Cyber Attack On The NHS

The Public Accounts Committee states that the WannaCry cyber-attack on Friday 12 May 2017, was a wake-up call for the NHS. The Department of Health and Social Care and its arm's-length bodies were unprepared for the relatively unsophisticated WannaCry attack; they had not shared and tested plans for responding to a cyber-attack, nor had any trust passed a cyber-security inspection.The report sets an end of June deadline for the Department of Health and Social Care to provide anupdate on costed plans for vital security investment. See Kings Fund blog here

Data security and protection for health and care organisations

Document outlining action expected from health and care organisations in 2017 to 2018, to implement recommendations by the National Data Guardian.   It has been updated.

National Data Guardian for Health and Care 2017 report: impact and influence for patients and service users

This report from the National Data Guardian looks back over the past three years since the creation of the National Data Guardian role and it describes future priorities. It sets out a case for the independent advice and challenges that the role provides to ensure that confidential data collected by the NHS and social care services is safeguarded and used appropriately to improve care.

Boards required to designate executive with data security responsibility

Every NHS board in England will be required to designate an executive board member responsible for data and cyber security, under government plans to bolster data security and increase cyber resilience across the health and care sector. 

The move forms part of a new requirement for chief executives to issue an annual ‘statement of resilience’ detailing the action their organisation is taking to meet the ten data security standards recommended in Dame Fiona Caldicott’s review into data security, consent and opt-outs.

Your data: better security, better choice, better care

This DH report outlines the government's response to the Caldicott Review and the Care Quality Commission's review on data protection in the NHS. The response accepts the recommendations in both reviews and it makes commitments to the safeguarding of information with the creation of the National Data Guardian's position as a statutory position and the introduction of stronger sanctions to protect anonymised data.

Government responds on cyber security and data

On 12 July 2017, the government announced that investment in data and cyber security will be boosted above £50 million - and include a new £21 million capital fund for major trauma centres - as part of its response to reviews and consultation feedback on these issues.

Your Data: Better Security, Better Choice, Better Care is the government’s response to the:

• National Data Guardian for Health and Care’s Review of Data Security, Consent and Opt-Outs
• public consultation on that review
• Care Quality Commission’s Review ‘Safe Data, Safe Care’

Proper Planning Prevents…NHS cyber attack

What lessons can be taken for future major incident planning from the NHS cyber attack? Helen Buckingham reflects and reports back from our New Cavendish Group.

What do people think about proposed patient data standards?

The Government has been consulting on new standards to strengthen the security of patient information and to help people make informed choices about how their data is used.

To help with our response to this consultation, we collected people’s views on some of the broad principles behind the proposals. Find out what people said and download our consultation response.

New NHS cyber security services to be rolled out to health and care

CareCERT (Care Computer Emergency Response Team) provides proactive advice and guidance about digital threats and cyber security best practice.

The service currently sends out broadcasts about known cyber threats and resolutions, and will now be expanded to include three new services, which will start being tested from September.

• CareCERT Knowledge- a new e-learning portal to help all health and care organisations train their staff in cyber security basics, and build up the first line of defence in ensuring the security of patient information
• CareCERT Assure - a service to help organisations assess their local cyber security measures against industry standards, and provide recommendations on how organisations can improve data security measures and reduce vulnerabilities
• CareCERT React - a support service to provide professional guidance and advice on the decisive actions to take to reduce the impact of a data security incident, in order to minimise the impact and help organisations recover and restore security as soon as possible

Monitor - FOI release: FOI National Data Validation Programme

NHS Improvement explained that it holds this information and has decided to release the information, subject to redaction of certain material under sections 40 and 42 of the Freedom of Information Act 2000.

Note and supporting documentation sent to NHS Improvement’s board on the National Elective Data Validation Programme.

What If People Controlled Their Own Health Data?

Health data offers the opportunity to develop a better health system for the future, but people need to believe their data is in safe hands. 

In its latest collection of essays from the King's Fund, Matthew Honeyman explores hypothetical scenarios for the future of health and care, and discusses how to realise the full potential of using this data.

Share your views on new standards to keep your patient data secure

The Government is now consulting on new standards to strengthen the security of health and care information and to help you make informed choices about how your data is used.
Over the summer the Government is seeking views from the public on plans for how the NHS will be able to use patient data to improve services and treatments.
In particular they are looking at how the NHS should be working in order to protect your data and how you can choose what your data is used for.

Safe data, safe care

This thematic review published by the CQC of data security was conducted to establish whether personal health and care information is being used safely and is appropriately protected in the NHS. The review found that across the NHS there is widespread commitment to keeping data secure, but effective action is not always being taken where necessary.

New standards to keep your patient data secure

A new report published by the National Data Guardian sets out recommendations for how patient's health and care information should be used within the NHS.

'Review of Data Security, Consent and Opt-out', produced by the National Data Guardian Dame Fiona Caldicott, was commissioned by the Department of Health and received evidence from Healthwatch England and local Healthwatch about the public's views on consent and data security.