Cyber security in NHS trusts

Source: NHE Jul/Aug 16

Dan Taylor, head of cyber security at the Health and Social Care Information Centre (HSCIC), soon to be NHS Digital, discusses the importance of cyber security and the development of CareCERT.

Many of you may be thinking that this piece isn’t for you, because you aren’t an IT professional. You would be wrong, and this perception is the single biggest threat to keeping health information safe and secure. Good cyber security is the responsibility for every member of staff in an organisation, and good ‘cyber hygiene’ is as important and can be as simple as good hand hygiene in an NHS organisation. 

The move to electronic records, the digitisation of patient services and the advent of technology-enabled care has saved time and resources for the NHS, and has huge potential to play a key role in delivering excellent patient care in the future. But alongside the benefits of digitisation there are risks, and with risks come responsibilities. These responsibilities aren’t just for your IT or security team, they belong to every member of staff in your organisation. 

Cyber security starts on the frontline 

Effective security has to start with people. Estimates vary, but official figures from HSCIC show that around 1.3 million people work within health, the vast majority of those delivering care. 

Security starts on the frontline, not in the IT department. Does everyone have basic training in cyber security? Do they understand their personal responsibility to keep data safe? This ‘cyber hygiene’ includes simple things such as keeping passwords safe and changing them regularly; never letting anyone other than the named person use a Smartcard; not clicking on unverified links; keeping mobile devices safe and secure; and ensuring that individuals log off or lock screens when they move away from a device. 

So if cyber security is so important to the NHS, what is happening at the centre to support organisations to practice what I am preaching? 

CareCERT support 

CareCERT Broadcast is an HSCIC service that gathers known threats and intelligence and broadcasts them appropriately across health and care organisations, along with advice about how to mitigate those threats. This enables organisations to make informed decisions about protectively fixing vulnerabilities before they become an issue. 

CareCERT Broadcast has been live for many months now [NHE reported on this in the Jan/Feb 2016 issue] and we’ve received useful feedback about other cyber services the sector would like to see us provide. As a result, CareCERT Broadcast will soon have some cyber siblings including CareCERT Assure; a set of CareCERT training modules; and a range of other services to be announced later this year.

CareCERT Assure will allow health and care organisations to take a free assessment of their cyber strengths and weaknesses. We want to use our experience to learn lessons on behalf of the sector, benchmark what good looks like and then share that, whilst also helping individual organisations to pin-point areas for improvement and investment, maximising the limited resources available. 

We are also in beta testing for a national cyber security training platform. This will cover a number of basic areas for all staff and a second, more complex module, will be available for specialist staff. Freely available to all health and care organisations, the training will enable organisations to develop colleagues, whilst ensuring our people form the first line of defence in securing information. 

CareCERT services will enable health and care organisations to benefit from the expertise at HSCIC, but without dictating a one-size-fits-all approach. Ultimately, the security of information is the responsibility of the organisation where it is held. We want to support organisations to safely look after that information, whilst allowing them to make appropriate local decisions about what works for their individual needs.

Tell us what you think – have your say below or email


Rick Gray   19/08/2016 at 08:14

My name is Rick Gray, I'm Head of Cyber Security for CSI Ltd. Charles Lilley (Head of Health Services) for CSI Ltd and myself have recently provided help to multiple NHS Trusts throughout the UK. I read the article this morning and its great to see Dan has created something educational for the NHS to use. We too often find deploying security tools which is necessary as prevention is not enough. Education is the key and one of the hardest areas in cyber security prevention, great to see Dan's created a collaboration of information to share.

Add your comment


national health executive tv

more videos >

latest healthcare news

GMC unveils new standards for more ‘flexible’ postgraduate education

22/05/2017GMC unveils new standards for more ‘flexible’ postgraduate education

Postgraduate training has been made more flexible for doctors today as the General Medical Council (GMC) announced new standards. Unveiled i... more >
NHS risks losing over 2,000 family doctors due to Brexit, warns RCGP

22/05/2017NHS risks losing over 2,000 family doctors due to Brexit, warns RCGP

Around 3.5 million patients are set to lose their family doctor because of Brexit, a leading group of GPs has today warned. In new analysis ... more >
Nuffield Trust: Party pledges fail to fully address NHS funding crisis

22/05/2017Nuffield Trust: Party pledges fail to fully address NHS funding crisis

None of the three main political parties currently vying for control of government have pledged enough funding for the NHS, a group of leading he... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

End of life care planning: why it should be everyone’s concern

10/05/2017End of life care planning: why it should be everyone’s concern

To mark Dying Matters Awareness Week (May 8-14), Michelle Brown, deputy head of department for healthcare practice at the University of Derby’s College of Health and Social Care, explains why everyone – young or old – should make sure they know what end of life care planning involves.  What is end of life care planning?  There is little doubt that end of life care is important to everyone. People generally r... more >
read more blog posts from 'the scalpel' >


Tight timetable for nursing associate  regulation

28/03/2017Tight timetable for nursing associate regulation

Jackie Smith, chief executive at the Nursing and Midwifery Council (NMC), talks to NHE’s David Stevenson about the challenges her organisat... more >
Improving the flow

13/02/2017Improving the flow

Glen Burley, chief executive of South Warwickshire NHS FT, explains how his organisation has been able to improve patient flow through its emerge... more >
Leadership development should be for all in health and care

07/12/2016Leadership development should be for all in health and care

Back in August, Stephen Hart joined Health Education England (HEE) as the organisation’s new director of leadership development, which incl... more >
The powerful link between staff and patient satisfaction

03/10/2016The powerful link between staff and patient satisfaction

David Behan CBE, chief executive of the Care Quality Commission (CQC), talks to NHE about the correlation between high rates of staff satisfactio... more >

last word

Foreign patient charges are a distraction from the real issues

Foreign patient charges are a distraction from the real issues

Vivek Kotecha, research officer at the Centre for Health and the Public Interest (CHPI), explains why the charging of foreign patients distracts from our home-grown NHS issues.  The Dep... more > more last word articles >

editor's comment

22/03/2017New additions and unexpected announcements

As NHE went to press, many of us were still recovering from the chancellor’s unexpected health announcements in his last Spring Budget.   While the sector welcomed Philip Hammond’s revelations, centered on capital funding for advanced sustainability and transformation plans (STPs) and A&E triage schemes (page 24)... read more >

health service focus

60 seconds with… NHSI’s Ben Dyson

07/04/201760 seconds with… NHSI’s Ben Dyson

We talk to Ben Dyson, executive director of s... more >
Paperlight is the outcome, and not the objective, of a digital NHS

04/04/2017Paperlight is the outcome, and not the objective, of a digital NHS

Sean Brennan, director of communications for ... more >