Information Governance and UK GDPR

Aim of the course

The course aims to give healthcare assistants and similar frontline care workers the practical knowledge needed to handle residents’ information safely, lawfully and respectfully during everyday work.

It helps learners understand that confidentiality does not mean never sharing information. Relevant information must sometimes be shared with authorised colleagues to provide safe care or protect someone from harm. The key is to share the right information, with the right person, for the right purpose and through an approved method.

Scope of the course

This course is suitable for:

1. Healthcare assistants
2. Care assistants
3. Support workers
4. Senior care assistants
5. Nursing assistants
6. Activity coordinators
7. Agency and temporary care staff
8. New employees and existing staff requiring refresher training

The course focuses on frontline activities such as:

1. Reading and updating care records
2. Completing daily notes and charts
3. Participating in handovers
4. Communicating with colleagues and relatives
5. Using electronic care-record systems
6. Handling paper documents
7. Using work email, telephones and mobile devices
8. Responding to information requests
9. Recognising and reporting information-security incidents

The course supports awareness of:

1. UK General Data Protection Regulation
2. Data Protection Act 2018
3. Common law duty of confidentiality
4. Human Rights Act 1998, particularly Article 8
5. Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, particularly Regulations 10 and 17
6. Caldicott Principles
7. Relevant CQC expectations
8. Local confidentiality, record-keeping, information-security and social-media policies

UK data protection legislation is formed principally by the UK GDPR and Data Protection Act 2018. GOV.UK: Data protection legislation

Limits of the course

This is a frontline awareness course. It does not train HCAs to:

1. Select or approve an organisation’s lawful bases
2. Write privacy notices
3. Complete Data Protection Impact Assessments
4. Negotiate data-processing contracts
5. Set organisational retention schedules
6. Manage subject access requests
7. Investigate serious data breaches
8. Make disclosures to the Information Commissioner’s Office
9. Perform the duties of a Data Protection Officer or Caldicott Guardian

An HCA’s responsibility is to recognise issues, protect information and report requests or incidents promptly to the appropriate manager or information-governance lead.

Topics covered

1. Meaning of information governance
2. Purpose of the UK GDPR and Data Protection Act 2018
3. Personal, confidential and special category information
4. Examples of information used in care homes
5. The seven data-protection principles
6. Confidentiality and the Caldicott Principles
7. Accessing records only for legitimate work purposes
8. Keeping usernames, passwords and access cards secure
9. Avoiding shared accounts and inappropriate record access
10. Accurate, factual and timely care records
11. Correcting recording errors appropriately
12. Maintaining respectful and professional language
13. Secure handovers and confidential conversations
14. Sharing information for direct care
15. Sharing only relevant and necessary information
16. Verifying identity and authority before disclosure
17. Communicating with relatives, friends and representatives
18. Consent, mental capacity and information sharing
19. Safeguarding and public-interest disclosures
20. Secure use of electronic care systems
21. Screen security and locking unattended devices
22. Safe handling and storage of paper records
23. Approved email, telephone and messaging methods
24. Personal phones, photography, video and audio recording
25. Social media and professional boundaries
26. Working from home or away from the care home
27. Printing, transporting and disposing of information
28. Misdirected emails and messages
29. Lost paperwork, devices and access cards
30. Recognising phishing and suspicious requests
31. Recognising personal data breaches
32. Immediate reporting and preservation of evidence
33. Responding appropriately to requests for copies or corrections
34. Residents’ information rights and appropriate escalation

Learning outcomes

By the end of the course, learners should be able to:

1. Define information governance and explain its relevance to care-home work.
2. Identify personal data, confidential information and special category data.
3. Give examples of information that HCAs handle during everyday care.
4. Outline the seven UK GDPR data-protection principles.
5. Explain why resident information must be accurate, relevant and secure.
6. Access records only when required for their authorised duties.
7. Keep usernames, passwords, access cards and devices secure.
8. Produce clear, factual, respectful and timely care records.
9. Correct documentation errors using approved workplace procedures.
10. Maintain confidentiality during handovers and conversations.
11. Explain why confidentiality does not prevent necessary information sharing for safe care.
12. Share only information that is relevant and necessary.
13. Verify a person’s identity and authority before disclosing information.
14. Respond appropriately when relatives request information.
15. Recognise when safeguarding concerns may require information to be shared.
16. Use workplace email, telephones and electronic records safely.
17. Explain why personal devices and social media must not be used to record or share resident information without proper authorisation.
18. Protect screens, paperwork and records from unauthorised viewing.
19. Recognise phishing, impersonation and suspicious information requests.
20. Identify common personal data breaches in a care-home environment.
21. Take immediate action following lost records, misdirected messages or unauthorised disclosure.
22. Report suspected breaches through the correct workplace procedure.
23. Recognise a resident’s information-rights request and pass it promptly to the responsible person.
24. Work within the limits of the HCA role and seek advice when uncertain.

NHS England’s adult social care guidance makes clear that sharing relevant information for individual care is as important as protecting confidentiality; information should be necessary, relevant and transferred securely. NHS England: Information sharing in social care