Health and social care - data strategy: 2025 update - progress and priorities

Protecting and Sharing Information

We want a trusted, secure health & care ecosystem where data is shared, managed, and stored securely, consistently, efficiently, and transparently.

Progress so far:

• Records management code of practice published – The Scottish Government published the Health and social care - records management: code of practice - gov.scot on 16 August 2024 to set out the required standards of practice for managing data, information and records for NHS Scotland organisations.
• Information Governance (IG) Maturity Pilots – IG maturity pilots have been undertaken to determine the key areas of focus for the Information Governance programme going forward. Business cases have been developed for specific use cases in collaboration with Local Government colleagues to demonstrate the impact and benefits of the IG programme. Furthermore, we are working with health and social care organisations in response to Digital Maturity findings to advise on the available tools and frameworks that can be used to continuously improve areas where IG challenges have been identified.
• Cyber Security Roadmap – A draft Cyber Security Strategy has been developed which will inform an implementation plan to support delivery of key services on a national scale. Digital Leads are engaged and are working to promote the NHS Scotland Cyber Centre of Excellence which is resulting in a cultural shift across organisations and driving uptake of NHS Boards onboarding tooling which enables them to see the national picture.
• Streamlining Information Governance – Scottish Government and COSLA continue to work collaboratively with NHS and SOLAR to identify opportunities for streamlining the Information Governance landscape and are currently exploring the development of common Information Sharing Agreements for Local Government. This is key to improving information sharing across health and social care which is critical to achieving the ambitions set out in within the Operational Improvement Plan and Service Renewal Framework.
• Information Governance Competency Framework – In 2023, we developed the first phase of the IG competency framework which sets out the roles and responsibilities required from those involved in governance, assurance and management of data and digital. Our intention was to make this available online and further progress this work throughout 2024. However, as a result of competing priorities and lack of resource, this work was deprioritised, and we were unable to progress as planned.
• Information Governance Code of Practice Framework – RDS have set out a proposal for mapping out the details and guidance to contribute to the Code of Practice framework to streamline approvals pathways for access to data for research purposes.

Priorities for 2025:

• Expanding the Use of Records Management Code of Practice – Scottish Government are working with Local Government to consider how a similar approach could apply in social work and social care organisations and are working on a digital platform to make the code more accessible and practical.
• Tools and Resources – We continue to progress work to develop and refresh resources such as the Information Governance Toolkit. The scope is being widened to include more tools and guidance for governance, assurance and management resources. We are also conducting a refresh of our website to ensure accurate information is easily available to support people to comply with guidance.
• Cyber Security – A roadmap and implementation plan has been developed to set out the plans for the Cyber Centre of Excellence and is now available to Health Boards to support understanding of the tooling that is available and timescales for implementation.
• IG Code of Practice Framework – An IG Code of Practice framework will be developed to set out the Information Governance principles which should be adhered to. This will provide a consistent framework that streamlines assurance processes and helps the sector comply with requirements such as UK GDPR. This framework will include specific guidance for researcher access to health and care data to streamline and improve the approvals process for researcher access to data.