Policies & Procedures
Information Security Policy v1.0
Document owner | Registered Manager / Director |
Approved by | Mrs. Tavleen Sharma (Registered Manager) |
Version | 1.0 |
Review frequency | Every 12 months or following any significant incident |
Next review date | 12 months from issue or earlier if required. Next formal review date: 01-04-2027 |
1. Policy Statement
VCare Consultancy Services Limited is committed to protecting the confidentiality, integrity and availability of all information held by the organisation.
The organisation recognises that secure handling of information is essential to protect service users, staff, commissioners, business operations and regulatory compliance obligations.
VCare Consultancy Services Limited will implement appropriate technical, organisational and operational controls to safeguard information against:
- unauthorised access;
- accidental loss;
- destruction or damage;
- theft;
- cyber attack;
- disclosure;
- misuse.
This policy supports compliance with:
- UK GDPR;
- Data Protection Act 2018;
- Human Rights Act 1998;
- Care Act 2014;
- Health and Social Care Act 2008;
- CQC Fundamental Standards;
- NHS Data Security and Protection Toolkit requirements.
2. Scope
This policy applies to:
- all employees;
- directors;
- temporary workers;
- agency workers;
- contractors;
- volunteers;
- third-party providers handling organisational information.
The policy applies to:
- paper records;
- electronic records;
- emails;
- mobile devices;
- cloud systems;
- laptops and computers;
- telephones;
- care management systems;
- removable media;
- verbal information sharing.
3. Objectives
VCare Consultancy Services Limited aims to:
- protect confidential information;
- maintain secure operational systems;
- prevent data breaches and cyber incidents;
- ensure lawful and secure sharing of information;
- maintain service continuity;
- promote staff awareness and accountability;
- support safe care delivery;
- meet legal and regulatory obligations.
4. Roles and Responsibilities
Directors and Senior Management
Directors and senior management are responsible for:
- ensuring adequate information security arrangements are in place;
- monitoring compliance;
- reviewing risks;
- ensuring sufficient training and resources are available.
Registered Manager
The Registered Manager is responsible for:
- operational implementation of this policy;
- reporting and managing incidents;
- ensuring staff compliance;
- overseeing secure record management.
Employees and Workers
All staff are responsible for:
- protecting confidential information;
- following organisational policies and procedures;
- maintaining secure passwords;
- reporting incidents immediately;
- completing mandatory training.
Failure to comply with this policy may result in disciplinary action.
5. Information Classification
Information handled by VCare Consultancy Services Limited may include:
- personal data;
- special category health data;
- safeguarding information;
- employment records;
- financial information;
- commercially sensitive information.
All confidential information must only be accessed by authorised individuals with a legitimate business need.
6. Access Controls
VCare Consultancy Services Limited maintains access controls including:
- password protected systems;
- individual user accounts where applicable;
- restricted access permissions;
- secure cloud-based systems;
- locking of unattended devices;
- role-based access arrangements.
Passwords must:
- not be shared;
- be kept confidential;
- be sufficiently strong;
- be changed if compromise is suspected.
7. Secure Use of Devices and Systems
Staff using organisational systems must:
- use approved systems and applications only;
- avoid storing confidential information on personal devices unless authorised;
- lock devices when unattended;
- ensure devices are protected from theft or unauthorised access;
- promptly report lost or stolen devices.
VCare Consultancy Services Limited uses secure digital systems to support care delivery, communication and governance.
8. Email and Internet Security
Staff must:
- remain vigilant to phishing emails and cyber threats;
- avoid opening suspicious links or attachments;
- use organisational email appropriately;
- not send confidential information insecurely.
Suspicious emails or cyber concerns must be reported immediately to management.
9. Confidentiality and Information Sharing
Information will only be shared:
- where lawful;
- on a need-to-know basis;
- with appropriate safeguards;
- in line with safeguarding and legal requirements.
Staff must not:
- discuss confidential matters in public;
- leave records unsecured;
- disclose information without authority.
10. Data Storage and Retention
VCare Consultancy Services Limited maintains arrangements for:
- secure electronic storage;
- secure physical storage;
- backup and recovery processes;
- controlled retention periods;
- secure disposal of records.
Records are retained in accordance with legal and regulatory requirements.
11. Incident Reporting and Data Breaches
Any suspected or actual:
- data breach;
- cyber incident;
- unauthorised disclosure;
- loss of records;
- security weakness;
must be reported immediately to management.
All incidents will be:
- investigated;
- risk assessed;
- documented;
- escalated where required.
Where necessary, incidents may be reported to:
- the Information Commissioner’s Office (ICO);
- local authorities;
- commissioners;
- affected individuals;
- law enforcement agencies.
12. Business Continuity and Cyber Resilience
VCare Consultancy Services Limited maintains business continuity arrangements to support operational resilience during:
- cyber incidents;
- digital outages;
- staffing emergencies;
- system failures;
- operational disruption.
The organisation undertakes periodic reviews and testing of continuity arrangements.
13. Training and Awareness
All staff receive information governance and data protection training including:
- confidentiality;
- GDPR awareness;
- cyber security awareness;
- phishing awareness;
- incident reporting;
- secure record handling.
Training is refreshed periodically and monitored through compliance processes.
14. Monitoring and Compliance
VCare Consultancy Services Limited may monitor:
- system access;
- security incidents;
- compliance with organisational procedures.
Non-compliance may result in:
- disciplinary action;
- removal of access rights;
- referral to regulatory or legal authorities.
15. Policy Review
This policy will be reviewed:
- annually;
- following significant incidents;
- following legislative or operational changes.