DCW116-Online Safety Policy

Registration Number: {{org_field_registration_no}}

Online Safety Policy

1. Purpose

The purpose of this policy is to ensure that all service users, staff, and stakeholders are protected from online risks, including cyber threats, data breaches, inappropriate content, and digital fraud. The increased use of technology in domiciliary care means that service user records, staff communications, and online interactions must be handled with the utmost care and security. This policy establishes a framework for managing these risks while ensuring compliance with the Regulation and Inspection of Social Care (Wales) Act 2016, the General Data Protection Regulation (GDPR), and relevant safeguarding policies.

Our organisation is committed to the responsible and secure use of digital technology to enhance the quality of care provided. This includes ensuring that service users can safely access online services, that staff follow best practices when using digital platforms, and that all personal data is protected against cyber threats. This policy sets out clear expectations for all stakeholders on how to use technology securely and responsibly within the home care environment.

2. Scope

This policy applies to all employees, volunteers, and contractors who use digital systems as part of their roles in providing domiciliary care services. It also extends to service users and their families who interact with our online platforms and digital records, as well as third-party providers who have access to our digital infrastructure.

The policy covers a wide range of digital activities, including:

The use of electronic care records and data management systems to store and process sensitive service user information.
Email and online communication between staff, service users, healthcare professionals, and external agencies.
Internet and social media usage within the context of care provision and professional communication.
Cybersecurity and data protection measures to prevent breaches and unauthorised access to sensitive information.
Online safeguarding to protect vulnerable individuals from digital exploitation, fraud, or harmful online interactions.

This policy ensures that all parties understand their responsibilities in maintaining online safety and mitigating risks associated with digital interactions in a domiciliary care setting.

3. Online Safety Management

3.1 Digital Access and Acceptable Use

All staff must use organisation-approved devices and software when handling any work-related online activities. Personal devices must not be used to store, share, or access confidential care information. Any access to digital systems is controlled through role-based authorisation, ensuring that only individuals with the necessary permissions can view or modify sensitive data.

To maintain security and accountability, staff must complete mandatory cybersecurity training as part of their induction and attend regular refresher sessions. This training includes guidance on password management, identifying phishing scams, and handling digital data safely. Staff are expected to follow best practices when accessing online services, ensuring that care records remain protected and that all interactions with service users are conducted securely.

3.2 Cybersecurity and Data Protection

All digital records containing sensitive service user information must be stored using encryption and secure access protocols. This ensures that only authorised personnel can view or edit confidential data. All passwords must meet security requirements, including a mix of uppercase and lowercase letters, numbers, and symbols. Passwords should be updated at least every three months to prevent unauthorised access.

Any suspected data breaches must be reported immediately to the Data Protection Officer ({{org_field_data_protection_officer_first_name}} {{org_field_data_protection_officer_last_name}} – {{org_field_data_protection_officer_email}}). Reports should include the nature of the breach, the type of information compromised, and the potential impact on service users. Our organisation conducts regular security audits and penetration testing to identify vulnerabilities in IT systems and implement necessary improvements.

3.3 Online Safeguarding of Service Users

To protect service users from online risks, staff must never share personal information via email or social media unless it is done through encrypted and secure channels. Any suspected cases of online abuse, exploitation, or cyberbullying must be reported to the Safeguarding Lead ({{org_field_safeguarding_lead_name}} – {{org_field_safeguarding_lead_role}}) and documented in the organisation’s safeguarding records.

Service users who require assistance with digital technology should be provided with guidance on recognising fraudulent emails, unsafe websites, and digital scams. Where necessary, service users can receive training on secure online behaviour to ensure they can use the internet safely. Any third-party access to service user data, such as family members or healthcare professionals, must be formally authorised and recorded to prevent unauthorised information sharing.

3.4 Social Media and Public Communications

Staff must not discuss service users, care plans, or any confidential matters on social media, even in private groups. Any reference to the organisation, staff members, or service users online must be professional and comply with confidentiality regulations.

Only designated staff members are permitted to manage the organisation’s official social media accounts, ensuring that all public communications reflect the organisation’s professional standards. Photos or videos of service users must not be shared online unless explicit written consent has been obtained and documented in the service user’s file. Any misuse of social media that compromises privacy or professionalism may result in disciplinary action.

4. Incident Reporting and Response

4.1 Reporting Online Safety Concerns

All online safety concerns, including cybersecurity threats, data breaches, or inappropriate online content, must be reported immediately. Concerns related to:

Data security breaches should be reported to the Data Protection Officer.
Safeguarding risks should be reported to the Safeguarding Lead.
General online safety issues should be escalated to the Registered Manager ({{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}).

A Cybersecurity and Online Safety Incident Log will be maintained to record reported incidents, actions taken, and any lessons learned from the investigation process.

4.2 Investigation and Corrective Action

Each reported incident will be investigated within 48 hours to determine the risk level and implement appropriate corrective actions. If a data breach occurs, it will be reported to the Information Commissioner’s Office (ICO) within 72 hours, as required under GDPR.

In cases of suspected online abuse or exploitation, a safeguarding referral will be made to {{org_field_local_authority_authority_name}}, and necessary protective measures will be taken. If disciplinary action is required, staff members will be subject to the Disciplinary and Grievance Policy (DCW31).

5. Staff Training and Compliance

All staff members must complete mandatory online safety training as part of their induction. Annual refresher training will ensure that employees remain aware of the latest cybersecurity threats and online safety practices. Compliance with this policy will be monitored through regular audits and spot checks by senior management.

Any breach of this policy will be investigated, and appropriate disciplinary action may be taken. This may include additional training, formal warnings, or termination of employment, depending on the severity of the violation.

6. Related Policies

This policy should be read in conjunction with the following:

Confidentiality and Data Protection (GDPR) Policy (DCW34)
Safeguarding Adults from Abuse and Improper Treatment Policy (DCW13)
Whistleblowing (Speaking Up) Policy (DCW29)
Risk Management and Assessment Policy (DCW18)
Staff Conduct and Code of Ethics Policy (DCW28)

7. Policy Review

This policy will be reviewed annually or sooner if there are changes in legislation, regulatory requirements, or significant online safety incidents.

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.