Classification	Public
Location	https://www.medcrowd.com/compliance/iso27001/policies/InformationClassification
Author	Paul Gardner
Approver	Felix Jackson
Approved	14th December 2016

Introduction

This policy is part of the medDigital ISMS and must be fully complied with.

medDigital is committed to the secure management of its information and the identification of assets that require protection.

The purpose of this policy is to establish the key principles of classifying information and the controls applied to each classification.

Scope

This policy applies to all information assets produced by medDigital that is stored or shared by any means.

Information Classification

All information will be classified into one of four categories.

Note that medCrowd conversations are created by third parties and cannot be labelled. Therefore, all medCrowd conversations should be considered CONTROLLED. If the conversation identifies a patient, it is PERSCONF. All information within the SETA application is also PERSCONF. Any material not classified is considered CONTROLLED.

Where information is grouped together, the highest classification shall be applied to all information in the group.

Classification	Description	Restrictions	Examples
PERSCONF	Information containing confidential personal identifying information	It is unusual for employees/contractors to be exposed to PERSCONF information. If you are exposed to this information, you may not use or disclose the information in any way.	A medCrowd conversation where a patient is identified and discussed The patient record within the SETA application
RESTRICTED	Information whose unauthorised disclosure would cause serious damage, legal action or loss of reputation	Access is restricted to senior management	Strategic planning Disciplinary records
CONTROLLED	Information which contains business value or which requires protection due to (non-confidential) personal identifying information	Access is restricted to: Employees and contractors and only in connection with their employment Clients and suppliers and only when the asset is specifically related to that client/supplier	Product roadmaps Product metrics medCrowd conversations where a patient is not identified Payroll data Sensitive IT procedures
PUBLIC	Information that can be made available to the public domain and which would not cause damage	None	Press releases Policies General recruitment information

All information must be classified PUBLIC, CONTROLLED, RESTRICTED or PERSCONF. Note that the classification of information does not override our duties under the Data Protection Act.

Information Handling

PERSCONF information must only be processed within the medCrowd application and must never be processed in any other way - this includes taking screenshots or printing the information.

It would be unusual for any employee/contractor to come into contact with PERSCONF information. If an employee/contractor is exposed to PERSCONF information, it must not be used or shared in any way. To do so would be unlawful.

CONTROLLED, RESTRICTED & PERSCONF information, when being handled by employees must only be processed on medDigital owned equipment.

A confidentiality or non-disclosure agreement must be in place when exchanging CONTROLLED or RESTRICTED information between medDigital and a third party.

Information Transfer

Method	PUBLIC	CONTROLLED	RESTRICTED	PERSCONF
Post	YES	NO	NO	NO
External email	YES	YES2	NO	NO
External email to approved partners See M:\Operations\Approved Partners	YES	YES	NO	NO
Microsoft Teams3	YES	YES	YES	NO
Internal email	YES	YES	YES	NO
Portable media	YES	YES1	YES1	NO
M: Drive	YES	YES	YES	NO
medDigital Secure File Transfer	YES	YES	YES	NO
medCrowd	YES	YES	YES	YES

¹ media must be encrypted as per the Cryptography policy.
² excluding personal identifying information
³ excluding files