Close
Where patient data, sensitive personal data or otherwise highly confidential information are involved there are always going to be risks.
Methods, environment and infrastructure all need to be assessed for risk. When assessing risk, practitioners look at impact and likelihood of a breach. So, one imagines the severity of discomfort/suffering caused to the individual or the penalty to the organisation if the information was found to have been disclosed inappropriately; and the probability of that disclosure occurring in spite of the organisation's attempts to prevent it; and multiplying the one by the other gives a value which can be used to quantify the risk.
In practice this does mean making plenty of subjective judgements since it is hard to say, for example, whether a break-in, a hacker, a rogue staff member or a simple mistake is about to impact on you. Equally, the relative merits of various technical options can be difficult to assess. This is why staff in UCL Information Services have spent time developing objective measures of information risk with research data in mind.
SLMS policy states that sensitive data obtained by staff within the SLMS is assessed for information risk both in terms of the workplace security and the information transfers. These risk assessments are documented by staff as part of the SLMS Information Governance Framework.
If you are involved in handling these kinds of data then it is critical that your planning includes a risk assessment which can be used to make informed judgements. Decisions that are made without adequately assessing the risks are likely to face criticism where the decision later contributes to a breach of confidentiality.