Terms and Conditions for HPAC Administrators

1.About these terms

1.1These terms apply to everyone we give access to HPAC's administration systems, whether you are an employee, a contractor, a person supplied by another organisation or a volunteer. Health Practice Associates Council (HPAC) is a community interest company registered in England and Wales, company number 10830551.

1.2You agree to these terms when you accept your invitation. They apply whenever you use HPAC systems or handle HPAC information, wherever you are working. They also apply to your conduct outside your role where it could affect your role or public confidence in HPAC.

1.3These terms apply alongside any employment contract, contract for services or volunteer agreement that covers your work for us. They do not, on their own, create a contract of employment, make you an employee or change the status that your contract or agreement gives you. Where your contract or agreement sets a stricter standard for handling information, you must meet that standard as well.

1.4If you are also a Council member, the Terms and Conditions for Council Members apply to you as well. If you are an HPAC registrant, the Terms and Conditions and the Code of Conduct that apply to registrants continue to apply to you.

2.Words used in these terms

Confidential information

The information described in 4.1.

HPAC systems

Every system, account and device we provide or approve for your role, including the administration and case management systems, the registrant and organisation portals, HPAC e-mail, file storage and any HPAC-issued device.

Personal data

Any information about an identifiable living person, as defined in the UK General Data Protection Regulation (UK GDPR).

Registrant

A person on HPAC's register or applying to join it.

We, us and our

HPAC.

Working day

Monday to Friday, excluding bank holidays in England. A timescale in working days begins on the working day after the event that triggers it.

Your manager

The person we name in your invitation as responsible for your HPAC work, or anyone we later tell you has taken that role.

3.Your role and your access

3.1Your invitation sets out your role. We give you access only to the systems and information you need for that role, and we may change or remove that access at any time.

3.2Open a record only when you need it for a task within your role. You must not look up any registrant, applicant, referrer, organisation or colleague out of curiosity, for a personal reason or on someone else's behalf outside your role.

3.3You must not try to access any system, record or function that we have not authorised you to access, even if the system allows it. If you find you can see something your role does not need, tell your manager.

3.4The system may log each time you sign in, open a record or change one. We review these logs and may ask you to explain any access.

3.5Knowingly or recklessly obtaining or disclosing personal data without our consent can be a criminal offence under the Data Protection Act 2018. Unauthorised access to computer systems can be an offence under the Computer Misuse Act 1990.

3.6Complete the data protection, information security and safeguarding training we provide before you access personal data about registrants. Complete any refresher training we require.

3.7If you need a reasonable adjustment to use our systems or carry out your role, tell your manager. We will agree with you what we can provide.

4.Confidentiality and non-disclosure

4.1Confidential information is any information you receive, see or create through your work for us that is not already public. It does not matter whether it is spoken, written or electronic, or whether it is marked as confidential. It includes:

• personal data about registrants, applicants, referrers, witnesses, employers' staff, our staff, volunteers and Council members;
• identity documents, qualifications, health information, DBS certificate information and any information about criminal records;
• concerns, fitness to practise and safeguarding matters, and the discussions and decisions of any panel;
• information that organisations give us through the organisation portal or in correspondence;
• our unpublished papers, decisions, finances, contracts and plans; and
• details of how our systems work and are protected, including passwords, access codes and security settings.

4.2Information is not public simply because part of it is. The fact that a person appears on the public register is public; any information we hold about them that is not public remains confidential.

4.3You must keep confidential information confidential. You may use it only for your role, and share it only with people inside HPAC who need it for their own role, or with people outside HPAC where your role requires it and we have authorised it.

4.4Do not discuss registrants or cases where you can be overheard, and do not tell family, friends, your employer or colleagues outside HPAC about any registrant, case or concern.

4.5If anyone outside HPAC asks you for confidential information, including the police, an employer, another regulator, a journalist or a registrant asking about someone else, give it only if your role covers the request and we have authorised the disclosure. Otherwise, pass the request to your manager.

4.6Your duty of confidentiality applies during your role and continues after it ends, without time limit.

4.7All information and records you create in your role belong to HPAC.

5.Disclosures you may always make

5.1Nothing in these terms, or in any other agreement with us, stops you from:

• making a protected disclosure under the Public Interest Disclosure Act 1998, including to a body on the government's list of prescribed persons, such as the Information Commissioner's Office or the Care Quality Commission;
• reporting a crime to the police or another law enforcement body, or helping the police or a court with an investigation or proceedings;
• reporting a concern to a regulator or other public body, or co-operating with one;
• reporting a safeguarding concern to the police or a local authority;
• reporting harassment or discrimination, or our response to it;
• discussing your pay for equal pay purposes;
• giving information where a law, court or tribunal requires it; or
• getting confidential advice or support from a lawyer, doctor, counsellor, trade union representative, Acas or a victim support service.

5.2You do not have to use the internal reporting routes in section 15 before making a disclosure described in 5.1. We will not treat you less favourably because you have raised a concern or made a disclosure described in 5.1.

6.Data protection

6.1HPAC is the data controller for the personal data you handle in your role. You must handle it in line with our data protection policy, the UK GDPR and the Data Protection Act 2018.

6.2Use personal data only for the task in hand. Record it accurately, and keep it only in the places we direct.

6.3Take particular care with special category data, such as health information, and with information about criminal offences, convictions, cautions and DBS checks. Use this information only for the matter you are handling, share it only as your role and our instructions allow, and follow the Disclosure and Barring Service's code of practice for DBS certificate information.

6.4Tell your manager at once if personal data or other confidential information is lost, sent to the wrong person, seen by someone who should not see it, or changed or deleted without authority, or if you think this may have happened. If your manager is not available, tell the Chief Executive Officer.

6.5Report a breach even if it seems minor, and even if it was your own mistake. We must report some breaches to the Information Commissioner's Office within 72 hours of becoming aware of them. Take any steps we ask you to take to limit the harm, such as asking an unintended recipient to delete a message.

6.6If anyone asks to see, correct or delete the information we hold about them, or objects to how we use it, pass the request to your manager as soon as you receive it.

6.7Before you discuss a registrant's or organisation's account with anyone who contacts you, confirm their identity using the checks we require.

7.Accounts and security

7.1Your account is for you alone. You are responsible for everything done under it.

7.2You must not share your password, sign-in codes or account with anyone, including colleagues and anyone offering technical support. You must not use anyone else's account.

7.3Use a strong password that you do not use anywhere else, and store it only in your memory or a secure password manager. Use multi-factor authentication wherever we provide it.

7.4If you think someone else knows your password or has used your account, change your password at once and tell your manager.

7.5Lock your screen whenever you step away, and sign out at the end of each session. Position your screen so that others cannot read it.

7.6Use HPAC systems only on devices we have provided or approved for your role. Protect any approved device with a passcode, keep its security updates current, and do not let anyone else use it while you are signed in.

7.7You must not download, copy, print, photograph or forward confidential information to a personal e-mail account, personal cloud storage, a personal device or removable media unless we have approved this in writing. Where we approve it, keep the information secure and delete it as soon as the task is complete.

7.8You must not enter confidential information into any artificial intelligence tool, translation service or other online service that we have not approved.

7.9Tell your manager at once if a device you use for HPAC work is lost or stolen, or if you think it has been infected by malicious software.

8.Using HPAC e-mail and systems

8.1Where we give you an HPAC e-mail address, use it for all your HPAC work, and do not use a personal e-mail account for HPAC business.

8.2Use the HPAC e-mail signature we provide on every message you send from your HPAC account.

8.3Use HPAC systems only for HPAC work. You must not use them to:

• run a personal business or carry out other private work;
• send, share or store material that is indecent, obscene, discriminatory, offensive, abusive or illegal, or that harasses anyone;
• send unsolicited personal views on social, political, religious or other matters unrelated to HPAC's work;
• send unsolicited commercial or advertising material;
• use material in a way that breaches copyright; or
• disable, bypass or test any security control.

8.4Take care with unexpected links and attachments. If a message asks you to disclose a password, do not provide it. If it asks for personal data or a payment, check that it is genuine through a contact route you already know before you act on it. Tell us about any message you suspect is not genuine.

8.5Before you send personal data, check the recipient and attachments, and send it only by the secure method we direct.

8.6HPAC's Acceptable Email Use Policy applies to you in full.

9.Monitoring

9.1HPAC systems and the information in them belong to HPAC. We monitor their use, as far as the law allows, to:

• keep our systems and information secure;
• check that access to records is needed for the user's role;
• investigate a suspected breach of these terms, a data breach or a crime;
• find information we need for our work when a user is absent; and
• meet our legal duties, including answering requests from people to see their information.

9.2Monitoring covers sign-ins, the records you open and change, files you download, and the messages in your HPAC e-mail account. Your use of HPAC systems is subject to this monitoring.

9.3We use information obtained through monitoring only for the purposes in 9.1, unless it reveals conduct that we could not reasonably ignore.

10.Conflicts of interest

10.1A conflict of interest arises where a fair-minded and informed observer could conclude that an interest, relationship or loyalty might influence how you carry out your role.

10.2Before you start, declare to your manager any interest that could give rise to a conflict, including:

• your paid or voluntary work, and any directorship, consultancy or self-employment;
• any role with an organisation that employs or deploys registrants, provides ambulance, event medical or community first response services, or has portal access to the register;
• employing, managing, recruiting, training or working closely with any registrant;
• your own registration with HPAC or with any statutory regulator or other register; and
• a partner or close family member who is a registrant or works for an organisation described above.

10.3Tell your manager about any new interest that could give rise to a conflict, or any change to your declared interests, within 10 working days of it arising.

10.4You must not open, change or make any decision on a record or case about yourself, a family member or friend, someone you manage or work closely with, or an organisation you work for outside HPAC. Tell your manager and pass the work to a colleague.

10.5If you are a registrant, deal with your own registration only through the registrant portal, as any registrant does. You must not use your administrator access to view or change your own record.

10.6If you employ, manage or recruit registrants, you must not use anything you learn in your HPAC role in recruitment, deployment or employment decisions, or tell an employer or colleague about a concern or case.

10.7Your role gives you no advantage in your own registration, your employer's portal access or any other dealings with us.

11.Conduct and equality

11.1Act honestly and with integrity, and in line with HPAC's purpose: to protect patients, the public, clinicians, employers and the wider profession from demonstrable risks.

11.2Treat registrants, referrers, organisations and colleagues with courtesy, dignity and respect. You must not discriminate against, harass or victimise anyone in breach of the Equality Act 2010.

11.3Keep accurate records of what you do and why. You must not alter, delete or back-date a record except as your role and our procedures allow.

11.4Be open and honest when something goes wrong, including your own mistakes, and tell your manager promptly.

11.5You must not use your role for personal gain, or act in a way that could bring HPAC into disrepute or undermine public confidence in its work.

12.Safeguarding

12.1Safeguarding children and adults at risk is part of every administrator's role.

12.2If anything you see or hear in your role suggests that a child or adult may be at risk of harm, tell the Designated Safeguarding Lead as soon as reasonably practicable and ahead of other work. If anyone is in immediate danger, call 999 first.

12.3Record what you were told or saw, using the person's own words where possible, with the date and time. Do not investigate the matter yourself or contact the people involved unless the Designated Safeguarding Lead asks you to.

13.Acting in a registrant's account

13.1Some roles allow you to access a registrant's account through your own administrator account, or view it as the registrant sees it. Use this access only where your role permits it, for a task we have assigned or to help that registrant with something they have asked for, and only for as long as the task requires.

13.2While you are in a registrant's account, you must not make a declaration, give consent, accept terms, send a message or make a payment in the registrant's name.

13.3We may log each visit to a registrant's account under your own name.

14.Social media and speaking for HPAC

14.1These terms apply online as they do in person. Anything you post can be copied, shared and kept after you delete it.

14.2You must not post or comment about any registrant, case, concern or panel that has not been made public. You must not identify anyone involved in a case, or give details from which they could be identified.

14.3You may name your HPAC role on your own profiles and share material we have published.

14.4You may speak or write on our behalf only when we have authorised you to do so. Pass any request from the media to the Chief Executive Officer.

14.5When you speak or write about our area of work in any other capacity, make clear that the views are your own or those of another organisation.

15.Raising concerns

15.1Report any suspected wrongdoing, fraud, misuse of data or risk to the public that you learn of through your HPAC work to your manager or the Chief Executive Officer. If it concerns either of them, report it to the Chair of the Council or the Board of Directors.

15.2Raise any concern about a colleague privately with your manager or, if it concerns your manager, with the Chief Executive Officer.

15.3This section does not limit the disclosures in section 5.

16.Concerns about your conduct and removal of access

16.1We may suspend or restrict your access to HPAC systems at any time to protect people or information, including while a concern about you is investigated. A suspension of access is not a finding against you.

16.2If you are an employee or a contractor, we deal with a concern about your conduct under your employment contract or contract for services, and the procedures it refers to.

16.3If you are a volunteer, your manager normally resolves minor matters informally. Where a concern is serious or repeated, your manager will set it out in writing and give you 10 working days to respond. You may bring a person of your choice to any meeting about the concern. Your manager will then decide the outcome and give you the decision and reasons in writing.

16.4A breach of these terms may lead to advice, a warning, a change to your role, removal of your access or the end of your role with us.

16.5Where a breach involves personal data, we may have to report it to the Information Commissioner's Office. Where it may involve a crime, we may report it to the police. We may also apply to a court to stop or prevent a disclosure of confidential information.

16.6If you are an HPAC registrant, we may also consider the matter under the terms that apply to registrants.

17.When you leave

17.1Your access to HPAC systems ends on the day your role ends, or earlier if we decide.

17.2Within 10 working days of your role ending, or of our asking, return any of our devices, papers and other property, and permanently delete any of our information held outside HPAC systems, except anything a law requires you to keep (see 17.3). Confirm in writing that you have done so.

17.3If a law requires you to keep any of our information, tell us what you are keeping and why, and keep it confidential. If you find any of our information after completing the steps in 17.2, tell us and delete it unless a law requires you to keep it.

17.4After you leave, you may describe your former HPAC role and the dates you held it, but you must not present it as a current role.

18.Your personal information

18.1We hold your contact details, declarations, training records and the logs of your use of HPAC systems to manage your role, in line with our Privacy Policy.

18.2HPAC's external Data Protection Officer is Satswana Limited.

19.Review of these terms

19.1We review these terms at least every two years. We will tell you in writing about any change and ask you to confirm that you accept it.