Digital Security and Confidentiality Audit - Supported Living

Evidence to check

• • Digital security and data protection policy is current and aligned with GDPR and the Data Protection Act 2018
• • Policy covers mobile working, shared accommodation, tenant homes, digital care records, photos, messaging and remote access
• • Staff can explain how they protect confidentiality during visits and in shared settings
• • Policy is reviewed after breaches, system changes or new digital tools

Evidence to check

• • Training records for confidentiality, GDPR, cyber security and digital systems
• • Staff can answer practical scenarios about mobile devices, shared homes and information sharing
• • Refresher training is completed where required
• • Supervision or team meetings reinforce learning after breaches or near misses

Evidence to check

• • Devices are password, PIN, biometric or multi-factor protected where appropriate
• • Device encryption or approved security controls are in place
• • Devices lock automatically when not in use
• • Lost or stolen device procedures are understood and followed

Evidence to check

• • Access permissions are role-based
• • Staff only access records for tenants they support or manage
• • Managers review access rights periodically
• • Unauthorised access concerns are investigated

Evidence to check

• • Paper records are stored in locked or restricted-access locations where required
• • Records are not left visible to visitors, co-tenants, relatives or contractors
• • Staff know how to transport paper records securely
• • Archived or outdated paper records are removed or stored according to policy

Evidence to check

• • Consent to share information is recorded and current
• • Rationale is recorded where information is shared without consent due to risk or legal duty
• • Information shared is relevant, proportionate and secure
• • Staff understand confidentiality does not prevent safeguarding escalation

Evidence to check

• • Care record audits include accuracy and data minimisation
• • Outdated, duplicated or irrelevant information is corrected or archived
• • Records use respectful and factual language
• • Tenant information is updated after changes in needs, risks, consent or preferences

Evidence to check

• • Approved email, care system and messaging platforms are identified
• • Staff know which systems may and may not be used for tenant information
• • Sensitive information is shared using secure methods
• • Communication records are retained where required

Evidence to check

• • Data breach and near-miss records
• • Immediate containment actions are recorded
• • Investigation identifies cause, impact and whether external reporting is required
• • Learning is shared and practice changed where needed

Evidence to check

• • Staff understand prohibited or restricted communication methods
• • No tenant-identifiable information is sent through unapproved channels
• • Managers check and act on unsafe communication practices
• • Clear guidance exists for urgent communication where secure systems are unavailable

Evidence to check

• • Consent records state who information can be shared with and for what purpose
• • Support plans reflect communication preferences and restrictions
• • Staff check consent before speaking with family, advocates, housing providers or professionals where required
• • Consent is reviewed when circumstances or relationships change

Evidence to check

• • Records retention and disposal policy
• • Confidential waste arrangements are used for paper records
• • Digital records are deleted or archived only through approved processes
• • Staff do not store tenant records on personal devices or unapproved drives

Evidence to check

• • Backup arrangements for digital care systems and key documents
• • Backups are secure and access-controlled
• • Business continuity plan includes digital system downtime
• • Recovery or backup access is tested or confirmed by provider assurance

Evidence to check

• • Software updates, patches and security controls are managed
• • Antivirus or endpoint protection is used where appropriate
• • Unsupported systems or outdated devices are identified and replaced or risk-assessed
• • Cyber security concerns are escalated promptly

Evidence to check

• • Approved systems list or procurement checks
• • Data protection impact assessment or supplier assurance where required
• • Access, storage, audit logs and data hosting arrangements are reviewed
• • Unapproved apps are not used for tenant records or sensitive communication

Evidence to check

• • Mobile working or device-use policy
• • Staff protect screens from visitors, co-tenants and others in the home
• • Photos or recordings are taken only where authorised and consented to
• • Staff maintain professional boundaries when using phones in tenants’ homes

Evidence to check

• • Privacy notice or data information is available in accessible formats
• • Tenants are told what information is kept and why
• • Subject access or record access requests are managed appropriately
• • Advocacy or communication support is offered where needed

Evidence to check

• • Staff can explain confidentiality risks in shared homes and community settings
• • Observation or feedback confirms confidential conversations are handled discreetly
• • Staff avoid discussing tenants in corridors, cars, public places or shared areas
• • Concerns about overheard information are recorded and addressed

Evidence to check

• • Leaver and role-change checklist
• • System access is revoked promptly after leaving
• • Access rights are updated after role or service changes
• • Managers audit inactive users and unnecessary access

Evidence to check

• • Remote working policy and security guidance
• • Staff use approved devices, secure networks and multi-factor authentication where required
• • Records are not downloaded, printed or stored insecurely at home
• • Confidential conversations and screens are protected when working remotely

Evidence to check

• • CCTV policy, signage and privacy information
• • Purpose, lawful basis and retention period are documented
• • Tenant rights, privacy and consent or consultation are considered
• • CCTV is not used in private areas or in a way that unnecessarily restricts tenants

Evidence to check

• • Support plan records the purpose of digital tools or assistive technology
• • Consent, capacity or best-interest decision is recorded where relevant
• • Privacy, proportionality and least restrictive options are considered
• • Technology is reviewed to ensure it still benefits the tenant

Evidence to check

• • System audit logs are available and reviewed where possible
• • Unusual access patterns are investigated
• • Staff understand that record access may be monitored
• • Access audit findings are reported through governance where relevant

Evidence to check

• • Governance records include data breach themes
• • Lessons from breaches are shared with staff
• • Policies, training or system controls are updated after breaches
• • Repeat breaches trigger stronger action and senior oversight

Evidence to check

• • Digital security included in audit programme
• • Risk assessments consider mobile working, shared accommodation, tenant homes and assistive technology
• • Quality reports include data protection and confidentiality themes
• • Actions from digital security audits are tracked and completed

Evidence to check

• • Support plans record digital support needs and boundaries
• • Staff do not access tenant accounts without consent and clear purpose
• • Online safety, scams, passwords and privacy are discussed where appropriate
• • Tenant independence and choice are promoted rather than staff taking control

Evidence to check

• • Social media and professional boundaries policy
• • Staff do not add tenants, relatives or advocates on personal social media unless explicitly permitted by policy and risk-assessed
• • Photos, videos or messages involving tenants are not stored on personal devices
• • Boundary breaches are recorded, investigated and acted on

Evidence to check

• • Digital security audit includes staff questioning and spot checks
• • Audit reviews mobile device security, record access, messaging and confidentiality risks
• • Tenant feedback is considered where digital tools affect them
• • Actions from audits lead to visible improvements