By Nick Heath, 24 June 2008 16:57
NEWS
NHS trusts will not have completed encrypting patients' personal data held on their computers until later this year.
A number of health trusts are expected to be months late meeting a target to encrypt all data on non-secure machines by 31 March.
Many trusts will be unable to meet the local targets as set by strategic health authorities (SHAs) as they had been told not to begin the work until Connecting for Health (CfH), the body co-ordinating NHS IT, procured an encryption package - which did not take place until 20 March.
The Department of Health (DoH) has confirmed that it would then take "at least six months" for each trust to complete the roll-out of encryption.
It means data will not be fully protected until 10 months after NHS chief executive David Nicholson asked trusts to make the securing of personal data a priority.
There is no central monitoring within the NHS to ensure that trusts have carried out encryption, with it being left up to the strategic health authorities to check on compliance.
Security from A to Z
Click on the links below to find out more...
A is for Antivirus
B is for Botnets
C is for CMA
D is for DDoS
E is for Extradition
F is for Federated identity
G is for Google
H is for Hackers
I is for IM
J is for Jaschan (Sven)
K is for Kids
L is for Love Bug
M is for Microsoft
N is for Neologisms
O is for Orange
P is for Passwords
Q is for Questions
R is for Rootkits
S is for Spyware
T is for Two-factor authentication
U is for USB sticks/devices
V is for Virus variants
W is for Wi-fi
X is for OS X
Y is for You
Z is for Zero-day
A spokesman for the DoH defended the time taken saying: "The roll-out of encryption is a complex matter.
"David Nicholson has sought and received assurances from the heads of all trusts that they are working to ensure encryption takes place in a timely fashion. Each of the SHAs will performance manage this but it is paramount that patient care is not disrupted."
The target of 31 March for encryption to take place was a local deadline set by some SHAs and CfH said there was no central target set by the DoH. CfH said the DoH had simply sought an assurance that the process was in hand by the end of March.
CfH confirmed that 700,000 licences had been issued for its chosen encryption package, McAfee's SafeBoot.
A CfH spokesperson said: "It is understood that this process can take some time as skilled technicians are required to complete the task.
"SHAs are responsible for ensuring that trusts progress with encryption as swiftly as possible and the Department of Health has advised SHAs to consider undertaking an independent audit of their trusts' progress."
The revelation came as it emerged that records of 894,629 calls made to the Scottish Ambulance Service had gone missing, after a portable hard drive being transported by courier went astray.
Comments
There are 2 comments. Join the discussion
1. anonymous
Betcha anything they have written the NHS-wide standard password 'nhs' on a post-it and stuck it to a monitor :-)
2. Karen Challinor
"A spokesman for the DoH defended the time taken saying: "The roll-out of encryption is a complex matter."
and as such should have been the first thing on the to do list with everything else using the original system until it was working, that way details like taking 90 seconds to log in being bypassed by one doctor remaining logged in all shift and everyone using the same terminl could have been addressed and fixed
it should not be a last minute bodge on, retrofitted inefficiently around a system that is being actively used
I know I come across as a bit of a luddite but I am not against the idea of technology being used to provide improvements
what I am against is some numpty or group thereof taking control of a project and making a complete mess of the thing by ignoring the development and implementation team, by imposing their own view of the project without any knowledge of the constraints, methodologies or technologies and by generally forcing the thing to be built arse backwards because they want visible results quickly
I was always taught the 80/20 rule, 80% design, 20% build and every project I've worked on thats adhered to that has pretty much worked first time, but there are no visible results for a very long time
the people in charge of projects like this NHS one have too much authority and not enough knowledge of the subject they have authority over