IG Information Risk

Purpose

The purpose of this policy is to set out how the organisation identifies, assesses, manages, and mitigates information risks to ensure the confidentiality, integrity, and availability of the information it holds. It ensures compliance with statutory, regulatory, and contractual obligations including:

Scope

This policy applies to all employees, contractors, temporary staff, and third parties who access, process, store, or manage organisational information, regardless of format or location.

Policy Statement

BrisDoc is committed to managing information risk effectively and proportionately as part of our overall governance framework. We aim to maintain the trust of patients, staff, partners, and the public by embedding a culture of responsible information stewardship.

Roles and Responsibilities

Board

- Overall responsibility and accountable for Information risk

CEO

- SIRO accountable to the CEO and is responsible for day-to-day assurance

Senior Information Risk Owner (SIRO)

- Leads the organisation’s information risk management programme
- Provides assurance to the Board on the effectiveness of controls
- Chairs the Information Governance Board
- Produces annual assurance report

Caldicott Guardian

Ensures patient confidentiality and compliance with the Caldicott Principles
Works with the SIRO on risks involving patient and staff identifiable information

Information Governance (IG) Leads

Supports the implementation of risk management controls
Co-ordinates the maintains the Information Asset Register (IAR) with Information Asset Owners.
Coordinates IG training and awareness

Information Asset Owners (IAOs)

Accountable for the protection of information assets within their domain
Conduct regular risk assessments and report incidents
Maintain Information Asset Registers

All Staff

Must comply with policies and report suspected information risks or breaches
Complete mandatory IG and cybersecurity training annually

Risk Identification and Assessment

Information risks are identified through a combination of:

Risk assessments by IAOs and the IG Lead/SIRO
Reviews of incidents, near misses, and audit findings
Change management processes (e.g. new systems or suppliers)

Threat intelligence from sources including NCSC and NHS England
Information risks are logged on the corporate risk register, reviewed by IG Board and Senior Leadership Team (SLT)

Risk Appetite

BrisDoc’s risk appetite reflects our commitment to patient safety, compliance, and innovation. The following categories define our tolerance levels:

Patient Safety
• Appetite Level: None
• No tolerance for risks that could harm patients or compromise clinical care.
Legal & Regulatory Compliance
• Appetite Level: None
• No tolerance for breaches of UK GDPR, Data Protection Act, or NHS DSPT requirements.
Confidentiality & Privacy
• Appetite Level: Very Low
• Minimal tolerance for risks that could lead to unauthorised disclosure of personal data.
Operational Continuity
• Appetite Level: Low
• Limited tolerance for minor disruptions if mitigated and recovery plans exist.
Innovation & Digital Transformation
• Appetite Level: Moderate
• Controlled tolerance for risks that enable innovation, provided safeguards are in place.
Financial Impact
• Appetite Level: Low
• Limited tolerance for risks causing minor financial loss; none for significant penalties.
Reputational Impact
• Appetite Level: Very Low
• Minimal tolerance for risks that could damage public trust or organisational reputation.

Third-Party & Supplier Risk

BrisDoc recognises that third-party suppliers and partners play a critical role in delivering services and managing information. To ensure the confidentiality, integrity, and availability of organisational data, we will:

Due Diligence
• Conduct risk assessments on all suppliers handling sensitive or personal information prior to engagement as part of the onboarding process, to verify compliance with relevant standards such as UK GDPR, NHS DSPT, and Cyber Essentials.
Contractual Controls
• Include clear information governance and security clauses in all contracts, covering data protection, breach notification, and audit rights.
Ongoing Assurance
• Monitor supplier compliance through regular reviews, audits, and DSPT submissions where appropriate.
Incident Management
• Ensure suppliers have robust incident response processes and agree to notify BrisDoc within defined timeframes for any data breach or security incident.
Termination & Exit
• Implement secure data return or destruction processes at contract end to prevent unauthorised retention or disclosure.

Risk Reporting and Assurance

IAOs review information risks at least annually
The SIRO reports information risk quarterly to the Board or Audit Committee
The DSPT are used to benchmark and monitor progress
Internal and external audits provide independent assurance

Incident Management

All information risk incidents must be reported via the Learning Events Portal and assessed for:

Impact to individuals, services, or systems
Notifiability to the Information Commissioner’s Office (ICO) or NHS England
Root cause and required remedial action

Serious incidents are reviewed by the SIRO and Caldicott Guardian, details are logged in the Learning Event portal when required.

Training and Awareness

Mandatory IG and cyber training is required annually for all staff
SIRO/CG receive enhanced training on risk ownership and mitigation
Lessons from incidents are shared and used to improve awareness

The IG Board monitors staff completion of mandatory training quarterly. Lessons from incidents are used to enhance the training content.

Monitoring and Review

This policy will be reviewed annually or following:

Major changes in legislation or guidance
Significant security or information incidents
Organisational restructure or IT transformation

The policy will be shared with the IG Board membership and via BrisDoc’s intranet ‘radar’.

Related Policies and Guidance

Privacy by Design Policy
Data Protection and Confidentiality Policy
Cyber Security Policy
Information Governance Framework
Acceptable Use Policy
Business Continuity and Disaster Recovery Plan

Version Control

Date	Version	Author	Change Details
14/07/25	Vn 1.0	DL	First draft policy produce as a result of SIRO training and discussion with DPO