1. Medical Clinic
Data Protection & Data Quality Review

2. Agenda
• Background and Overview
• Summary of Report Findings
– Maturity Ranking
– The Good (Things to be commended)
– The Bad (Issues causing concern)
– The Ugly (Serious Compliance
issues/risks)
• Recommendations

3. BACKGROUND & OVERVIEW

4. Context
• Data Protection Compliance = Risk
– Risk to Trust
– Risk to Revenue
– Risk to Brand
• Data Quality Issues = Cost + Risk
– Risk of wrong treatment
– Risk of underutilised resources
– Cost of checking and rechecking data

5. The Methodology
Face to Face Qualitative Interviews
Observations made while on-site
Research & Review of Best Practice

6. THE FINDINGS

7. Summary of Findings
Some good things found.
12 areas of concern/weakness
6 critical risks to Compliance found

8. Maturity Assessment
Value Centric Management
Optimising State of the Art Practices & Outcomes
Information Value quantified and
communicated
Advanced Practices and outcomes well above
industry average
Interactions formalised for critical
processes
Data Protection Target Intermediate Transparent Investment Decisions
Basic IT Services being delivered
Basic Some interactions/processes formalised
Data Protection Maturity No formal processes
Initial Ad hoc Management
Based on IVI IT-CMF framework

9. CRITICAL RISKS
Data Controller (??)
Data Processor (??)

10. Critical Risks
Patient file: Mr Smith
• Patient data being transferred by email without
encryption/security
• Email forwarding to external services a concern

11. CRITICAL RISK
No defined Data Security Breach Process

12. CRITICAL RISK
Personal and Sensitive
Personal data being
managed and transferred in
Spreadsheets

13. CRITICAL RISK
Little or no segregation of
inbound and outbound patient
data

14. CRITICAL RISK
Registry Entry for Hospital with DPC is inaccurate

15. Compliance Issues
Classification/Categorisation of Information
No Formal Governance framework for Data
Policies/Procedures/Process
• Absent or poorly defined
• May not reflect DP Obligations

16. Compliance Issues
No training in Data Protection
No consistency in formal training in
systems – a lot of ‘informal’ learning
The absence of “role based” access to
personal data in systems is a concern

17. Compliance Issues
No verifiable evidence of good behaviours
being followed
No formal or consistent “Leavers/Movers”
process to restrict access to records
CCTV Signage does not meet DPA
requirements

18. 12 STEP PROGRAMME

19. 12 Step Plan
Governance & Policy
Issues
Training and Awareness
Technical & Technology
Issues

20. Governance Issues
Formalise Data
Controller/Data
Processor Relationships
Implement formal
Define appropriate Information Governance
Policies, Procedures &
Metrics
Review appropriateness
of email forwarding.
Define Leaver/Movers Define clear policy
process to encompass all
systems and manual data
Conduct Audit of Manual
Data Storage/Disposal
Review existing (Clean Desk Policies)
Disclosure policies to
ensure DPA
requirements met.

21. Technology Issues
Implement Role based
access to electronic data
(where possible)
Implement Segregation
between “Data In” and
“Data Out”
Inspect Data
Redundancy (e.g.
Spreadsheets)
Assess need and secure
Review existing
Disclosure policies to
ensure DPA
requirements met.

22. Training & Awareness Issues
Implement Training on
DP/DQ to key target
audiences
Coupled with the roll out and implementation of Training,
we would recommend that supporting activities be
developed to help make culture change stick e.g.:
• “Story” development to lock in the learning
• Internal Communication plans
• Continuous Improvement

23. SAMPLE GOVERNANCE
MODELS

24. Governance Model 1
Advisory
External
Expert
Chair
CEO
Consultants (DPO)
HR
IT
Information Governance
Bus
Steering Group Patient
Svcs
Apps
JCI Nursing Radiology Finance

25. Governance Model 2
Chair
External
CEO Expert
Consultants
(DPO)
HR
IT
Information Governance
Bus
Steering Group Patient
Svcs
Apps
JCI Nursing Radiology Finance

26. Governance Model 3
External
Expert
Bus
Apps Consultants
(DPO)
IT
HR
Information Governance
CEO
Steering Group Patient
Svcs
JCI Nursing Radiology Finance
Effective Model for Project Management
Least Preferred Option for on-going Governance

27. Evolving from Excellent Project
to Effective Governance
Project
Governance
Governance Model 1 Governance Model 2 Governance Model 3
Project Execution Transition & Bed-in Operational & Effective

28. Summary
1. Ensure all staff know WHAT needs to be done
– (Policies, Procedures & Training)
2. Ensure all staff know WHY it needs to be done
– (Culture change, align with values)
3. Ensure all staff know HOW it needs to be done
– Governance, Policies, Training)
4. Ensure all staff know WHO is doing it
– (Governance, Policies, Contractual issues)
5. Ensure the Clinic can demonstrate THAT IT HAS been
done
– (Metrics, Governance, Reporting)

29. In conclusion....
Best efforts are essential.
Unfortunately, best efforts, people
charging this way and that way
without the guidance of principles,
can do a lot of damage.
W. Edwards Deming Think of the chaos that would come
Out of the Crisis
if everyone did his best, not
knowing what to do.