Lancashire Care NHS Foundation Trust has taken control of its USB ports using a data protection solution from Lumension Security.
The trust, which employs 3,500 staff and provides mental health and substance misuse services across Lancashire, held a USB stick amnesty and replaced “rogue” devices with officially sanctioned memory sticks.
It then implemented the Sanctuary Data Protection solution. This allows it to assign user access rights, block unauthorised attempts to download data and encrypt all data that is downloaded.
Repeated public sector data breaches this week prompted NHS chief executive David Nicholson to write to all NHS chief executives to ask them to check they had implemented Department of Health policy on encrypting removable data.
Alan Boardman, the trust’s data security officer, told E-Health Insider that the software will also allow his team to centrally shadow and log all usage of USB memory sticks for auditing and compliance purposes, giving Lancashire Care a record of exactly what data has been downloaded to and from what USB devices.
“We were specifically looking for a centralised data protection solution that automatically enforced encryption,” he said. “We looked at alternatives, but found that they were not enforceable and couldn’t be managed centrally.”
The new USB sticks are printed with the trust’s logo, post office box number, postcode, and a personal identification number which is unique to each employee. Therefore, the trust hopes that if the device is lost, it can be returned safely.
When asked whether he believed that the devices were foolproof, Boardman said: “In my opinion there is no way of hacking into the AES256 software, so I think that the devices are perfectly safe.”
The trust, which provides mental health and substance misuse services, has purchased 1,000 memory sticks and is now looking to use similar software on its laptops.
“We wanted to add the software to our laptops in the same year, but it just wasn’t possible due to lack of time and funding,” said Boardman.
The trust is also using the solution to disable write access to floppy disks and CD/DVDs, so that data can be read from these media but not written to them. It is now planning to explore solutions for other devices such as dictaphones and digital cameras.
Link