Download Attachment 2

Gloucestershire Hospitals
NHS Foundation Trust
Staff:
o
Ensuring all staff use systems and equipment securely and have training made
available for them to do so.
o
To enable all staff within their department/site comply with the Trusts Information
Governance, IT Security policy and procedures.
o
Upon staff termination of employment, departmental property is returned including
identity badges, Smartcards and any user rights are removed from IT Service systems.
2.2.2 System Managers
Each centrally resourced software application: (for example; PAS, SMARTSTREAM,
SUNRISE CLINICAL MANAGER, CHILD HEALTH, etc.) to be controlled by a named
System Manager who shall be registered with the IT Service.
Where System Managers are IT Service staff, they are responsible for the running of the
system and for the integrity of the data, i.e. data ownership.
Where System Managers are non IT Services staff, a Data Owner shall be identified and
registered.
Responsibilities of System Managers:
o
Control of access to the system, i.e. setting up user accounts and allocating access
levels and passwords.
o
Removing accounts when staff terminate their employment.
o
Ensuring the delivery of appropriate user training in both the use of the application
and the security aspects of the application.
o
Agreeing fixes and upgrades to the system.
o
Liaison as appropriate with the IT Service.
o
Ensuring system procedures are documented.
o
Evaluating operational procedures to identify potential security risk(s).
o
Recording and acting upon security violations of the system.
o
Ensuring that output from the system is distributed securely.
(Functions with high security risk should be performed by 2 persons to avoid fraud or
misappropriation.)
IT Security Policy (version 2.0b)
Sponsor: S. Pratt
Author: A Jones
Issue Date May 2004
Reviewed November 2006
Page 7 of 45