Proposed NHS portal raises questions about data security
Proposed NHS portal raises questions about data security
The new NHS information strategy is to allow patients, health professionals, commissioners and researchers to access their records easily.

The national ‘portal' will allow all NHS patients to be able to have secure online access, where they wish it, to their personal health records by 2015. According to E-Health Insider, this will fit with the central theme of shifting to a sharing of information within and between health and social care providers, and capturing data just once at the point of care.

David Harley, senior research fellow at ESET and former director of the NHS Threat Assessment Centre, looked at the plan and said he felt it read more like an extended mission statement than a real strategy document.

He said: “Even the polysyllabic version seems to me to say, basically, that the security of an individual's data will depend on the data being handled responsibly by medical professionals; and on the sharing of such information by the individual only with appropriate people.

“The security model of the central repository isn't defined, even in the main document. Instead the emphasis is on the need to share the data with the subject of the data, with professionals treating the subject and the agencies who would make use of the anonymised/sanitised data.”

Harley said that the model described doesn't sound like it has been changed significantly from the NHS National Programme for IT (NPfIT) model, as the central agencies under control of the Department of Health are focusing on central security.

“I'd be willing to place a small bet on the implementation continuing to rely on external providers rather than in-house expertise and a lot of responsibility devolved to ‘the local level',” he said.

“The emphasis on better data sharing with the data subject, however desirable in principle, does increase the attack surface – even if the central resource is soundly protected, it seems to me that how local services and data subjects access data is likely to be highly dependent on local conditions. We're already all too aware that security awareness across the many individual units that make up the NHS is highly variable.”

Marc Lee, EMEA sales director at Courion, said: “Giving all NHS patients secure online access to their records by 2015 is hugely ambitious. Such a tight timetable, the huge numbers of potential users and the need to strike the right balance between access and privacy means the NHS cannot rely on traditional identity and access management systems that take too long to develop and when deployed aren't fit for purpose.

“Quite clearly, this project will require the NHS to embrace access risk management solutions that help the authorities prioritise and plan for risks and gives them the real-time tools to spot and stop abnormal activities.”

He added: “I don't see the NHS funding handheld tokens to every eligible member of the UK population to give them access to their data, but I wouldn't be surprised to see authentication move towards the customer's mobile devices as it has already started to happen among healthcare professionals, and I can see all the problems that already exist with bring your own device in the enterprise multiplying in the context of healthcare customers.”

Jim Williams, application development manager at University Hospitals Birmingham, who told SC Magazine about the development of its myhealth@QEHB patient portal this week, said he had not been involved in this project.

“From the perspective of the man on the street, I would imagine that this would be a major undertaking to get this happening, but we are not involved at all – but I am sure that we will hear about it eventually,” he said.

Grant Taylor, UK vice-president of Cryptzone, welcomed the news, but warned that the two biggest stumbling blocks would be the high levels of security and public confidence required for the project to succeed.

Taylor said: “The challenges are not technology-based, but involve the development of a 'joined up' security strategy that will handle the phenomenally large volumes of data involved, and to a level of security that inspires confidence among the UK's population – all of whom will be stakeholders in what promises to be a very challenging IT project.

“Then there is the problem of confidence in the system among NHS staff in general. While the technologists amongst us understand that the security and IT systems are potentially scalable, we have all seen too many failures where NHS technology is concerned.

“The important thing to realise here is that one size does not fit all, as our observations suggest that the security will only work if the data is stored securely in multiple silos and replicated – as well as shared – between different IT systems. For this to happen, there needs to be a culture shift in the way patients, users of healthcare services and NHS professionals think, work and interact on the technology front.

“Most current NHS IT systems do not even record information in the same way, so merging data systems can only be a long-term aspiration. I have grave doubts as to whether the public has enough confidence in IT security to embrace an electronic healthcare revolution any time soon.”