Personal Electronic Devices Acceptable Use Policy Version 1.0 Purpose: For use by: This document is compliant with /supports compliance with: This document supersedes: Approved by: To advise Trust staff on the acceptable use of computers, the Internet and email system. All Trust staff, contractors, patients and visitors The Data Protection Act (1998), security of person identifiable data, Health and Safety, Safeguarding N/A Safeguarding Children Committee Information & Records Governance Group Approval date: SCC 25 July 2016 IRGG 22 August 2016 Notified to : Patient Safety & Clinical Effectiveness Group Date Notified: 26 September 2016 Implementation date: 1 September 2016 Review date: 1 September 2019 In case of queries contact: (Responsible Officer) Directorate and Department: Archive Date: (ie date document no longer in force) Date document to be destroyed: (ie 10 years after archive date) Chief Information Officer IT BPT Executive Support To be inserted by Information Governance Department when this document is superseded. This will be the same date as the implementation date of the new document. To be inserted by Information Governance Department when this document is superseded. Registered Document 1872 Page 1 of 11
Version and document control: Version Date of Change Description Author number issue 0.1 02/06/2016 First Draft Version Karl Kroger 0.2 24/08/2016 Incorporated recommendations and suggestions Karl Kroger/ Sarah Preston This is a Controlled Document Printed copies of this document may not be up to date. Please check the Trust Intranet for the latest version and destroy all previous versions. Hospital documents may be disclosed as required by the Freedom of Information Act 2000. Sharing this document with third parties As part of the hospital s networking arrangements and sharing best practice, the hospital supports the practice of sharing documents with other organisations. However, where the hospital holds copyright to a document, the document or part thereof so shared must not be used by any third party for its own commercial gain unless this hospital has given its express permission and is entitled to charge a fee. Release of any strategy, policy, procedure, guideline or other such material must be agreed with the Lead Director or Deputy/Associate Director (for Trust -wide issues) or Directorate/ Departmental Management Team (for Directorate or Departmental specific issues). Any requests to share this document must be directed in the first instance to Chief Information Officer. Registered Document 1872 Page 2 of 11
CONTENTS SECTION 1 - INTRODUCTION... 4 1.1 Policy Statement and Rationale... 4 1.2 Key Principles... 4 1.3 Background Information... 4 1.4 Definitions... 4 SECTION 3 Acceptable use of Personal Electronic Devices... 6 SECTION 4 TRAINING AND EDUCATION... 8 SECTION 5 DEVELOPMENT AND IMPLEMENTATION INCLUDING DISSEMINATION... 8 SECTION 6 MONITORING COMPLIANCE AND EFFECTIVENESS... 9 SECTION 7 CONTROL OF DOCUMENTS INCLUDING ARCHIVING ARRANGEMENTS. 9 SECTION 8 SUPPORTING COMPLIANCE AND REFERENCES... 9 APPENDIX A: Guidance for Acceptable use of Personal Electronic Devices...10 Registered Document 1872 Page 3 of 11
SECTION 1 - INTRODUCTION 1.1 Policy Statement and Rationale The Ipswich Hospital NHS Trust (hereafter referred to as the Trust ) recognises its responsibility to protect the privacy, dignity and wellbeing of all its patients, visitors, and staff and to protect all patient, personal, and person-identifiable information from inappropriate access or disclosure. The goals of this policy are to outline appropriate and inappropriate use of personal electronic and photographic devices within the Trust s premises pursuant to the principles of the Data Protection Act (1998) and to protecting personal privacy, dignity, and wellbeing. 1.2 Key Principles For the avoidance of doubt, this policy applies to the use of any personal electronic devices including, but not limited to, all types of communications devices (mobile telephones, smart-phones, tablet devices, personal digital assistants, wearable smart devices), cameras (digital or film stills- or video cameras, or any device not specifically defined as a camera but capable of taking photos or videos), any device capable of recording sound (audio), and personal computers (of any type and running any operating system). The use of Trust-owned photographic equipment to take photographs or video recordings for clinical purposes is covered by the Trust s Clinical Photography Policy (published on the Intranet) and all such instances should adhere to that policy. Personal devices, or devices not specifically authorised for such purposes should not be used to take clinical photos or videos whether locally stored or transmitted to a remote location as this would make it difficult to comply with the Clinical Photography Policy which requires such images or videos to be processed and stored appropriately on Trust equipment and systems. Where personal electronic devices are used, whether by a patient, a visitor or a member of staff, the appropriate expressed approval must be sought and obtained from the relevant person responsible in the area and for the purpose that the device is to be used. Approval will be guided by this policy and will specify how such devices may or may not be used. 1.3 Background Information The Trust recognises that personal electronic devices are an integral part of people s lives as they provide a means of connecting with others, accessing information, and to entertain and the Trust provides free limited guest Wi-Fi access to facilitate such activities. The use of cameras in locations where care is provided is a particularly significant concern and many mobile phones are also cameras, video and audio recorders. The risks associated with their use must be managed. 1.4 Definitions Staff/ Employee Patient Visitor Any person working at the Ipswich Hospital NHS Trust as a directly employed staff member (including agency and bank), contractor, sub-contractor, or volunteer. Any person under the care of the Ipswich Hospital NHS Trust. Any person visiting the Ipswich Hospital NHS Trust for any reason other than as a patient or an employee. Registered Document 1872 Page 4 of 11
Personal electronic device Photographic equipment Any portable electronic device capable of running an operating system and applications, Internet access, messaging of all types, and possible photography. Such devices may include mobile and smart phones, tablet devices, smart watches and other wearable technology, portable computers etc. Any device, whether electronic, electric or mechanical capable of taking a photographic image or video recording whether that is the device s primary purpose or not. Typically such a device would have at least one lens. Photography shall refer to the use of any photographic device to take photographs or videos whether locally recorded on the device or transmitted to a remote location. SECTION 2 DUTIES AND RESPONSIBILITIES 2.1 The Trust s Senior Information Risk Owner (SIRO) has the overall responsibility for the confidentiality, integrity, and availability of corporate data. The Ipswich Hospital NHS Trust has delegated the execution and maintenance of Information Technology and Information Systems to the Chief Information Officer. 2.2 The Chief Information Officer is responsible for this policy and its implementation. 2.3 Other staff under the direction of the Chief Information Officer are responsible for following the procedures and policies within Information Technology and Information Systems. 2.4 The Ipswich Hospital NHS Trust employees have the responsibility to act in accordance with company policies and procedures. 2.5 It is the responsibility of any employee of The Ipswich Hospital NHS Trust who is connecting a removable storage device to the organisational network to ensure that the device has been duly authorised for such use by the IM&T department. 2.6 All staff within the Trust have a responsibility to adhere to this policy and report any concerns in line with the Trust s Safeguarding Policies Registered Document 1872 Page 5 of 11
SECTION 3 Acceptable use of Personal Electronic Devices 3.1 Potential risks from inappropriate use of devices include: impact on the privacy of patients, visitors, or staff impact on the right to dignity of those receiving care breach of confidentiality in respect of those receiving care and/or the Data Protection Act in respect of all individuals threat to safeguarding arrangements for children and vulnerable adults causing interruptions to care provision, creation of unacceptable working conditions for staff or undermining patient comfort and recuperation threat to patient safety through interference with electronic medical devices spread of infection through contaminated mobile devices 3.2 Privacy and Dignity There is a legal duty imposed by human rights legislation to respect the private lives of individuals and the European Court of Human Rights has suggested that there are positive obligations inherent in effective respect for private life. This means that care providers have an obligation to take reasonable steps to create an environment where privacy and dignity are respected. It is essential, and a key component of the NHS Constitution, that those receiving care remain safe, that they are treated with dignity, and enjoy privacy and comfort during their stay. 3.3 Confidentiality and Data Protection The European Court has recognised that respecting patient confidentiality is a vital principle crucial to privacy and to confidence in health services. Individuals may take legal action if information about them is inappropriately shared. Further, any individual who takes photographs or videos of other individuals whether a patient, visitor, volunteer or member of staff, where this is not directly related to their own care, must comply with the Data Protection Act (1998) and is likely to be in breach of that Act if consent has not been gained. In many cases recordings will be stored in unsecure repositories without encryption and in some cases this will not provide adequate protection. Photographing patient notes, documentation, white boards, or any personal or clinical information displayed on a screen or written would also likely be a breach of the Data Protection Act (1998). 3.4 Safeguarding Care providers must safeguard and promote the welfare of children and vulnerable adults, whether patients or visitors, and need to take steps to prevent inappropriate photographs or videos being taken, either of the individuals concerned or of confidential information pertaining to them. There are clear links to the broader safeguarding agenda and to the actions that Trusts are recommended to take in the lessons learned report relating to Jimmy Savile and Myles Bradbury (see https://www.gov.uk/government/publications/jimmy-savile-nhs-investigations-lessonslearned and http://www.verita.net/wp-content/uploads/2015/10/cuh-final-191015- report.pdf). Goodwill visitors and members of the press should always be accompanied by a chaperone and all photography must be approved by a representative of the Trust s press office. Staff members are advised never to share personal contact details (e.g. telephone numbers, addresses, social media contacts etc.) with patients. 3.5 Nuisance Unwell and recuperating individuals should not be subject to the noise and disturbance that may arise from the use of mobile devices by other patients, visitors or staff even where this is otherwise unobjectionable communications activity. Staff also need consideration and should not be expected to put up with unreasonable Registered Document 1872 Page 6 of 11
behaviour. Whilst on Trust premises people who are not seeking medical advice, treatment or care could commit an offence if they use a mobile phone in such a way as to cause a nuisance or disturbance to an NHS staff member (reference sections 119 (Offence of causing nuisance or disturbance on NHS premises) and 120 (Power to remove person causing nuisance or disturbance) of the Criminal Justice and Immigration Act 2008). 3.6 Interference with Electronic Medical Devices The Medicines and Healthcare products Regulatory Agency (MHRA) does not advise that NHS trusts should operate a hospital-wide ban but has said that in certain circumstances the electromagnetic interference from mobile devices can interfere with some medical devices, particularly if used within 2 metres of such devices. Mobile devices may also need to be charged via the mains power supply. Consequently, there is a risk that an essential medical device may be inadvertently unplugged in order to charge a mobile device. In addition, patients chargers are not electrically Portable Appliance Tested (PAT), and this may contravene hospital policy and health and safety regulations. 3.7 Spreading Infection Standard precautions are required to underpin the safe care of all patients at all times when staff, visitors or patients are using equipment such as mobile phones and computer keyboards/tablets. Precautions include hand washing before direct contact with patients and after any activity that contaminates the hands, and regular cleaning of the equipment with detergent and disinfectant wipes, which should be used in line with manufacturer s instructions. In order to further support infection control, the use of personal electronic devices may be restricted in certain areas. 3.8 Defining Acceptable or Unacceptable use Appendix A provides a helpful chart that can be displayed and provides guidance on the acceptable or unacceptable use of devices and should be used as a guide to approving or disallowing such use. Registered Document 1872 Page 7 of 11
SECTION 4 TRAINING AND EDUCATION Staff must receive adequate training. Training related to this policy will be provided in the form of user guides issued as appropriate published on the Trust Intranet. Information will also be sent out via email where necessary and may be delivered as part of general Information Governance Training. SECTION 5 DEVELOPMENT AND IMPLEMENTATION INCLUDING DISSEMINATION 5.1 This document was prepared by the Data and Security Manager and based on industry and Department of Health best practice as well as recommendations made by the Information Governance Alliance. 5.2 The Ipswich Hospital Trust is a large site and has many staff groups working around the clock. To ensure that all staff have access to the most accurate and up-to-date data collection guidance, procedures and changes will be notified via the Trust intranet. 5.3 This policy applies to all The Ipswich Hospital NHS Trust employees (including full and part-time staff), contractors, freelancers, volunteers, and other agents, who utilise either company-owned or personally-owned computers or devices to process, back up, relocate or access any organisation or client-specific data as well as networked resources. Such access to this confidential data is a privilege, not a right, and forms the basis of the trust The Ipswich Hospital NHS Trust has built with its clients, supply chain partners and other constituents. Consequently, employment at The Ipswich Hospital NHS Trust does not automatically guarantee the initial and ongoing ability to use these devices within the enterprise technology environment. 5.5 This policy is complementary to any previously implemented policies dealing specifically with the use of electronic or photographic devices. Registered Document 1872 Page 8 of 11
SECTION 6 MONITORING COMPLIANCE AND EFFECTIVENESS 6.1 Compliance with this policy shall be managed by persons in charge in the various areas. Non-compliance may be met with withdrawal of Internet access services and/ or staff disciplinary or legal action as appropriate. SECTION 7 CONTROL OF DOCUMENTS INCLUDING ARCHIVING ARRANGEMENTS 7.2 Once approved by the Information & Records Governance Group the Responsible Officer will forward this guideline to the Information Governance Department for a document index registration number to be assigned and for the guideline to be recorded onto the central hospital master index and central document library of current documentation. 7.1 In order that this document adheres to the Trust s Records Management Policy, the Responsible Officer will arrange for staff to be advised when this document is superseded and for arranging for this version to be removed from the hospital s intranet. The Responsible Officer will also advise the Information Governance Department who will ensure that this document is removed from the current index and library, archived and retained for 10 years from the archive date. SECTION 8 SUPPORTING COMPLIANCE AND REFERENCES Data Protection Act (1998) Data Protection Policy (The Ipswich Hospital NHS Trust) IM&T Use of Privately Owned Equipment Policy (The Ipswich Hospital NHS Trust) Safeguarding Children Policy (The Ipswich Hospital NHS Trust) Safeguard Adults Policy (The Ipswich Hospital NHS Trust) Infection Prevention and Control Policy (The Ipswich Hospital NHS Trust) Sections 119 and 120 of the Criminal Justice and Immigration Act 2008 Dignity and Respect Charter (The Ipswich Hospital NHS Trust) Chaperoning Patients Guideline (The Ipswich Hospital NHS Trust) Goodwill Visitors Guideline (The Ipswich Hospital NHS Trust) Registered Document 1872 Page 9 of 11
APPENDIX A: Guidance for Acceptable use of Personal Electronic Devices The use of mobile devices should be kept to a minimum in patient areas and where may infringe on the safety, privacy, wellbeing and dignity of patients and visitors. Below is a table of guidance for the use of mobile or camera devices in specified areas of the Trust. This table may be altered at the discretion of nurse-leads to suit requirements and may then be displayed to advise staff, visitors and patients. Area Designation Staff Patients Visitors Treatment and High-care areas including: Emergency Department and assessment unit cubicles, bedsides and resuscitation areas Critical Care Unit High Dependency Unit Children s High Dependency Unit Recovery Areas Neonatal Units Delivery Rooms Generally Prohibited Cameras should not be used except in accordance with Clinical Photography policy. Phones can be used for work purposes or for personal use during breaks in a permitted area. The Nurse in Charge can agree exceptional patient use for those with specific communication or carer needs or for those confined to bed areas. Cameras should not be used where this may infringe on the privacy of others. Other clinical areas (not in prohibited list) that the Trust has designated as restricted due to risks outweighing the benefits to patients and visitors including clinic rooms and cubicles. Other areas e.g. waiting areas Restricted Permitted Cameras should not be used except in accordance with Clinical Photography policy. Phones can be used for work purposes or during breaks in a permitted area. Allowed, but no personal use when on duty (Phones can be used in breaks). The Nurse in charge can agree exceptional patient use as above. Care should be taken to respect the privacy of other patients. Visitors should leave the area when using devices. Calls must only be made from a permitted area or outside the building. The Nurse in Charge can agree exceptional use. Cameras should not be used where this may infringe on the privacy of others. Visitors should leave the area. Calls must only be made from a permitted area or outside the building. The Nurse in Charge can agree exceptional use, but care should be taken to respect the privacy of others. Allowed but please have regard to others and try to keep a distance from electronic medical devices. Phones should not be used when this would disturb Registered Document 1872 Page 10 of 11
Registered Document 1872 Page 11 of 11 resting patients. If using video chat the camera must be facing you and you need to be aware that you may pick up other peoples conversations and other people may hear both sides of your conversation. Please respect staff and service user privacy and dignity when updating your status on any social media sites / apps.