British Nursing News Online

WWW.BNN-ONLINE.CO.UK

Tuesday, 23 April 2024

Thursday, 29 June 2006 11:00

BNN: British Nursing News Online · www.bnn-online.co.uk

NHS mobile devices 'not secure'

The NHS is failing to use adequate security on portable data storage devices, according to a survey.

Of the 117 healthcare workers quizzed, almost two thirds use no or inadequate security on their mobile devices. Medical professionals also admitted to using the devices to store patient information.

The survey was carried out by the British Journal of Healthcare Computing and Information Management (BJHC) and company Pointsec Mobile Technologies.

Harry Wood, assistant editor of BJHC, said patient confidentiality is being put in jeopardy.
The respondents included information managers, IT managers and medical professionals.

Two thirds of the 117 worked in the NHS, and a quarter were suppliers to the NHS.

Portable data storage devices are becoming increasingly popular, as they can carry large amounts of data from one place to another. The participants surveyed said they use a mixture of USB memory sticks, laptops, PDAs, smart phones and mobile phones.

Nearly two thirds of respondents used their device to store corporate information, and one fifth held security details, such as passwords and pin numbers. Half of the medical professionals who responded said they carried patient records on their devices.

But the survey also revealed that inadequate security was being used to safeguard this information. One fifth of those asked said they did not use any security, and a further two fifths only used password controlled access.

Mr Wood said: "A password alone is not adequate security for mobile devices.
"The data should be encrypted at source where it is held on the organisations network, and then anything that is taken off onto a mobile device is readily encrypted.

"This means that it doesn't matter if it has been password protected or not because you can only get into it if you gave the decryption codes."

Almost 80% of the respondents said there was a security policy in their organisation, but Mr Wood said the survey suggested these policies were not being strictly enforced placing medical records and patient information in jeopardy.

Dr Paul Cundy, a GP from London and the British Medical Association's spokesman for computing in general practice, said: "In the past, data was kept on hard discs, but we are increasingly moving into a mobile data world.

"There needs to be a far greater understanding of the consequences of having electronic records in general.

"One of the problems is that it takes a mishap to really bring things home, and I dare say at some point there will be a story about people having their medical details sold."

A Department of Health spokesman said: "Individual devices and data security are a matter for individual trusts. Each has its own Caldicott guardian who is responsible for data security and clinical confidentiality.

"Any equipment or activity taken through the National Programme for IT will meet stringent security and confidentiality requirements. These requirements were commended in the recent National Audit Office report on the programme."

- 0 comments on this story