The policy covers security which can be applied through technology but perhaps more crucially, it encompasses the behaviour of the people who manage information in the line of NHS England business.