FAQs for staff in health and care organisations

Last updated 1 July 2020

Can I work from home for example if I have to self-isolate? 

To help underpin staff working from home, your organisation should have an agreed policy for you to refer to which covers this. If your organisation considers it is suitable for you to work at home, then this should be possible if you: 

  • Use the IT equipment issued by your organisation wherever possible as this should have the appropriate security protection.  
  • Use a secure network connection, e.g. home wifi that requires a password so information is not sent or received over a public wifi network.  
  • Ensure any applications or software solutions you use have appropriate security (such as using strong passwords).
  • Ensure the security of any physical documents you take home, particularly those that contain personal/confidential patient information.
  • Lock print outs and devices away at the end of the working day if possible, to avoid loss or theft of personal/confidential patient information.

If you are using your own device, you should contact your IT department and see if they can install programs on your own equipment or send you links to software to download to secure your own equipment. If that’s not possible you should keep your software up to date to make it more difficult for an attacker. You should also avoid mixing your organisation’s information with your own personal information to avoid accidentally keeping hold of information for longer than is necessary.  

The ICO has published its own guidance on home working here. See question below regarding the additional precautions you should take when accessing and /or using confidential patient information (CPI) when working from home. 

Can I access and/or use confidential patient information (CPI) when working from home?

 When accessing and using CPI at home you should protect it in the same way you would normally. You should follow the recommendations set out in the question above on homeworking and take the following additional precautions when accessing and /or using CPI: 

  • If you need to share CPI with others then choose NHS Mail, a secure messaging app or online document sharing system. If you don’t have access to these and need to use an alternative email account, which may not be secure, consider password protecting documents and sharing the passwords via a different channel, like text;
  • Consider who else is in the household, and if they can access CPI accidently or inappropriately (such as looking over your shoulder);
  • CPI should be used for the minimum time necessary for your purpose, and in a way that minimises disclosure;
  • Once the reason for accessing CPI at home has passed, then any CPI that is stored must either be returned to the organisation as soon as possible, or if it is duplicated then your copies must be destroyed. 

What about if I’m overseas and I cannot return, can I still work? 

This will depend on your role and your organisation agreeing it is appropriate.  The requirements are the same as working from home (see above) however in addition you should discuss it with your Data Protection Officer (DPO). 

Can I share information with a health & care professional based at another health and care organisation if they are supporting the individual care of a patient/service user?  

Information should be shared to support individual care.  For example, a Radiologist in Birmingham could view and report on an image of a patient from Kettering, because Kettering temporarily has a reduced number of Radiologists. You should ensure that your DPO is aware so that they can update your organisation’s privacy notice as appropriate.  

Can I use video conferencing and other tools with patients who are critically ill to communicate with their family members? 

Where a patient is critically ill due to COVID-19 you can use mobile devices in order to facilitate communication between patients and their families.  NHSX encourages the use of video conferencing between health and care professionals and patients to support individual care and to reduce the spread of COVID-19. This can be extended to facilitating conversations between health and care professionals and the family of critically ill patients. See full guidance here.

Can we carry out group sessions with patients and service users using video conferencing tools

Using video conferencing tools may mean you can continue to provide group sessions for patients and service users safely during the COVID-19 period. For example antenatal classes or physiotherapy sessions.
You should ensure patients and service users understand that they are joining a group session and any information they share during the session will be seen or heard by others in the group. You should also consider setting out some terms of use for patients/service users, e.g. do not take screenshots or record the session. The consent of the patient or service user, under common law, is then implied by them accepting the invite and entering the consultation. There should be no compulsion to sign up or use the service, but services need to make sure they have provided as much information as possible so patients and service users can make an informed choice.

You should use a video conferencing tool that has been approved by your organisation and follow any advice set out in your organisation's policy on video conferencing with patients and service users.