Continuous Improvement

PURPOSE

The aim of this document is to outline the approach in evaluating Health Informatics Centre (HIC) processes to continuously improve the efficiency and effectiveness of HIC procedures and policies which are governed by the Information Security Management System (ISMS).

SCOPE

The scope is an improvement framework to help implement material progress across HIC.

RESPONSIBILTIES

PRINCIPLES

1.  Incremental Change: Not a paradigm shift or invention, but measured, incremental progress is the most innovative. It helps apply change more easily, as well as giving the reigns to the organisation rather than having to respond to external forces.  

2. Employees Provide Ideas: Rather than management alone, the ideas for change should come from all HIC staff, who are often closest to areas for improvement within the organisation and issues or obstacles that might be experienced directly and have the knowledge to resolve them.  

3. Incremental Change Is Cheap: Small changes are likely to not be as costly (financial, reputational, operational, technical) and will not impact the operational budget as severely. The emphasis is on eliminating and simplifying, not adding to process, which is less expensive.  

4. Staff Take Ownership and Accountability: By giving HIC employees ownership of the process, they’re more invested and motivated.  

5. Improvement Is Reflective: The strategy of continuous improvement only works if there’s dialogue, feedback, and open communications between HIC staff.  

6. Improvements Can Be Measured and Repeated: Once a change is made, it is not left alone but reviewed, monitored, and measured, so determinations can made as to its effectiveness. Therefore, if that change does work, it can be repeated or applied to other aspects of the organisation.  

PROCEDURE

1. Identification of Improvement Opportunities

   • Governance Co-Ordinator initiates continuous assessment review from one of the improvement opportunity triggers; annual review, internal audit feedback, external audit feedback, incidents (such as significant events, business continuity scenarios and disaster recovery incidents both real and simulated), client complaints or employees.

2. Prioritisation of Improvement Initiatives

   • Process Manager and Governance Co-Ordinator assess improvement opportunities based on their impact on information security against current controls and business objectives.

   • Process Manager and Governance Co-Ordinator assess if improvement opportunities may be of a material or strategic nature. If potentially yes, then a wider review group is required.

   • Process Manager identifies subject matter experts from HIC staff to create a review group.

   • Review Group analyses current process for immediate improvements already identified and/or identifies further areas for improvement.

   • Governance Co-Ordinator supports, coordinates, and drives the review which is to be completed in a timescale of two months.

3. Implementation of Improvements

   • Process Manager and Governance Co-Ordinator prioritise improvement opportunities.

   • Governance Co-Ordinator and Process Manager implement immediate changes.

   • Governance Co-Ordinator captures future opportunities for improvements identified in Project Management System.

4. Approval of Improvements

   • Governance Co-Ordinator routes the changes for approval to the HIC Leadership Team and Executive Committee. HIC Leadership Team will determine if the changes are material or strategic and require HIC Executive Committee approval. Review Group reviews any suggested changes made by the HIC Leadership Team and Executive Committee. Governance Co-Ordinator adjusts and changes, as necessary. 

5. Communication of Improvements

   • Once approved, Governance Co-Ordinator updates all relevant documentation, communicates to all stakeholders, and co-ordinates training where applicable. 

6. Monitoring and Evaluation

   • Governance Go-Ordinator in collaboration with Information Security & Governance Manager measures results of improvements made (via audits and significant events) and repeats improvements where applicable. 

APPLICABLE REFERENCES

• How To Manage Controlled Documentation

• For Definitions see ISMS Glossary

DOCUMENT CONTROLS