F4: Security and confidentiality in practice

Security is a legal duty, not only an IT one. Under the UK GDPR personal data must be kept with appropriate security, and anyone handling it for a controller may process it only on the controller's instructions. That puts tools and accounts outside those instructions, including public chatbots, off limits for patient data.

It teaches how data is lost and stolen in everyday practice, the rules that prevent it, and what security training achieves and what it does not. It shows how to recognise threats, including phishing made more convincing by AI. It explains why a suspected breach is reported at once, given the controller's duty to notify the regulator without undue delay and, where feasible, within 72 hours. It explains when encryption protects data, applies security rules to AI tools, including where the law is silent, and shows how to tell patients what happens to their data. A section covers Qatar. It maps to the HEE AI and Digital Healthcare Technologies Capability Framework (2023). Veritant is education, not legal advice.

You receive the Master Teaching Document and slide deck as PDFs, and a narrated video. Reading Veritant (U0), the guide to how the units are built, is included free. An assessed certificate is coming: a 20-question online assessment with a pass mark of 80 per cent. Everyone who has bought the unit will be able to take it free.