Any of you worked on security for the NHS?

[Eirikur]

This liability insurance and legal insurances may come in handy for someone on here, but it may not be enough

[stek]

So if they've managed to do that, what's to say they're not downloading all of the patient health records. A breach of that would be the largest ever.

Caldicot Guardian!

[DaveB]

So if they've managed to do that, what's to say they're not downloading all of the patient health records. A breach of that would be the largest ever.

Because control of the PC doesn't give access to the records systems. To gain access to patient records you have to have a physical NHS smart ID card that you plug into the PC and then use that in combination with user ID ad password to authenticate yourself via the specific application.

This looks like a ransomware attack that got through in a couple of trusts. Knee jerk reaction from medical staff would be that they think the patient data has been compromised when in reality it will only be whatever was locally stored on that PC, which should be bugger all in normal circumstances.

Local IT staff will be shutting down local systems to prevent infection spreading while they clean up and work out how it happened. If SPINE or any of the other national services were down UKCCS and others would know about it and be telling people.

[MarillionFan]

Caldicot Guardian!

I was back in the day and carried out analysis on 3M patients records as part of a study. It always worried me how easy it was for me to do that analysis & how easy it would have been for me to lost my laptop & data.

[northernladyuk]

So if they've managed to do that, what's to say they're not downloading all of the patient health records. A breach of that would be the largest ever.

There is no single system for patient health records. Happens in the US:

Hackers demand ransom to release encrypted US medical records | Ethics & Health Law News

[northernladyuk]

Because control of the PC doesn't give access to the records systems. To gain access to patient records you have to have a physical NHS smart ID card that you plug into the PC and then use that in combination with user ID ad password to authenticate yourself via the specific application.

This looks like a ransomware attack that got through in a couple of trusts. Knee jerk reaction from medical staff would be that they think the patient data has been compromised when in reality it will only be whatever was locally stored on that PC, which should be bugger all in normal circumstances.

Local IT staff will be shutting down local systems to prevent infection spreading while they clean up and work out how it happened. If SPINE or any of the other national services were down UKCCS and others would know about it and be telling people.

Smartcards are a necessity only for spine connected systems (and even then it's slightly more nuanced).

Local PCs may have (but shouldn't have) clinical correspondence such as letters, and in some case small departmental databases.

[northernladyuk]

This liability insurance and legal insurances may come in handy for someone on here, but it may not be enough

Suppliers' will have insurance. The NHS IIRC self-insures.

[AtW]

The NHS IIRC self-insures.

Won't be allowed after Brexit - unfair competition with US Insurance giants...

[MarillionFan]

Because control of the PC doesn't give access to the records systems. To gain access to patient records you have to have a physical NHS smart ID card that you plug into the PC and then use that in combination with user ID ad password to authenticate yourself via the specific application.

This looks like a ransomware attack that got through in a couple of trusts. Knee jerk reaction from medical staff would be that they think the patient data has been compromised when in reality it will only be whatever was locally stored on that PC, which should be bugger all in normal circumstances.

Local IT staff will be shutting down local systems to prevent infection spreading while they clean up and work out how it happened. If SPINE or any of the other national services were down UKCCS and others would know about it and be telling people.

It's pretty major for that amount of ransomware to have got to that many machines. It may just be a case of a few machines and they've just instantly shut down the networks though.

[Mordac]

I don't think anyone has ever worked on IT security for the NHS. Their network was riddled with SQL worms and all sorts of other nasties when I had a passing acquaintance with it about 15 years ago. MF will probably back me up on that.