Website of the Department of Health

Information Security Management: NHS Code of Practice

The Information Security Management: NHS Code of Practice is a guide to the methods and required standards of practice in the management of information security for those who work within or under contract to, or in business partnership with NHS organisations in England. It is based on current legal requirements, relevant standards and professional best practice.

This Code of Practice replaces:
HSG 1996/15 – NHS Information Management and Technology Security Manual
The Code provides a key component of information governance arrangements for the NHS. It is part of an evolving information security management framework because risk factors, standards and practice covered by the Code will change over time.
The guidelines contained within the Code of Practice apply to NHS information assets of all types.

• Download Information Security Management: NHS Code of Practice (PDF, 340K)