NHS warns staff over tablet security risks

Gill Hitchcock
Guardian Professional, Friday 13 January 2012 16.22 GMT

NHS Connecting for Health (CfH) has issued guidance to staff warning them not to use tablet devices to store sensitive patient data.

In a "good practice guidance" document, CfH says the use of tablets in commercial organisations is increasing and there is pressure for NHS organisations to follow suit. However it tells staff that these devices are inherently less secure than more traditional technology.

The financial cost and the risk of device theft or data loss may be higher than with other portable technology because of tablets' desirability, ease of concealment and ease of access to content once stolen.

NHS staff must have strong encryption and passwords if using tablets, and the devices must be configured to allow for remote wiping, or wiping after a number of failed password attempts, the guidance says.

It recommends that staff consider using built-in GPS functionality to enable the location of a device to be tracked.

The guidance warns against the use of cloud services with tablets, saying tablet devices have the ability to automatically back up content to the cloud, which can result in sensitive data being uploaded to remote servers without the user being aware.

Users should remove or disable unnecessary services from tablets, while the ability to transfer data from the devices should be restricted to a list of permitted destinations, CfH says.

Tablets are a high profile target for malware, it warns, claiming operating systems on tablet devices and smart phones are still evolving and distribution of updates and patches is not consistent.

It recommends that tablets should not be deployed 'out of the box', but should be configured with a standardised OS and firmware version together with current security updates before use.

A Department of Health spokesman said: "We have developed interim guidance about the safe use of tablet devices within the NHS in response to growing interest in this area. This makes it clear that these devices are currently not as secure as more traditional IT equipment. They should therefore not be used to store sensitive patient data and should, as with all mobile devices, be encrypted. Further guidance will be updated as necessary."

Latest News

Bookmark this page:
  • Add To Digg
  • Add To Reddit
  • Add To Del.icio.us
  • Add To Stumble Upon