Data Protection

Aim and Scope of Policy

This policy shows how Neuro Rehab for Children Ltd trading as Neuro Rehab and Sensory Integration complies with the requirements of the data protection requirements found in Regulation 17: Good Governance of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, which expects service providers to have effective governance of their record keeping with records that are comprehensively fit for purpose and securely maintained.

The policy applies to all manual and electronic records kept by Neuro Rehab for Children Ltd in relation to clients, including those involved with them, whose personal data might be found on their records, all staff, and any third parties (agencies and professionals), with whom anyone’s personal data information held by the service might have to be disclosed or shared.

The policy should be used with other relevant record-keeping policies on:
a) Confidentiality of Client’s Information
b) Information Governance under the UK General Data Protection Regulation, which addresses the wider organisational and management of information issues
c) Record Keeping, which addresses the practice of record keeping
d) Access to Records

Policy Statement

Neuro Rehab for Children Ltd recognises it must keep all records required for the protection and wellbeing of clients, and those for the effective and efficient running of the business such as staff records to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR), which came into force in May 2018.

In line with its registration under the Data Protection Act, and to comply with UK GDPR, Neuro Rehab for Children Ltd understands that it will be accountable for the processing, management and regulation, and storage and retention of all personal data held in the form of manual records and on computers.

This means that all personal data obtained and held by the Neuro Rehab for Children Ltd, is to carry out its activities as a registered care provider must:
a) Have been obtained fairly and lawfully.

b) Held for specified and lawful purposes as an organisation that is carrying out a public duty.

c) Processed in recognition of persons’ data protection rights, which are described in UK GDPR in terms of the right:
• to be informed
• to have access
• for the information to be accurate and for any inaccuracies to be corrected
• to have information deleted (e.g. if inaccurate or inappropriately included)
• to restrict the processing of the data to keep it fit for its purpose only
• to have the information sent elsewhere as requested or consented to (e.g. in any transfer situation)
• to object to the inclusion of any information (e.g. if considered to be irrelevant)
• to regulate any automated decision-making and profiling of one’s personal data.
d) Be adequate, relevant and not excessive in relation to the purpose for which it is being used.

e) Be kept accurate and up to date, using whatever recording means are used or agreed (eg manual or electronic).

f) Not be kept for longer than is necessary for its given purpose (e.g. in line with agreed retention protocols for each type of record).

g) Have appropriate safeguards against unauthorised use, loss or damage with clear procedures for investigating any breaches of the data security.

h) Comply with the relevant UK GDPR procedures for international transfer of personal data.

Procedures

Neuro Rehab for Children Ltd has taken the following steps to protect everyone’s personal data, which it holds or to which it has access so that it complies with current data protection laws and UK GDPR.
a) It appoints or employs staff with specific responsibilities for:
• the processing and controlling of data (data controller)
• the comprehensive reviewing and auditing of its data protection systems and procedures (data protection manager or auditor)
• overviewing the effectiveness and integrity of all the data that must be protected (data protection officer).

b) There are clear lines of responsibility and accountability for these different roles.

c) It provides information to its clients and others involved in their care on their data protection rights, how it uses their personal data, and how it protects it. The information includes the actions clients and staff can take if they think that their data has been compromised in any way (e.g. through the complaints procedure or grievance procedure in the case of staff).

d) It provides its staff with information and training to make them aware of the importance of protecting people’s personal data, to teach them how to do this, and to understand how to treat information confidentially.

e) It can account for all personal data it holds, where it comes from, and who it is and might be shared with.

f) It carries out risk assessments as part of its reviewing activities to identify any vulnerabilities in its personal data handling and processing, and to take measures to reduce the risks of mishandling and potential breaches of data security. The procedure includes an assessment of the impact of both use and potential misuse of personal data in and by the service.

g) It recognises the importance of seeking individuals’ consent for obtaining, recording, using, sharing, storing and retaining their personal data, and regularly reviews its procedures for doing so, including the audit trails that are needed and are followed for all consent decisions.

h) It has policies and procedures for enabling clients and/or staff to have access to their personal information, and for the making of subject access requests that are in line with UK GDPR.

i) It has the appropriate mechanisms for detecting, reporting and investigating suspected or actual personal data breaches, including security breaches. It is aware of its duty to report significant breaches that cause significant harm to the affected individuals to the Information Commissioner and is aware of the possible consequences (e.g. fine).

Training

New staff must read and understand the policies on data protection and confidentiality as part of their induction.

Any new staff receive training covering basic information about confidentiality, data protection and access to records.

This policy applies to the following people in our organisation Everyone in the company.
Policy Written by Meghan Hazell
Director

Date Policy written 2nd May 2024

Due for Review 2nd May 2025

Who has or can give authority to change policy
Meghan Hazell
Director

Where is this policy kept On the business shared drive in a folder called policies.