Care and health records
Care plans, risk assessments, daily notes, medication administration records and body maps.
Health information is special category data under UK GDPR, so it carries a higher standard of protection.
Customer storyCare“I have everything protected when I cannot be on site.”
How an award-winning care business uses Offline Secure Storage® for storage and backups, while retaining control of its data, its users and its existing IT relationship.
Illustration
- With Firevault
- 12 months
- Organisation
- Multi-site
- Sector
- Highly regulated
- IT provider
- Retained
As featured in
The challenge
“I have multiple sites for my care business.”
Running a multi-site care organisation means responsibility for important information reaches well past a single site. Protecting information supports the people delivering care every day.
Protection when leadership cannot be on site
The organisation wanted greater confidence that important business data and backups were protected when senior leadership could not be physically present, while operating in a heavily regulated industry.
No new gap between suppliers
The organisation already had an IT provider. Any new approach needed to work alongside the existing environment rather than create another gap between suppliers.
What is at stake
“Something which is a priority for me as we are in a heavily regulated industry.”
A care organisation holds some of the most sensitive information there is, and the law sets out how it must be kept. This is the general position for registered providers in the United Kingdom, not a description of this customer’s records.
Resident and family information
Next of kin and emergency contacts, funding and financial assessments, capacity and best-interest decisions.
Safeguarding and incident records
Safeguarding referrals, accident and incident reports, complaints, and notifications.
Staff and employment records
Recruitment files, DBS checks and right-to-work evidence, training and supervision records, rotas, payroll.
Contracts and commissioning data
Local authority and NHS contracts, invoices, service user placements.
Operational evidence
Policies, audits, maintenance and fire records, CCTV where used, and the governance trail.
The legal responsibilities
What the law asks of a registered provider.
Firevault does not provide legal advice. Every provider should confirm its own obligations with its data protection officer or legal adviser.
UK GDPR and the Data Protection Act 2018
Secure, lawful processing
Personal data must be processed lawfully and kept secure using appropriate technical and organisational measures.
Health data is special category data and needs an additional lawful condition. A personal data breach likely to risk people’s rights must be reported to the ICO within 72 hours.
ICO guide to UK GDPRGood governance: Regulation 17
Accurate, complete records
Registered providers must maintain accurate, complete and contemporaneous records for every person using the service and for staff.
Records must be available to the regulator on request.
Regulation 17Records management and retention
Kept for years
Adult social care records, including care plans, carry a minimum retention period of eight years.
Information cannot simply be deleted when a placement ends, so it has to be kept safely for years.
NHS England retention scheduleAvailability during disruption
Care continues
Care continues during an outage or a cyber attack.
Providers are expected to plan for business continuity so that care records remain available to the people delivering care.
CQC guidance for adult social careThe support received is professional, knowledgeable, and proactive.
What Firevault delivered
In the customer’s words.
“I have been working with Firevault for a year or so now.”
Storage and backup
“Using Firevault for storage and backups helps reassure me that I have everything protected when I cannot be on site.”
“I have regular backups to ensure that no data is exposed to cybercrime.”
A smooth transition
“The Vault set up was easy enough with a smooth transition from my previous data storage.”
Existing IT provider retained
“The team at Firevault worked well with our existing IT provider to ensure that there were no gaps that we had not thought about.”
Access around the organisation
“They worked alongside me and my team to ensure that access was granted to the right people.”
Customer autonomy
“I had full autonomy over the way the Vault was managed.”
“They facilitated the requests I had and adapted to what our business needed.”
Ongoing support
“The team at Firevault reassured me and evidenced that data is secure.”
“I am thoroughly happy with the service we received and continue to receive with their after-care.”
The care industry changes regularly and we are proud that we can keep up with the changes, especially when it comes to data security.
Disconnect to Protect®
Offline Secure Storage® for selected data.
Offline Secure Storage® is designed for selected data that does not need to remain permanently reachable. Published with the customer’s approval. The organisation is not named at its own request.
