Cyber security in NHS trusts

Source: NHE Jul/Aug 16

Dan Taylor, head of cyber security at the Health and Social Care Information Centre (HSCIC), soon to be NHS Digital, discusses the importance of cyber security and the development of CareCERT.

Many of you may be thinking that this piece isn’t for you, because you aren’t an IT professional. You would be wrong, and this perception is the single biggest threat to keeping health information safe and secure. Good cyber security is the responsibility for every member of staff in an organisation, and good ‘cyber hygiene’ is as important and can be as simple as good hand hygiene in an NHS organisation. 

The move to electronic records, the digitisation of patient services and the advent of technology-enabled care has saved time and resources for the NHS, and has huge potential to play a key role in delivering excellent patient care in the future. But alongside the benefits of digitisation there are risks, and with risks come responsibilities. These responsibilities aren’t just for your IT or security team, they belong to every member of staff in your organisation. 

Cyber security starts on the frontline 

Effective security has to start with people. Estimates vary, but official figures from HSCIC show that around 1.3 million people work within health, the vast majority of those delivering care. 

Security starts on the frontline, not in the IT department. Does everyone have basic training in cyber security? Do they understand their personal responsibility to keep data safe? This ‘cyber hygiene’ includes simple things such as keeping passwords safe and changing them regularly; never letting anyone other than the named person use a Smartcard; not clicking on unverified links; keeping mobile devices safe and secure; and ensuring that individuals log off or lock screens when they move away from a device. 

So if cyber security is so important to the NHS, what is happening at the centre to support organisations to practice what I am preaching? 

CareCERT support 

CareCERT Broadcast is an HSCIC service that gathers known threats and intelligence and broadcasts them appropriately across health and care organisations, along with advice about how to mitigate those threats. This enables organisations to make informed decisions about protectively fixing vulnerabilities before they become an issue. 

CareCERT Broadcast has been live for many months now [NHE reported on this in the Jan/Feb 2016 issue] and we’ve received useful feedback about other cyber services the sector would like to see us provide. As a result, CareCERT Broadcast will soon have some cyber siblings including CareCERT Assure; a set of CareCERT training modules; and a range of other services to be announced later this year.

CareCERT Assure will allow health and care organisations to take a free assessment of their cyber strengths and weaknesses. We want to use our experience to learn lessons on behalf of the sector, benchmark what good looks like and then share that, whilst also helping individual organisations to pin-point areas for improvement and investment, maximising the limited resources available. 

We are also in beta testing for a national cyber security training platform. This will cover a number of basic areas for all staff and a second, more complex module, will be available for specialist staff. Freely available to all health and care organisations, the training will enable organisations to develop colleagues, whilst ensuring our people form the first line of defence in securing information. 

CareCERT services will enable health and care organisations to benefit from the expertise at HSCIC, but without dictating a one-size-fits-all approach. Ultimately, the security of information is the responsibility of the organisation where it is held. We want to support organisations to safely look after that information, whilst allowing them to make appropriate local decisions about what works for their individual needs.

Tell us what you think – have your say below or email


Rick Gray   19/08/2016 at 08:14

My name is Rick Gray, I'm Head of Cyber Security for CSI Ltd. Charles Lilley (Head of Health Services) for CSI Ltd and myself have recently provided help to multiple NHS Trusts throughout the UK. I read the article this morning and its great to see Dan has created something educational for the NHS to use. We too often find deploying security tools which is necessary as prevention is not enough. Education is the key and one of the hardest areas in cyber security prevention, great to see Dan's created a collaboration of information to share.

Add your comment


national health executive tv

more videos >

latest healthcare news

Nearly a quarter of reception children in England overweight

20/10/2017Nearly a quarter of reception children in England overweight

Nearly a quarter of school children in reception classes in England are overweight – and the figure goes up to almost a third by year six. ... more >
Scrapping staff assault data collection to create ‘dangerous blind spot’

20/10/2017Scrapping staff assault data collection to create ‘dangerous blind spot’

The government has revealed that it will no longer keep regularly tracking NHS staff assaults. Since NHS Protect was scrapped this year, the... more >
MPs endorse Baroness Harding as new NHSI chair

20/10/2017MPs endorse Baroness Harding as new NHSI chair

The government’s Health Select Committee has endorsed Baroness Harding as the next chair of NHS Improvement (NHSI). The committee look... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

Our Health Heroes: NHS awards ceremony unveils shortlist

18/10/2017Our Health Heroes: NHS awards ceremony unveils shortlist

With the NHS facing unprecedented demand and difficult working conditions, it’s incredible that the workforce across the country still delivers great care to patients every single day. Requiring care is never a pleasant experience, but having a brilliant member of staff look after can make a huge difference to a quick recovery. For that reason, it’s important to recognise the support staff who work so hard to give patients p... more >
read more blog posts from 'the scalpel' >


Tackling infection prevention locally

04/10/2017Tackling infection prevention locally

Dr Emma Burnett, a lecturer and researcher in infection prevention at the University of Dundee’s School of Nursing and Midwifery and a boar... more >
Scan4Safety: benefits across the whole supply chain

02/10/2017Scan4Safety: benefits across the whole supply chain

NHE interviews Gillian Fox, head of eProcurement (Scan4Safety) programme at NHS Supply Chain. How has the Scan4Safety initiative evolved sin... more >
Simon Stevens: A hunger for innovation

25/09/2017Simon Stevens: A hunger for innovation

Simon Stevens, chief executive of NHS England, knows that the health service is already a world leader when it comes to medical advances – ... more >
Improving care at the touch of a screen

08/08/2017Improving care at the touch of a screen

When it comes to dementia, having a calm and safe environment can have a substantial impact on a patient’s quality of life. NHE’s Jos... more >

last word

The Refugee Doctor Initiative

The Refugee Doctor Initiative

Terry John, co-chair of the BMA & BDA Refugee Doctors and Dentists Liaison Group and chair of the union’s international committee, talks about a brilliant initiative that is proving mut... more > more last word articles >

editor's comment

25/09/2017A hotbed of innovation

This edition of NHE comes hot on the heels of this year’s NHS Expo which, once again, proved to be a huge success at Manchester Central. A number of announcements were made during the event, with the health secretary naming the second wave of NHS digital pioneers, or ‘fast followers’, which follow the initial global digital e... read more >

health service focus

Women power usage and uptake of myGP®

18/10/2017Women power usage and uptake of myGP®

Advertisement Feature: Lemarie Moses, prod... more >
Why don’t you write to your patients

11/10/2017Why don’t you write to your patients

The president of the Royal College of Surgeon... more >