• Paul White

Should organisations share data breach information?

Updated: Feb 24

 

Should you share data breach information? | NetworkWorld.com Community

An interesting question put to two commercial CEO’s, which is a question of some relevance for the NHS.


One of the challenges I believe many organisations face is the fact that if they do anything to improve Information Governance capability, the process of doing so invariably exposes issues that have previously gone un-noticed or worse,  ignored.


The NHS policy currently states that anything constituting a breach above a certain level, must be disclosed as a Serious Untoward Incident (SUI), which is then made publicly available through Strategic Health Authority (SHA) websites.


Ironically a consequence of being forced to publish information in SUI’s creates a fairly significant disincentive for organisations to take positive action, in particular in regard to investment in technologies that help improve compliance capability.


I wrote to the NHS Information Governance team at NHS Connecting for Health expressing this concern and ask whether organisations could be granted a SUI publication amnesty for a short defined period, providing consequently time to put compliance technology into service. Despite chasing I unfortunately didn’t manage to secure any response from them on this idea.


As it is the SUI process is somewhat flawed, in that it is open to a wide range of interpretation, you only have to look at what has been published previously on SUI incidents to see that this is not a satisfactory process as it stands.


I am a supporter of greater transparency and openness in healthcare, but I think it has to be acknowledged that transparency and openness can sometimes be a problem, rather than a cure. Especially when the standard for what should be published is interpreted so differently.


#NHS #SeriousuntowardIncident #SUI

0 views0 comments