Comment

11.07.16

Cyber security in NHS trusts

Source: NHE Jul/Aug 16

Dan Taylor, head of cyber security at the Health and Social Care Information Centre (HSCIC), soon to be NHS Digital, discusses the importance of cyber security and the development of CareCERT.

Many of you may be thinking that this piece isn’t for you, because you aren’t an IT professional. You would be wrong, and this perception is the single biggest threat to keeping health information safe and secure. Good cyber security is the responsibility for every member of staff in an organisation, and good ‘cyber hygiene’ is as important and can be as simple as good hand hygiene in an NHS organisation. 

The move to electronic records, the digitisation of patient services and the advent of technology-enabled care has saved time and resources for the NHS, and has huge potential to play a key role in delivering excellent patient care in the future. But alongside the benefits of digitisation there are risks, and with risks come responsibilities. These responsibilities aren’t just for your IT or security team, they belong to every member of staff in your organisation. 

Cyber security starts on the frontline 

Effective security has to start with people. Estimates vary, but official figures from HSCIC show that around 1.3 million people work within health, the vast majority of those delivering care. 

Security starts on the frontline, not in the IT department. Does everyone have basic training in cyber security? Do they understand their personal responsibility to keep data safe? This ‘cyber hygiene’ includes simple things such as keeping passwords safe and changing them regularly; never letting anyone other than the named person use a Smartcard; not clicking on unverified links; keeping mobile devices safe and secure; and ensuring that individuals log off or lock screens when they move away from a device. 

So if cyber security is so important to the NHS, what is happening at the centre to support organisations to practice what I am preaching? 

CareCERT support 

CareCERT Broadcast is an HSCIC service that gathers known threats and intelligence and broadcasts them appropriately across health and care organisations, along with advice about how to mitigate those threats. This enables organisations to make informed decisions about protectively fixing vulnerabilities before they become an issue. 

CareCERT Broadcast has been live for many months now [NHE reported on this in the Jan/Feb 2016 issue] and we’ve received useful feedback about other cyber services the sector would like to see us provide. As a result, CareCERT Broadcast will soon have some cyber siblings including CareCERT Assure; a set of CareCERT training modules; and a range of other services to be announced later this year.

CareCERT Assure will allow health and care organisations to take a free assessment of their cyber strengths and weaknesses. We want to use our experience to learn lessons on behalf of the sector, benchmark what good looks like and then share that, whilst also helping individual organisations to pin-point areas for improvement and investment, maximising the limited resources available. 

We are also in beta testing for a national cyber security training platform. This will cover a number of basic areas for all staff and a second, more complex module, will be available for specialist staff. Freely available to all health and care organisations, the training will enable organisations to develop colleagues, whilst ensuring our people form the first line of defence in securing information. 

CareCERT services will enable health and care organisations to benefit from the expertise at HSCIC, but without dictating a one-size-fits-all approach. Ultimately, the security of information is the responsibility of the organisation where it is held. We want to support organisations to safely look after that information, whilst allowing them to make appropriate local decisions about what works for their individual needs.

Tell us what you think – have your say below or email opinion@nationalhealthexecutive.com

Comments

Rick Gray   19/08/2016 at 08:14

My name is Rick Gray, I'm Head of Cyber Security for CSI Ltd. Charles Lilley (Head of Health Services) for CSI Ltd and myself have recently provided help to multiple NHS Trusts throughout the UK. I read the article this morning and its great to see Dan has created something educational for the NHS to use. We too often find deploying security tools which is necessary as prevention is not enough. Education is the key and one of the hardest areas in cyber security prevention, great to see Dan's created a collaboration of information to share.

Add your comment

 

national health executive tv

more videos >

latest healthcare news

Time to address paramedic retention rates

28/03/2017Time to address paramedic retention rates

Following the National Audit Office’s (NAO’s) recent report into NHS ambulance services, Gerry Egan, chief executive of the College o... more >
Empowering leaders for the future of commissioning

28/03/2017Empowering leaders for the future of commissioning

Caroline Chipperfield, associate director of partnerships at the NHS Leadership Academy, explores the conditions, culture and climate leaders wil... more >
Firefighters and pharmacists: empowering the wider public health workforce

28/03/2017Firefighters and pharmacists: empowering the wider public health workforce

Shirley Cramer CBE, chief executive of the Royal Society for Public Health (RSPH), explains how we must look beyond the core public health workfo... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

The future of clinical commissioning

13/03/2017The future of clinical commissioning

Dr Graham Jackson, co-chair of NHS Clinical Commissioners (NHSCC) and chair of NHS Aylesbury Vale CCG, discusses the changing landscape facing commissioners.  Since they were set up more than three years ago, CCGs have demonstrated a great ability to innovate and develop services according to a local population’s needs. They have also continually had to adapt and change the way they work. Going forward, this is something I ex... more >
read more blog posts from 'the scalpel' >

interviews

Tight timetable for nursing associate  regulation

28/03/2017Tight timetable for nursing associate regulation

Jackie Smith, chief executive at the Nursing and Midwifery Council (NMC), talks to NHE’s David Stevenson about the challenges her organisat... more >
Improving the flow

13/02/2017Improving the flow

Glen Burley, chief executive of South Warwickshire NHS FT, explains how his organisation has been able to improve patient flow through its emerge... more >
Leadership development should be for all in health and care

07/12/2016Leadership development should be for all in health and care

Back in August, Stephen Hart joined Health Education England (HEE) as the organisation’s new director of leadership development, which incl... more >
The powerful link between staff and patient satisfaction

03/10/2016The powerful link between staff and patient satisfaction

David Behan CBE, chief executive of the Care Quality Commission (CQC), talks to NHE about the correlation between high rates of staff satisfactio... more >

last word

Foreign patient charges are a distraction from the real issues

Foreign patient charges are a distraction from the real issues

Vivek Kotecha, research officer at the Centre for Health and the Public Interest (CHPI), explains why the charging of foreign patients distracts from our home-grown NHS issues.  The Dep... more > more last word articles >

editor's comment

22/03/2017New additions and unexpected announcements

As NHE went to press, many of us were still recovering from the chancellor’s unexpected health announcements in his last Spring Budget.   While the sector welcomed Philip Hammond’s revelations, centered on capital funding for advanced sustainability and transformation plans (STPs) and A&E triage schemes (page 24)... read more >

health service focus

Firefighters and pharmacists: empowering the wider public health workforce

28/03/2017Firefighters and pharmacists: empowering the wider public health workforce

Shirley Cramer CBE, chief executive of the Ro... more >
A holistic approach is needed to tackle estate issues

24/03/2017A holistic approach is needed to tackle estate issues

Julian Amey, chief executive of the Institute... more >