So führen Sie eine unternehmensweite IG-Risikoanalyse durch

Information governance (IG) is about more than data protection policies or annual staff training. At its heart, it’s about protecting patient trust and ensuring that personal, confidential data is handled safely, lawfully, and responsibly. Every general practice should conduct regular IG risk assessments. These reviews help you identify where your practice may be vulnerable - whether due to outdated systems, unclear processes, or human error - and take action before a data breach occurs. In this guide, we explain what an IG risk assessment involves, how to run one in your practice, and how to ensure it becomes a living part of your governance culture. 

Warum IG-Risikoanalysen wichtig sind 

An IG risk assessment is not just a paperwork exercise to satisfy CQC or DSPT requirements. It’s a structured way of answering questions like: 

• Where could our systems or staff processes expose us to risk? 

• Are we doing what we think we’re doing when it comes to handling patient data? 

• What would happen if a laptop was lost, a folder was misplaced or a member of staff clicked a phishing link? 

By identifying weak spots before incidents occur, you reduce the chance of patient harm, reputational damage or regulatory penalties. Done well, these assessments also strengthen staff understanding and ownership of IG responsibilities. 

Wann eine IG-Risikoabschätzung durchgeführt werden sollte

A full practice-wide IG risk assessment should ideally be carried out: 

• At least once per year as part of your governance cycle. 

• Ahead of completing your annual DSPT submission. 

• Nach größeren Änderungen (z. B. neue Systeme, Fusionen, neue Drittanbieter).

• Following an incident, breach, or near miss. 

• As part of preparation for a CQC inspection. 

It doesn’t have to be an overly complex process - but it should be thorough, documented, and shared with those who need to act on it. 

Was in Ihre IG-Risikoanalyse aufgenommen werden sollte 

A good assessment will cover both technical systems and day-to-day human behaviours. Consider reviewing: 

1. Datenzugriff und Berechtigungen 

• Who can access clinical systems, and are permissions appropriate? 

• Are shared logins being used? 

• Are joiners, movers and leavers processes in place? 

2. E-Mail und Kommunikation 

• Is patient information ever sent via non-secure email? 

• Do staff know how to check for verified NHSmail accounts? 

• Is there a standard process for sending referral attachments? 

3. Papierakten und physische Sicherheit 

• Are printed documents ever left unattended on desks or printers? 

• Is there a shred-all policy or designated confidential waste process? 

• Are consultation rooms and reception areas secure? 

4. IT-Infrastruktur und Cybersicherheit 

• Are operating systems and antivirus software up to date? 

• Are USB ports and personal devices controlled? 

• Are backups regularly tested? 

5. Drittanbieter und Datenverarbeiter 

• Do you have up-to-date Data Processing Agreements (DPAs)? 

• Are non-NHS software tools GDPR compliant and risk assessed? 

6. Mitarbeiterverhalten und Schulung 

• When did each staff member last complete IG training? 

• Are staff confident in handling SARs or data requests? 

• Are there clear lines of responsibility for IG issues? 

You can use templates provided by the DSPT, your ICB, or DPO as a starting point - but the most effective assessments will reflect how your practice actually works day to day. 

So führen Sie die Bewertung durch 

1. Planen und Verantwortlichkeiten zuweisen

Nominate a named lead for the assessment - this may be the practice manager, Caldicott Guardian, or IG lead. Decide whether to involve team leaders or rotate responsibility across teams. 

2. Beweise und Erkenntnisse sammeln

This might include system logs, audit trails, training records, screenshots, or physical walkthroughs. Consider involving IT support or external suppliers for technical elements. 

3. Risiken bewerten und Maßnahmen vereinbaren

Use a simple matrix to assess likelihood and impact. For example: 

• Low likelihood, high impact: USB port left open but no known use. 

• High likelihood, low impact: Confidential notes left briefly on printer. 

• High likelihood, high impact: No process for revoking leavers’ access. 

Agree and document what actions will be taken, by whom and by when. 

4. Berichten und Überprüfen

Summarise findings in a clear, practical format. Highlight priority areas and present it to your partners, DPO, and governance lead. Store securely and schedule a review date. 

Integration von Risikobewertungen in die Unternehmenskultur 

The real value of an IG risk assessment isn’t the document - it’s the change it helps create. Use the opportunity to raise awareness with your team, celebrate good practice, and build confidence in speaking up about data risks. You might include IG risk assessments as part of: 

• Annual staff appraisals. 

• Induction for new staff. 

• Your Significant Event Audit (SEA) process. 

• Your regular team or clinical governance meetings. 

Letztes Wort: Vorbeugung ist Schutz

A well-run IG risk assessment gives you something few other processes can: foresight. It helps you prevent breaches, protect patients, and demonstrate strong, proactive leadership. In a world where practices are increasingly reliant on digital systems and shared care models, IG risks are no longer abstract or occasional. They’re daily, embedded in almost every interaction. By making IG risk assessment a regular part of your practice’s rhythm, you create safer systems, more confident teams, and a culture where protecting patient information is second nature.