A simple set of guidelines for avoiding NHS style data-loss blunders



Keeping your data safe and secure

Part two of two: Protecting your private practice against data security threats

As you may recall we recently published a post assessing the data loss risks to your system, including those posed by staff blunders. In this follow up post, Tom Hunt, managing director of PPM Software, the provider of the software suite ‘PPM’ - Private Practice Manager, presents some guidelines on how to manage and keep your practice data safe.

Most of the data losses the NHS has suffered were created internally by staff making simple mistakes. To avoid these mistakes in private practice, you should remove the risks of employees copying, corrupting or abusing your practice information. For instance, fully integrated private practice management software can save a great deal of administration time and effort and help keep data manageable and in an easily secured, central location.

Another way of ensuring staff don’t make silly mistakes, like keeping a file of passwords on their PC or taping them to the side of a monitor, is to find a user friendly package which allows easy retrieval of information. This will also massively improve time management, both for the medical secretary running the practice and the other staff.

However, when you purchase any kind of private practice management software, you should ensure that the provider can work smoothly with your IT consultant in the event of a problem. You must not get into the situation where the hardware supplier says it is the practice management software company’s responsibility and vice-versa. Practice managers should expect technical support to be delivered in easily understood terms. Furthermore, there’s no reason not to expect your software provider to be able to give you advice on data security.

In summary then, here are some simple steps that you should take to protect your data:

 Installing an industry recognized firewall will significantly reduce the possibility of an external attack on your PC or network

 Install anti-virus software and keep it updated

 Back up your data every working day and keep a copy off site in a safe and secure location. There are also plenty of affordable online and cloud backup systems available now, including ones provided by huge global corporations such as Amazon and Google.

 Create a password to get into your computer

 Create a password to get into your practice management application

 Keep all of your passwords safe and change them regularly.  It is advisable to use a password generator to reduce the possibility of someone guessing your password based on information about you that is shared publically. Most hackers have ways of working out your passwords using stolen information of information about you that is available online. Using a password generator makes it much more difficult for them to do this.

 Only allow key tried and trusted staff access to critical data – For example within ‘PPM’ – Private Practice Manager there are four levels of access to the data. Each level is password protected so you can allocate the appropriate one to each member of staff.

 Ensure the data is encrypted using the latest methods available

Having said all of the above, there is no absolute solution to this problem.  If professional hackers want to get at your data they will, irrespective of the steps you take. After all they’ve proved in recent times that they can hack everyone from Sony Playstation to NASA!

However, you can at least make it difficult for them. I believe that if you stick to these steps you can minimise the problems the NHS have encountered. If you have any questions, please call me on 01992 655940. Furthermore, readers of our blog can obtain a free trial of ‘PPM’ – Private Practice Manager by quoting ‘Blog Offer’ when you call. 

Subscribe to receive our Blog via e-mail

Data-loss blunders are a real threat for private practice

How much security does your password proivde?

Part one of two: Security breaching mistakes

The most valuable thing on your private practice computers or network is the data you store there. After all, that information is the reason for having the computer and network in the first instance. Software applications and operating systems can always be reinstalled, but user-created records are unique and, if lost, may be irreplaceable. This is the first of two posts that will assess the data loss risks to your system - including those posed by staff blunders. 

In recent years we seem to have witnessed an increase in the number of news stories about laptops containing sensitive patient data which have gone missing. The same is true of files containing medical details, which have been lost or forgotten on public transport.

In 2010, computers containing the names, addresses and medical notes of 2,500 Camden Primary Care Trust patients were left beside a skip at St Pancreas hospital in London. The PCs, which were not encrypted, were stolen and never recovered.

In January 2009, a health worker in Lancashire lost a memory stick containing the medical details of more than 6,000 prisoners and ex-prisoners from HMP Preston, a category B local prison. The data was encrypted, but the password had been written on a note which was attached to the stick when it was misplaced.

Later that year, a report from the Information Commissioner told the NHS to improve its data security, after the watchdog took action against 14 NHS organisations in six months prior.

In addition to these security issues, attacks on computer networks from the Internet have dramatically increased in sophistication and frequency. These attacks are affecting all types of networks, from home users up to large corporations. Viruses, junk email, spyware and other security risks are now commonplace and a security breach can paralyze an entire practice in a matter of minutes.

New viruses compromise passwords and pass confidential data to unscrupulous third parties.

Not only are external risks like those mentioned above expensive to correct, but the damage to patient confidence and the risk to operations from an internal threat, such as a disgruntled employee stealing data, can cripple an organisation.

However, you can at least make it difficult for them. I believe that if you stick to these steps you can minimise the problems the NHS have encountered.  If you have any questions, please call me on 01992 655940. Furthermore, readers of our blog can obtain a free trial of ‘PPM’ – Private Practice Manager by quoting ‘Blog Offer’ when you call. 

Subscribe to receive our Blog via e-mail