Acceptable Use Policy

Assurance Statement

1. This policy describes the acceptable use of the LeDeR web-based platform (WBP) and the responsibilities of its users.
2. NHS England will ensure that users of the WBP are sufficiently informed of the policy requirements to be able to comply with the policy. All updates to the policy will be communicated to existing users.

Scope of Policy

1. Each LeDeR partner must have their own policy, or set of policies, that includes the acceptable use of their Information Technology assets, email, internet, network and systems/applications/software use. These policies should align to the relevant national standards set out by the Data Security and Protection Toolkit or equivalent national standards.
2. This policy is supplementary to the policy/policies of the LeDeR partners and covers only the use of the WBP.

Prohibited Use

1. Staff must only access and/or use information in the WBP that they are authorised to access and solely for the purpose of the LeDeR programme.
2. Staff must follow established procedures for password changes.
3. Staff must take all reasonable steps to maintain;
   1. the confidentiality of their access to the WBP
   2. the information within the WBP, and,
   3. the security of the WBP (i.e. staff must not share their access credentials).
4. Personal use of the WBP, such as access by staff to information about their self or someone they know in a personal capacity, is strictly forbidden.
5. For circumstances where staff may be required to access the records of someone they know, acting in their professional capacity, they should consult their employer’s policy and/or seek authorisation from their organisation’s Caldicott Guardian or an appropriate senior clinician within their organisation.
6. Access to the WBP must be by way of individual accounts (each staff member should have credentials that are unique to them).
7. It is strictly forbidden to circumvent, attempt or cause to circumvent, established security mechanisms or controls to view, modify, delete or transmit information in the WBP.
8. It is strictly forbidden for staff members to share their, or another staff member’s, usernames or passwords to gain access to the WBP.
9. It is strictly forbidden to access or use information in the WBP in support of any illegal activities.
10. Anyone that is found to have made unacceptable use of the WBP may be disciplined and/or prosecuted.
11. If a staff member has read this policy and is still unsure what is considered to be acceptable or unacceptable use of the WBP, they must check with their organisation’s Caldicott Guardian or an appropriate senior clinician.

Definition of Terms

Duties and Responsibilities

1. Overall responsibility for this Acceptable Use Policy must be determined by each LeDeR partner, this should rest with the Director (or equivalent) that has responsibility for information risks (e.g. in NHS organisations this would be the individual occupying the role of Senior Information Risk Owner).
2. The LeDeR partners’ Caldicott Guardians will provide advice and guidance on acceptable use of the WBP where applicable.
3. Employees of LeDeR partners will receive instruction and direction regarding this policy from a number of sources:
   • Policy and Strategy Manuals
   • Line Managers
   • Training courses
   • Acceptable Use statement (displayed routinely on screen when accessing the WBP)
   • Other communication methods (e.g. briefings or newsletters)
4. Users of the WBP must report any personal data breaches, incidents or near misses pertaining to data in the WBP as soon as reasonably practicable to This email address is being protected from spambots. You need JavaScript enabled to view it.

Monitoring Arrangements

1. Access and use will be recorded and may be monitored or audited for the purpose of investigating legitimate concerns.
2. This policy will be reviewed at least on a yearly basis, or when required following:
   • Legislative changes
   • Good practice guidance
   • Case law
   • Significant incidents reported
   • New vulnerabilities
   • Organisational changes