Table 1.

Caldicott audit points

Audit points		Audit level 0	Audit level 1	Audit level 2
1	Information for patients/clients on the proposed uses of information about them	No information provided, or limited to simple posters and leaflets in waiting rooms, etc	An active information campaign is in place to promote patient understanding of NHS information requirements	An active information campaign is supported by comprehensive arrangements for patients with special/different needs
2	Staff code of conduct in respect of confidentiality	No code exists, or staff not generally aware of it	Code of conduct exists and all staff aware of it	Code regularly reviewed and updated as required
3	Staff induction procedures	No mention of confidentiality and security requirements in induction for most staff	Basic requirements outlined as part of induction process	Comprehensive awareness raising exercise undertaken and comprehension checked
4	Confidentiality and security training needs assessment	Training needs not assessed systematically for most staff	Training needs only considered as a consequence of organisational or systems changes	Systematic assessment of staff training needs and evaluation of training that has occurred
5	Training provision (confidentiality and security)	No training available to most staff	Training opportunities broadcast with take up left to line management discretion	In house training provided for staff; for example, comparable to health and safety training provision
6	Staff contracts	No reference to confidentiality requirements in staff contracts	Confidentiality requirements included in contracts for some staff	Contractual requirements included in all staff contracts
7	Contracts placed with other organisations	No confidentiality requirements included	Basic agreements of undertaking are signed by contractors	Formal contractual arrangements exist with all contractors and support organisations
8	Reviewing information flows containing patient identifiable information	Information flows have not been comprehensively mapped	Information flows have been mapped and senior management has been informed	Procedures are in place for the regular review of information flows and the justification of purposes
9	Internal information/data “ownership” established	Information/data “ownership” has not been established for all information/data sets	“Ownership” established for all information/data sets and register established	All “owners” justifying purposes and agreeing staff access restrictions with the guardian
10	Safe haven procedures in place to safeguard information flowing to and from the organisation	No safe haven procedures used	Safe haven procedures used for some information flows	Safe haven procedures in place for all patient identifiable information
11	Protocols governing the sharing of patient identifiable information with other organisations locally agreed	No locally agreed protocols in place	Partner organisations clearly identified and information requirements understood	Agreed protocols in place to govern the sharing and use of confidential information
12	Security policy document	No security policy available	Security policy exists but not reviewed within last 12 months	Security policy reviewed annually and reissued if appropriate
13	Security responsibilities	No information security officer appointed, or existing officer is not appropriately trained	An appropriately trained information security officer is in post	Responsibility for information security identified in various staff roles, coordinated by the security officer
14	Risk assessment and management	No programme of information risk management exists	A risk management programme is under way and reports are available	A formal programme exists with regular reviews, outcome reports, and recommendations provided for senior management
15	Security incidents	No incident control or investigation procedures exist	The security officer handles incidents as they arise	Procedures are documented and accessible to staff to ensure incidents reported and investigated promptly
16	Security monitoring	No monitoring or reporting of security effectiveness or incidents takes place	Basic reporting of major incidents or problem areas only	There are regular reports made to senior management on the effectiveness of information security
17	User responsibilities	No guidance issued to staff for password management	Users encouraged to change passwords regularly but this is at their discretion	Password changes are enforced on a regular basis
18	Controlling access to confidential patient information	Staff vigilance, and/or an “honour” system control access. Some physical controls, lockable rooms, etc, may exist	Access for many staff controlled by “all or nothing” systems. Staff groups requiring access identified and agreed with the guardian	All staff have defined and documented access rights agreed by the guardian. Access is controlled, monitored and audited