus on necessary changes to the following key elements:• Vacancy control process.• New starter setup (from acceptance of offer of employment).• Managing changes to person details, assignments and positions.• Leaver process.• Access control.

Failure to deliver the Trust wide Maxims electronic patient record could have a detrimental effect on patient care and patient safety. This plan describes the arrangements needed to recover from a system failure and maintain services that rely on Maxims availability.

This policy sets out the requirements for the use of Multi-Factor Authentication as a cyber security control to establish a consistent minimum expectation. The requirements of this policy are incorporated into the mandated principles of the Data Security and Protection Toolkit (DSPT, CAF-DSPT, DSP Toolkit). The objective of this policy is to promote and ensure the widespread use of MFA as a fundamental cyber security control, in order to manage the data security risks associated with user credential compromise.Keywords: Authentication, login, admin, administrator, privileged, root, superuser.

The procedure aims to outline the process to be followed in order to provide a temporary clinician with access to an IT account for the use of clinical IT systems in practice, whilst outlining the risks inherent within the process.

Sets out the manual processes needed to be put in place to capture information in a structured way if the patient administration system fails. This will ease retrospective data entry once the system is back up and running.