Information Governance Data Security and Protection Specialist

Job description

Job responsibilities

Key operational results areas

- Work with the DPO to ensure the completion of the Trusts Data Security and Protection Toolkit assessment, collating evidence, and undertake compliance audits.

- To advise on and provide updates to IG and cybersecurity e-learning training to ensure staff have access to up to date and relevant IG and Data security and protection training.

- To ensure the development and delivery of the UK GDPR compliance action/improvement plans, monitor progress and report.

- To ensure the Trust's contractors and support organisations have adequate IG arrangements in place.

- To ensure the development of local information sharing agreements as required.

- To provide support/undertake date privacy impact assessments.

- To ensure fair processing notices are adequate for flows of personal confidential information.

- To support the Trusts Information Asset Owners in information asset management and assist with undertaking risk assessments.

- To support the management and response to information security incidents.

- To maintain on-going personal development and knowledge of data protection laws, issues and developments.

- Freedom to take actions as the lead specialist, based on own interpretation of policy, to conduct complex investigations into suspected or actual breaches of data protection and security and provide formal written reports advising how legislation and or policy should be interpreted directly to the Information Asset owner, Human resources business partner and service leads. These cases could lead to disciplinary action being taken against staff

- Participate in relevant internal and external working groups/projects, services and initiatives to provide information and analytical advice and expertise.

- Liaise with senior managers of stakeholder organisations, NHS cyber security teams, the Counter Fraud Service, the Police and external organisations, as required, when investigating incidents.

- Investigations into abuse of IT services such as internet and email may occasionally expose the post holder to distressing images and require the post holder to act as a professional witness in disciplinary hearings etc.

- The alignment of digital and operational processes with legislative, NHS and business security requirements.

- Work with the wider digital team in the identification and management of data protection and data security risks ensuring that digital and operational services maintains compliance in line with the overall Trust corporate governance framework, designing and maintaining appropriate data protection and data security controls and plans with procedures for their operation and maintenance

- Work with services and digital teams to Identify and classify information assets and the level of control and protection required.

- Ensuring that the confidentiality, integrity and availability of trust information is maintained and the public trust in the organisation is promoted and maintained.

- Ensuring that all access to services by external partners and suppliers is subject to contractual agreements and appropriate responsibilities documented.

- Be responsible for a high standard of work supporting the delivery of Information Governance to quality standards and in a cost-effective manner. Maintain documentation and associated plans with regular team meetings to monitor progress and resources.

- Overseeing team members to deliver the requirements listed above; engage and liaise with key stakeholder, in particular:

To support the delivery of day-to-day activities and projects

Support the development and maintenance of a high performing IG team

Advocate data protection and cyber security during all interactions with staff across all roles and levels within the trust.

At as Information asset administrator for IG related assets including the Trusts Information asset register.

Customer care for patients and/or service users

- To act as a champion for patients and their interests in relation to data security and protection

- To ensure all staff and occasional public and patient contact with the office is of the highest professional standard

Leadership and management

- To provide line management for the IG team

- Responsible for undertaking appraisal and personal development for staff within the team

- To support, motivate and develop staff within the team to ensure that they are able to deliver the trust and team objectives

- Liaise with other Managers to share best practice

- Plan, organise, deliver, and review regular IG and ad hoc stakeholder awareness workshops and training sessions on data security and data protection that raise the awareness of staff of information governance issues and ensure their compliance with policies and procedures, ensuring the collaboration of Human Resources, Training, Data Protection and Information Governance Lead. Take personal responsibility for delivering some of these awareness training programmes. Develop materials to enable others to deliver training in a standard manner

Communications and working relationships

- The post holder will be a contact point in the organisation for IG and provide advice to IAOs, IAAs and liaise with the DPO, Caldicott Guardian and SIRO.

- Provide advice and take action, where necessary, in response to Audit findings and recommendations in respect of information governance.

- Work internally in the development and implementation of IG policies and procedures.

- Act as a consultant to projects, advising on matters relating to information governance & security.

- To work with the Head of Information Governance (DPO) to ensure that the Trust fully complies with relevant legislation, agreed policies and procedures.

- To deputise for the Head of Information Governance (DPO) as required in representing the Trust both on internal and external user groups ensuring that the Trust's priorities are effectively communicated, promoted and implemented.

- Ensure that Trust staff know how to report any data protection and data security breaches, incidents, malfunctions and suspected system weaknesses and threats.

- Management of IT security policies, and supporting set of policies, and their controls including their development and review and facilitation of their ratification

- Responsible for proposing and drafting changes, implementation and interpretation to policies and guidelines.

- Ensure that IT security and IG policy is enforced and communicated to all parties.

- Where necessary to liaise with external organisations on IT/cyber security matters, drafting and implementing joint policies and procedures and ensuring external network connections adhere to all appropriate security policies.

- Identify areas within the trust that are inadequately covered by IT/cyber security policies and procedures and, in consultation with operational manager IT specialists, and Data Protection Officer, develop new policies and procedures to cover these areas. Support Digital senior leads in presenting these to the relevant Boards or other approval bodies.

- The post holder will need to maintain a good knowledge of emerging policies from government departments. This will assist in the thinking and definition of the strategy discussions for the network and stakeholders.

Key Relationships:

- Head of Information Governance (DPO)

- Chief Delivery & Governance Officer

- Head of Records, Digital Risk & Compliance

- Caldicott Guardian

- Health and Corporate Records manager

Information Governance/Access to Records team

- Cyber security team

- Digital Senior Leadership Team

- Clinicians

- Senior Information Risk Owner (SIRO)

- Information Asset Owners (IAO)

- Information Asset Administrators (IAA)

- IG colleagues in local partner organisations

Research and development

- Develop and implement ad-hoc audit programmes to test system and data security measures, review findings and improve those system and data security measures

- Plan, develop and evaluate methods and processes for gathering, analysing, interpreting and presenting data and information

Person Specification

Qualifications

• Degree level or equivalent in a discipline directly relevant to the role
• Evidence of CPD

• Data Protection professional qualification(s)
• SSCP/CISSP/CISMP

Experience

• Data protection and data security risk management in an enterprise setting
• Significant experience of working in, or managing, an IT Security or IG function
• Demonstrable experience in delivery of training / education to large groups of staff at all levels of the organisation
• Experience of managing and motivating a team and reviewing performance of the individuals

• Previous experience of working within the NHS or other healthcare setting
• Previous experience of report preparation and delivery
• Previous auditing experience
• Previous experience of risk assessment
• Experience of identifying and interpreting National policy. Experience of researching best practice (globally, private and public sector), interpreting its relevance and processes/ practices which could be implemented successfully to achieve system reform (advising on policy implementation)

Disclosure and Barring Service Check

This post is subject to the Rehabilitation of Offenders Act (Exceptions Order) 1975 and as such it will be necessary for a submission for Disclosure to be made to the Disclosure and Barring Service (formerly known as CRB) to check for any previous criminal convictions.

Employer details

Employer name

Gloucestershire Hospitals NHS Foundation Trust

Address

Victoria Warehouse

The Docks

Gloucester

GL1 2EL

United Kingdom

Employer's website

https://www.gloshospitals.nhs.uk/