Request for information under the Freedom of Information Act – 2019.199 Released – 26 July 2019 Thank you for your email received 10 July 2019 requesting information regarding instant messaging by clinicians. Please find detailed below a summary of your request, together with our response. Summary of your original request: 1. Does your Trust/organisation permit clinicians to communicate about patients or other clinical matters (for example, a junior doctor discussing a patient with a consultant) using an instant messaging app (for example, WhatsApp, Forward, Siilo, Medicbleep, Skype for Business, Vocera, Rainbow)? NHS Digital have authorised the use of Skype for Business Instant Messenger for the exchange of personal data about patients. 2. If yes, what is/are the names of the apps/devices? Skype for Business 3. If applicable, do your clinicians use their personal devices, or those provided by your Trust/Trust/organisation for the purposes referenced in question 1(for example, the ASCOM ‘Myco 2’)? Staff are issued with communication devices where this is necessary for their role. 4. If such devices are provided by your Trust/organisation for use by clinicians, what is the make and model of each device? All tablets used across the Trust are Samsung, the models used are:- SM-T365 SM-T555 SM-T585 For mobile phones, this varies considerably. The smartphones are Android and the majority will be Samsung. There will also be Sony and Vodafone handsets. For voice only connections Nokia and Mobiwire are current issue. 5. If your Trust/organisation does not use any such app or device, please state whether your Trust/organisation is considering their use, stating which apps and/or devices are being considered. Not applicable. 6. Please state whether your Trust/organisation has an instant messaging, or related policy. Yes 7. Please attach your Trust/organisation’s instant messaging, or related policy. Please see attached. 8. Please state whether your Trust/organisation has carried out a Data Protection Impact Assessment (DPIA) for: a. Instant messaging generally for the purposes mentioned in question 1. b. Specific instant messaging apps/devices (each, if more than one) for the purposes mentioned in question 1. Yes, but the DPIA is currently being reviewed. 9. Please enclose the DPIAs referred to in question 8. As stated above for question 9, the section requested is currently under review; therefore we are not able to provide a copy of this at this time. 10. If not included in your DPIA, please enclose your standard operating procedure and/or policies which specify how information is separated and, if necessary, extracted from the apps/devices where: a. A valid access request (e.g. patients, police etc.) is made for all patient information contained on the apps/devices. b. A valid access request is made for the personal data of a user of the apps/devices. This is currently under review. The subject access request process in the Access to Records policy would be referenced in all cases. 11. Please state the number of reported incidents (categorised, if possible) concerning the devices/apps (each, if more than one). There have been no reported incidents. Page 2 of 2 INSTANT MESSAGING STANDARD OPERATING PROCEDURE Document Reference No. KIG027 Status Ratified Version Number 1.1 Replacing/Superseded 1.0 documents Number of Pages 12 All permanent, and part time staff, and anyone acting for or Target audience/applicable to on behalf of KCHFT Author Cyber Security Specialist Acknowledgements Contact Point for Queries Cyber Security Specialist Date Ratified 9th January 2019 Date of March 2019 Implementation/distribution Circulation Intranet, Policy Distribution Review date January 2022 Copyright Kent Community Health NHS Foundation Trust Kent Community Health NHS Foundation Trust (Instant Messaging SOP) EXECUTIVE SUMMARY This document presents a standard operating procedure for the use of Instant Messaging applications throughout Kent Community Health NHS Foundation Trust (KCHFT). This document will refer specifically to Skype For Business Instant Messaging which will be made available to all staff members. There are other Instant Messaging (IM) solutions available; however Skype For Business Instant Messaging is KCHFT’s choice for use across the Trust. Reasons for choosing SfB IM are; • It is available free of charge as a part of our existing package • It is linked to existing email accounts and so minimal setup is required • It is encrypted by default when exchanging messages between @nhs.net accounts • The NHSmail Skype for Business Services have been reviewed and approved for clinical use in line with SCCI0129 Clinical Risk Management Scope and purpose of Standard Operating Procedure IM is a part of everyday life and is an efficient way to exchange information quickly. However within the NHS this needs to be tightly controlled to ensure the confidentiality of Personally Identifiable Information (PII), or special categories of data under the General Data Protection Regulation (GDPR). This document will provide clear guidance for all staff on what is acceptable with regards to the use of IM applications, specifically Skype For Business Instant Messaging. With new GDPR and Cyber, Network and Information Systems legislation coming into effect in May 2018 KCHFT need to ensure that these new regulations are being met by all staff regardless of which system they are using. KCHFT has repeatedly received requests for guidance around the use of IM applications, and KCHFT recognises the part that these applications have to play in a modern NHS. This document therefore addresses questions from staff, and will also form a part of other business processes. Risks addressed The following risks have been identified. • Ensuring confidentially is maintained through the use of Skype for Business Instant Messaging • Ensuring all staff are aware that SFB (Skype for Business) IM (Instant Messaging) is not a private means of communication and can be requested via FOI’s for example. • Ensuring that no PII or special categories of data is exchanged through SFB IM. Version 1.1 Page 2 of 12 February 2019 Kent Community Health NHS Foundation Trust (Instant Messaging SOP) Governance Arrangements Governance Group responsible for developing Information Governance Assurance Group document Circulation group Intranet, Policy Distribution Authorised/Ratified by Information Governance Assurance Group/Corporate Governance Group/Board Assurance and Risk Management Group . Committee Authorised/Ratified On January 2019 Review Date January 2022 This document will be reviewed prior to review date if a Review criteria legislative change or other event dictates. Key References NHS QUIPP (Quality Innovation Productivity and Prevention) Digital Technology A brief guide to Skype For Business remote consultations (2012) available at https://www.networks.nhs.uk/nhs-networks/qipp-digital-technology-and- vision/documents/QIPP%20DT%20Skype For Business%20Factsheet%20v1.pdf https://s3-eu-west-1.amazonaws.com/comms-mat/Comms-Archive/SfBUserHandbook.pdf NCSC – Factsheet_Choosing a messaging app Information Security Management – NHS Code of Practice The National Data Guardian’s 10 Data Security Standards The Network Information Systems Directive Related Policies/Procedures Title Reference Privacy and Dignity Policy QC001 Accessible Information Policy IML006 Data Security and Protection Policy KIG025 Cyber Network and Information Systems Policy KIG026 Document Tracking Sheet Version Status Date Issued Comments/Summary of Changes to/Approved by V0.1.0 DRAFT 18/05/2018 First Draft V0.1.1 DRAFT 30.05.18 Made changes as suggested by VM V0.1.2 DRAFT 01.06.18 Additional updates added around information allowed in messages. V0.1.3 DRAFT 14.06.18 Final changes made after review by DA (IG) V0.1.4 DRAFT 04.09.18 Additional updates added after consultation feedback. Just one point required updating in 3.1. Version 1.1 Page 3 of 12 February 2019 Kent Community Health NHS Foundation Trust (Instant Messaging SOP) Added BT Cloud as authorised IM. V0.1.4 Approved at 26.09.18 IGAG No changes requested or made. IGAG V 0.1.4 RATIFIED 9th January CARM No changes requested or made, 2019 version number amended to 1.0 prior to publishing. V 1.1 UPDATED 26th January Section 5 “acceptable use” updated 2019 to include personal devices, and location of mobile device install guide. Version 1.1 Page 4 of 12 February 2019 Kent Community Health NHS Foundation Trust (Instant Messaging SOP) CONTENTS Contents 1.0 INTRODUCTION 6 1.5 Equality Analysis 7 2.0 ROLES AND RESPONSIBILITIES 7 3.0 INSTANT MESSAGING APPLICATIONS 8 4.0 REQUIREMENTS 9 5.0 ACCEPTABLE USE OF SFB IM ERROR! BOOKMARK NOT DEFINED. 6.0 INFORMATION GOVERNANCE AND COMPLIANCE 10 7.0 TRAINING AND AWARENESS 11 8.0 MONITORING COMPLIANCE AND EFFECTIVENESS OF THIS SOP 11 9.0 EXCEPTIONS 11 10.0 GLOSSARY AND ABBREVIATIONS 12 Version 1.1 Page 5 of 12 February 2019 Kent Community Health NHS Foundation Trust (Instant Messaging SOP) 1.0 INTRODUCTION 1.1 This document defines the Instant Messaging guidance and procedure for staff and those working for or acting on behalf of KCHFT. This is to ensure proper use of IM and make users aware of what the Trust deems as acceptable use of IM applications. 1.2 Instant Messaging can play an important role in modern healthcare, speeding up communication, and reducing costs. It also provides an alternative method of communication in the event of a disaster scenario where other methods of communication are not available. The type of information sent using such applications, the version of these applications, and the devices themselves must be controlled to allow for data security, auditability and accountability. 1.3 KCHFT is required by law to ensure the confidentiality and integrity of all PII, and Patient data which falls under its responsibility. Any failure in these responsibilities could result in financial or reputational damage to KCHFT, and also cause distress, medical or financial damage to its patients.