GPAtlasWhat it covers
Why the information a GP practice holds is valuable, the types we protect, and the law and principles behind confidentiality. The everyday habits that keep it safe: your own login and smartcard, locked screens, spotting phishing and scam calls, social media, and sharing by phone, email and text. How to recognise subject access and Freedom of Information requests, and what to do the same day when a breach or near miss happens. It also covers artificial intelligence tools and scribes, sign-in prompts, memory sticks, work chat apps and how long records are kept.
Who it is for
Everyone in a GP practice who sees patient or staff information: reception, administration, practice managers, healthcare assistants (HCAs), nurses, pharmacists, care coordinators, social prescribers, GPs, trainees, locums, students and volunteers.
By the end you will be able to
- Explain why patient information is valuable, and the types of information we protect.
- Apply data protection law, confidentiality and the Caldicott Principles in everyday work.
- Keep information confidential, accurate and available across logins, smartcards, screens, devices and memory sticks.
- Recognise phishing, scam calls, malware and social media risks, and respond safely.
- Share information safely, and recognise and pass on subject access and Freedom of Information requests.
- Recognise a data breach or near miss, and report it the same day.
Modules
- Why patient information matters
- Your login, screen and smartcard
- Phishing, scams and social media
- Sharing information the right way
- When something goes wrong
- New technology and record keeping
Content mapped to the learning outcomes of the Core Skills Training Framework (England) v1.1: Information Governance and Data Security. Law named: Data Protection Act 2018 and the UK GDPR.
Sources
- Core Skills Training Framework (England) Statutory/Mandatory Subject Guide v1.1, June 2021 (Skills for Health), Information Governance and Data Security: Key Learning Outcomes (archived copy)
- UK GDPR, Article 4: definitions, including personal data, personal data breach and data concerning health
- UK GDPR, Article 5: principles relating to processing of personal data
- UK GDPR, Article 9: processing of special categories of personal data
- UK GDPR, Article 33: notification of a personal data breach to the Commissioner
- UK GDPR, Article 34: communication of a personal data breach to the data subject
- Data Protection Act 2018, section 170: unlawful obtaining etc of personal data
- Data Protection Act 2018, section 164A: complaints by data subjects to controllers (inserted by the Data (Use and Access) Act 2025)
- Computer Misuse Act 1990, section 1: unauthorised access to computer material
- Freedom of Information Act 2000, section 1: general right of access to information held by public authorities
- Freedom of Information Act 2000, section 8: request for information
- Freedom of Information Act 2000, Schedule 1, Part III, paragraph 43A: providers of primary medical services
- The Eight Caldicott Principles (National Data Guardian, 8 December 2020)
- Review of Data Security, Consent and Opt-Outs (National Data Guardian, 2016)
- Confidentiality: NHS Code of Practice (Department of Health, 2003)
- Data Security and Protection Toolkit (NHS England)
- Data Security and Protection Toolkit: overview and introductory guidance
- Data Security Standards: overall guide, the ten National Data Guardian standards
- Data Security and Protection Incident Reporting tool (Data Security and Protection Toolkit news)
- Information governance and data protection, GP good practice guidelines (NHS England, updated 11 March 2025)
- Smartcards and access controls, GP good practice guidelines (NHS England, updated 9 April 2025)
- GP mythbuster 41: Smartcards (Care Quality Commission)
- NHS mail, GP good practice guidelines (NHS England)
- Microsoft Teams and remote working, GP good practice guidelines (NHS England)
- Social media, GP good practice guidelines (NHS England, updated 4 April 2025)
- Subject access requests (SAR), GP good practice guidelines (NHS England, updated 13 March 2025)
- High quality patient records, GP good practice guidelines (NHS England)
- Texting, emailing and messaging patients and service users (NHS England information governance guidance, 21 January 2026, archived copy)
- Personal data breaches: a guide (Information Commissioner's Office)
- How do we recognise a subject access request (SAR)? (Information Commissioner's Office, updated 7 April 2026)
- What makes a valid request? Guide to managing an FOI request (Information Commissioner's Office)
- How to spot a scam email, text message or call (National Cyber Security Centre)
- Phishing attacks: defending your organisation (National Cyber Security Centre)
- Three random words (National Cyber Security Centre)
- Use a strong and separate password for your email (National Cyber Security Centre)
- Mitigating malware and ransomware attacks (National Cyber Security Centre)
- How to identify common cyber threats, NHSmail cyber security guide (NHSmail Support): the Report Phishing button and [email protected]
- Investigation: WannaCry cyber attack and the NHS (National Audit Office, 27 October 2017)
- Opt out of sharing your health records (NHS website, reviewed 6 June 2024)
- UK GDPR, Article 12A: meaning of applicable time period (inserted 5 February 2026 by section 76 of the Data (Use and Access) Act 2025)
- Freedom of Information Act 2000, section 10: time for compliance with request
- Data Protection Act 2018, section 173: alteration etc of personal data to prevent disclosure to data subject
- Right of access: how long do we have to comply? (Information Commissioner's Office subject access guidance)
- Guide to managing an FOI request: what are the timescales for responding? (Information Commissioner's Office)
- Incident reporting, Data Security and Protection Toolkit support (the 72 hour notification)
- Data protection officers, Article 37 UK GDPR, with section 7 Data Protection Act 2018 (public authority)
- The Data (Use and Access) Act 2025 (Commencement No. 9 and Transitional and Saving Provisions) Regulations 2026, SI 2026/1015, regulation 2: the Information Commissioner's office abolished and its functions transferred to the Information Commission on 30 September 2026
- ICO governance changes confirmed for 30 September 2026 (Information Commissioner's Office news, 15 September 2026): the Information Commission will continue to be known as the ICO
- Care Identity Service and NHS Spine users, terms and conditions (NHS England Digital, archived copy of 27 April 2025): no sharing of smartcards or passcodes; a breach may lead to disciplinary proceedings or criminal prosecution
- Data Security and Protection Toolkit 2026-27, version 9, news item dated 2 October 2026, category 4 spreadsheet v1.1: GP practices still answer assertions numbered by the National Data Guardian standards; assertion 3.2.1 asks for at least 95% of staff trained in the last twelve months
- Artificial intelligence, NHS England information governance guidance for health and care workers (30 April 2025, archived copy of 22 March 2026): a DPIA must legally be completed before AI is implemented; the IG lead, DPO and Caldicott Guardian should be involved; re-identification from combined details. Moved to NHS England Digital, last edited 11 May 2026
- Using AI-enabled ambient scribing products in health and care settings, NHS England information governance guidance (31 March 2026, archived copy): only approved products; inform patients at the start; respect objections; check every note before it enters the record; delete the recording once the note is confirmed
- Using AI-enabled ambient scribing products in health and care settings, guidance for patients (NHS England Digital, last edited 7 May 2026, archived copy): told at the start of the session, can ask for a scribe not to be used
- Guidance on the use of AI-enabled ambient scribing products in health and care settings, version 2 (NHS England, published 27 April 2025, updated 30 March 2026, archived copy): DPIA and DCB0160 before use; users review and approve outputs; not for tools used outside the setting's supervision
- Guidance on AI and data protection: accountability and governance (Information Commissioner's Office): in the vast majority of cases AI use triggers the legal requirement for a DPIA; under review after the Data (Use and Access) Act 2025
- Multi-factor authentication for your corporate online services: why MFA matters (National Cyber Security Centre, reviewed 26 September 2024): push notification fatigue or prompt bombing attacks
- Phishing attacks: defending your organisation (National Cyber Security Centre, PDF, September 2026): MFA means a stolen password alone cannot open an account; password managers that will not autofill on fake websites
- Top Tips for Staff (National Cyber Security Centre, 19 May 2025): passwords, securing devices, phishing and reporting
- Cyber Security Small Business Guide, tip 4: control how USB drives and memory cards can be used; approved drives only; transfer files by email or cloud storage instead (National Cyber Security Centre, PDF)
- Device security guidance: using peripherals securely, removable media (National Cyber Security Centre, reviewed 13 May 2025)
- Data Security and Protection Toolkit 2026-27 version 9, category 4 (GP) spreadsheet v1.1: 1.1.5 a named person with overall senior responsibility for data security; 4.5.3 MFA on all remotely accessible user accounts; 9.5.2 encrypted removable devices and port control
- Data Security and Protection Toolkit help 8.1, e-learning FAQs: locally produced training is signed off by the organisation's SIRO or Caldicott Guardian, with an 80% pass mark; 3.2.1 counts new starters, locums, temporary staff and students
- Using mobile messaging, NHS England information governance guidance (20 December 2022, archived copy of 25 July 2025): approved apps, minimise patient information, transfer decisions to the record and delete, conversations may be subject to FOI or subject access requests
- Records Management Code of Practice for Health and Social Care (first published 4 August 2021, updated 7 August 2023, GP living-patient entry reworded May 2024; archived copy of 22 April 2026), Appendix II retention schedule and instant messaging records
- Records Management Code of Practice, Appendix I: public and statutory inquiries (NHS England Digital, last edited 20 May 2026, archived copy of 4 October 2026): retain records until clear instruction from the inquiry
GPAtlas is not accredited, verified or endorsed by Skills for Health or NHS England. Acceptance of this training is at the discretion of your employer, who remains responsible for confirming it meets local requirements. Your employer may require more frequent refreshers than the guidance period; the practice's own policy applies. Some pictures and films in our courses, and the film narration, are made with AI tools. We check every one for accuracy before we publish it.