EMIS Web Confidentiality Agreement

Please read the following agreement and confirm below:

This document should be viewed as a means of establishing a standard to govern the access of North Mersey Clinical Commissioning Groups’ (CCG’s) and Mersey Care NHS Trust (MCT) information relating to access to the North Mersey CCG’s and MCT’s EMIS Web system.  It lays the foundation to ensure that access to patient information is compliant with current legislation including the provisions of the Data Protection Act 2018 and that the Common Law Duty of Confidence is maintained.
This agreement is supplemented by legislation, North Mersey CCG’s and MCT’s policies and procedures and national guidelines including but not exclusive to the following:

•	IM&T Information Security Policy
•	Information Sharing and Confidentiality Policy and Procedures
•	Confidentiality – NHS Code of Practice
•	The Human Rights Act 1998
•	Data Protection Act 2018
•	Common Law Duty of Confidence
•	UK General Data Protection Regulation 2018

North Mersey CCG’s and MCT must ensure that it considers its legal obligations under the terms of the Data Protection Act when considering whether allowing staff access to patient information.
Background and Conditions for Access
Access to information and information processing facilities, in relation to the EMIS Web System by staff may not be provided until the appropriate controls have been implemented as follows:

•	Only named clinicians will have access rights to EMIS Web

•	An EMIS Web user account request must be completed and signed off by the relevant staff members line manager

•	A standard role of activities will be provided and any variations to this role must be applied for, stating the justification for this variation.

•	All staff must complete EMIS Web training for the relevant access before user names/log on details are provided

•	Access to EMIS Web must be supervised in that ;

•	It must only be accessed via suitable location

•	The location of the computer is in an area deemed as a Safe Haven and cannot be accessed by unauthorised personnel.

•	Provision of access will be regularly monitored and reviewed by North Mersey CCG’s and MCT.

•	All staff must be made aware of the conditions under which they may access patient information and will be required to sign a declaration of understanding the terms and conditions of access – see Appendix A

•	A form must be completed for each user, to enable a user to log on an interim password set up, and North Mersey CCG’s and MCT keep a log of those staff accessing the system.

•	It is the responsibility of a named sponsor to ensure that patients are provided with relevant information to ensure North Mersey CCG’s and MCT meet the ‘Fair Processing’ requirements of the Data Protection Act

 
Appendix A

You have been provided with access to North Mersey CCG’s and MCT’s EMIS Web system.  The following Code of Conduct to protect patient information must be observed at all times;

Protecting Patient Information – Code of Conduct

•	Do not breach patient confidentiality – keep confidential information safe by following the basic rules listed below:

•	Do not access information you are not authorised to see or disclose patient information to anyone who is not authorised to receive it. Do not give your computer, log in details or security passwords to any other person – under any circumstances.  If you think someone knows your password then you must change it immediately and report it to your supervising clinician.

•	Do not use someone else’s password to gain access to information – if you forget your password you should contact your local IT service desk

•	Do not leave a computer terminal logged onto the system unattended

•	Do not leave patient health records unattended

•	Do not download patient identifiable information from the system

•	Do not access information about yourself, your relatives, friends and neighbours

•	Data should only be accessed on a need to know basis


I will read and strictly follow the conditions of EMIS Web access and have completed the relevant form that must be signed to enable the issuing of a log on and password.

Unauthorised browsing or disclosure of patient information could have a detrimental effect on your future career.  The North Mersey CCG’s and MCT have the right to monitor and revoke user access and activity.

I confirm that I have read and understand the North Mersey CCG’s and MCT’s Code of Conduct to protect patient information (text above).

I confirm that I understand, accept and agree to be bound by the principle of confidentiality of patient records and patient data.

I will therefore take all responsible precautions to ensure that any personal data concerning patients, which I have learned by virtue of my role, will be kept confidential.

I confirm that I will not discuss patients with other professionals outside the clinical setting.

I understand that if I fail to adhere to the Code of Conduct the North Mersey CCG’s and MCT will revoke access to the system.