Data Security Assessment 2024

As part of our annual IT Governance assessment we are required to complete a level of training in data security. The training consists of a Workbook and an Assessment.

The workbook sets out the principles of Data Security. A paper copy of the workbook is available upstairs and in reception.

It is also on the shared drive H://Data_Security/Data_security_workbook2019.doc

Please read the Data Security Workbook and then complete this assessment which will be scored. Please don’t forget to add your name at the bottom of the form!

As part of our annual assessment we are required to complete a level of training in data security. The training consists of a Workbook and an Assessment.

Question 1: Which of the following statements on the types of information used in health and care is correct? Tick one option from the answers listed below.

Personal information applies only to living people

Personal information applies only to patients

A person’s name and address are needed for them to be identified

An unusual name will not identify an individual

Anonymised information cannot be personal or confidential

Question 2: Which of the following statements on the topic of confidentiality is correct? Tick one option from the answers listed below.

It is not necessary to explain how someone’s personal information will be used

It is not necessary to give them a choice about how their personal information is used

It is not necessary to tell them before their personal information is shared for the first time

It is not necessary to get consent every time you subsequently share someone’s personal information for the same purpose

Question 3: Which of the following statements on the Data Protection Act 1998 is correct? Tick one option from the answers listed below.

The Act only applies to patient or service user information

The Act only applies to personal information in digital form

The Act prevents information being shared for health and care purposes

Organisations can be fined or face legal action for breaching the principles of the Act

Question 4: Which of the following statements on the Freedom of Information Act is correct? Tick one option from the answers listed below.

The Act puts a duty on organisations to supply information to individuals who make a written request

Individuals can submit a request for information in writing or over the telephone

Organisations must respond to a valid request within 10 working days

If necessary, organisations have a duty to create new information in order to meet a FOI request

Question 5: Which of the following represents an example of good practice in record keeping? Tick one option from the answers listed below.

Storing commonly used records in your drawer

Including each person’s NHS number

Creating duplicate records for each person

Preventing people from checking their own details

Updating records at the end of each month

Question 6: Which of the following represents an example of good practice in physical security? Tick one option from the answers listed below.

Having a sign-in procedure for visitors

Sharing your ID badge with a colleague who has forgotten his

Propping open fire doors when the weather is warm

Leaving service user records on your desk in case you need them later

Question 7: Which of the following should not be used to send personal information unless absolutely necessary? Tick one option from the answers listed below.

Post

Fax

Telephone

Question 8: Which of the following is likely to increase the risk of a breach when sending personal information? Tick one option from the answers listed below.

Using a trusted postal courier service

Verifying the identity of telephone callers

Using a secure email system

Leaving messages for telephone callers

Encrypting any personal information

Question 9: Which of the following statements best describes how to respond to an incident? Tick one option from the answers listed below.

All incidents should be reported

An incident should be reported only if it results in personal information being revealed

An incident should be reported only if it results in personal information being lost

An incident should be reported only if it results in harm to a service user

There is no need to report an incident

Question 10: Which of the following is least likely to create a security risk? Tick one option from the answers listed below.

Leaving sensitive documents on your desk

Using a company USB at work

Using an unauthorised mobile phone for work matters

Leaving a restricted access door open

Question 11: Which of the following is characteristic of a secure password? Tick one option from the answers listed below.

No more than 5 characters in length

Contains your username

Contains a mix of character types

Similar to previous passwords

Question 12: Under which of the following circumstances is it acceptable to use your work-provided digital asset for personal browsing? Tick one option from the answers listed below.

To connect to your personal webmail

If you don’t stay online too long

When you are working outside the office or home

Only if you have been authorised to do so by your organisation

Question 13: Which of the following is the best course of action if you receive a phishing email? Tick one option from the answers listed below.

Reply to the email

Forward the email to your colleagues

Notify your IT department/provider

Open the attachments

Click on the links in the email

Question 14: Consider the following statement. “If your computer is running slowly you should disable the anti-virus software.” Tick one option from the answers listed below.

This statement is true

This statement is false

Question 15: Which of the following represents an example of good practice in data security? Tick one option from the answers listed below.

Attaching unauthorised equipment to your work-provided digital asset

Updating the anti-virus software on your work-provided digital asset

Using your work-provided digital asset for personal reasons not consistent with your organisation’s policy

Downloading software or data from the Internet to your work-provided digital asset

Connecting your work-provided digital asset to an unknown network

Name

First Optional Last Optional