Safe Haven Procedure on Holding & Transmission of Personal, Confidential & Patient Identifiable Information

INTRODUCTION

 “Safe Haven” is a term recognised throughout the NHS to describe the system of safeguarding the confidential transfer of person or patient-identifiable information between organisations or sites in accordance with current legislation and guidelines.

Although ‘Safe Haven’ was initially used in the context of information transmission by fax machine, it now also includes data held and used with:

1. FUNCTION

1.1 This policy supersedes policy F1 The Use of Facsimile Transmission for Transfer of Personal Health Information.

1.2 To ensure that the confidentiality of ‘personal information’, ‘patient health information’ and ‘confidential business information’ is maintained when sending/receiving such information.

1.3 All Safe Haven Procedures relate to the parent policy – NHS Fife Data Protection (GP/D3)

2. LOCATION

2.1 This Policy and associated procedures are applicable to all staff and contractors working within NHS Fife.  It is offered as advice to independent GP, Dental, Pharmacy and Optometry Contractors.  It is acknowledged that the accountability arrangements of these independent contractors differ from those of NHS Fife employees, and therefore this policy must be seen as good practice guidance and used in conjunction with the requirements of their own professional body.

3. RESPONSIBILITY

3.1 All members of staff who, in the course of their duties, may transfer personal or confidential information have a responsibility to comply with this policy.

3.2 This policy is particularly  relevant to all staff who handle and transfer patient or person identifiable information.

3.3 The responsibility for ensuring compliance rests with line managers.

4.  OPERATIONAL SYSTEM

4.1 Staff must handle all information with care, and ensure that person and patient-identifiable information is not made available inappropriately or to unauthorised persons.

4.2 Person or patient-identifiable information is any data which can, by itself, or with other data, permit an individual to be identified.  However, care should also be taken to avoid unwittingly identifying people when referring to situations or events.  The following list is not meant to be exhaustive, but patient identifiable information will include:

4.3 Although ultimate responsibility for the safe transfer of person and patient identifiable information lies with the organisation (its procedures, policies and equipment), the sender must comply with these policies and procedures and use the equipment for the purposes provided.

4.4 Staff are individually accountable for their actions and, if under any doubt, guidance should be sought from the relevant supervisor or line manager before transmitting personal or patient-identifiable information. 

4.5 Staff must familiarise themselves with the relative procedures.  These are listed in 6. Related Documents.

4.6 Information on how to send confidential information by email is covered under NHS Fife Email Policy (GP/E6).

5.  RISK MANAGEMENT

Risks identified as a result of the implementation of this policy must be assessed and managed in accordance with the NHS Fife Risk Assessment and Risk Register Policies.  Any incident should be reported in line with NHS Fife Incident Management System Policy (GP/I2)

5.1 Control of Risk

5.1.2 Line managers must be made aware of the updated policy and must bring this to the attention of relevant staff.

5.1.3 It is intended that details of new policies will be placed on the front page of the Intranet.  Managers are encouraged to check this on a daily basis and inform staff of any new policies relevant to their area of responsibility.

5.1.4 Include Safe Haven in induction training.

5.2 Management of Risk

5.2.1 In a situation where an incident has occurred which could have or did lead to unintended or unexpected harm, loss or damage, staff must complete an NHS Fife Incident/Near Miss Reporting Form.  This is the first stage in a series of steps recording such incidents.  The NHS Fife Incident Management Policy (GP/I2) describes the procedures for incident reporting and follow up. 

5.2.2 Follow up will be as described in the Incident Management Policy and logged in the Risk Management Information System (Datix).  NHS Fife Incident Management Policy (GP1) should be referred to. 

5.2.3 Existing systems/working practices will be reviewed and amended where necessary.  Lessons learned as a result of such an approach will be shared.  

5.2.4 Amendments to this policy by improved working methodologies will be published on the Intranet and brought to the attention of staff via 1, 2 and 3 above.

6.  RELATED DOCUMENTS

6.1 The following operational procedures must be referred to:
 

7. REFERENCES

NHS Fife Policies including:

An Equality & Diversity Rapid Impact Assessment has been completed for  this procedure  No negative impacts have been identified.