Information Governance and Data Security for Health and Care Staff

This information governance training is for everyone who handles confidential information in health and care, which means almost everyone: doctors, nurses, allied health professionals, dental, pharmacy and optical teams, receptionists and administrators, porters, and care workers using a tablet in someone's home. It turns the law and the Caldicott Principles into the everyday habits that prevent most information incidents.

Most breaches are not the work of sophisticated hackers. They are ordinary mistakes under pressure: a letter in the wrong envelope, an email to the wrong address, a handover overheard in an open bay, a smartcard left in the reader, a password shared to save time, or a link clicked at the end of a long shift. The course shows how to avoid each one, and how to report quickly and honestly when something goes wrong. It is equally clear that the duty to share information for care and safeguarding is as important as the duty to protect it.

It is designed to take approximately 2 hours, including case illustrations, reflection points, a reflective account and a 15-question assessment. It is self-paced and taken on our course portal. Healthcare Practise UK is an independent provider. We are not affiliated with CQC, any professional regulator or the NHS, and no regulator has reviewed this course.

• Module 1, information governance and you: what IG means in a receptionist's or porter's day, your legal and professional duties, and the eight Caldicott Principles.
• Module 2, everyday confidentiality: conversations and phone calls (with phrases to use with callers you cannot verify), relatives and carers, requests from police and solicitors, looking only at records you need, and social media and personal devices.
• Module 3, good records: what makes a record accurate, contemporaneous and attributable, correcting errors visibly, paper and portable information, and secure disposal.
• Module 4, communicating securely: email (including Bcc and autocomplete), messaging apps and texts, clinical photographs, video consultations, post, and a table for choosing the right channel.
• Module 5, cyber security essentials: why health and care is targeted, including the 2017 WannaCry attack and the 2024 London pathology ransomware attack, phishing warning signs, passwords, multi-factor authentication, smartcards, home working and public AI tools.
• Module 6, incidents and reporting: what counts as an incident or near miss, what to do straight away, why fast internal reporting lets your organisation meet the 72-hour ICO deadline, learning rather than blame, and working safely when systems go down.
• Module 7, organisational assurance: the DSPT, Better Security, Better Care and frameworks in the other nations, who to ask for help, and eight personal habits that prevent most incidents.

The 15-question scenario assessment has a pass mark of 12 (80%). Scenarios include a caller claiming to be a patient's son, a colleague asking to borrow your smartcard, a famous footballer admitted to your hospital, a police officer at reception asking for an address, a wound photo on a personal phone, and a password typed into a fake login page. If you fall short, you revisit the relevant sections and try again; passing supports your learning record but does not by itself demonstrate competence in your role.

Your reflective account asks which IG habit is most at risk in your workplace, how you balanced confidentiality with sharing in a real situation, and how you will respond to the next suspicious email. You receive a certificate of completion from Healthcare Practise UK.

For CPD, record the time you actually spend, which may be more or less than the two-hour estimate. Nurses, midwives and nursing associates record 35 hours of CPD over three years for NMC revalidation, at least 20 of them participatory; self-directed online learning like this normally counts as individual learning unless you complete it with colleagues. The GMC does not set fixed hours and asks doctors to reflect on their CPD at appraisal. The HCPC, GDC, GPhC, GOC, GOsC, GCC and Social Work England each set their own requirements, so check the current rules for your register and any training your employer or contract requires. Keep your certificate and your written reflection together.

Many employers require annual data security awareness training. This course can support awareness, but it does not replace a specific course your employer, NHS contract or the DSPT asks you to complete, so check what your organisation requires. Managers often use it for new starters, for non-clinical staff who rarely get tailored training, or after a run of near misses. Team credits are available through courses for organisations, and practice managers who need the legal detail behind it should also take Data Protection and UK GDPR for Healthcare Practices.

For an individual registrant, accessing records without a work reason or sharing information on social media are recurring reasons for employer action and fitness to practise investigations. If you are facing a concern of that kind, this course can sit alongside our confidentiality training and the plan on our confidentiality and social media page. Courses support reflection and remediation; panels decide. Take advice from your defence organisation or union.

• Building a Just and Learning Culture After Incidents, for learning without blame after incidents;
• CQC Inspection Readiness;
• Complaints Handling for Practice and Service Managers.

See the managers and organisations collection or which course do I need.