NHS National Services Scotland has awarded a £1m contract to Lumension to nationally enforce security policies governing the storage of data.
The contract for Lumension Device Control will provide IT departments with complete visibility and control of all storage devices and media connected to their networks, includng laptops, USB sticks, CDs and DVDs.
The software also allows data that has been authorised for storage to be encrypted, with specific limits set regarding the file size and type. This can be set to prevent large databases being copied.
Last year, the Information Commissioner’s Office published Data Handling Procedures in UK Government, a document that highlighted the need to restrict access to public sector data and for personal data stored on removable devices to be encrypted to prevent unlawful access.
As a result, the Scottish Government made £1m available to Scottish health boards from its eHealth budget to help them to comply with the latest requirements.
Mark Salveta, the head of NHS National Services Scotland’s business advisory group, which procures IT software on behalf of the 14 Scottish health boards and eight special health boards, told E-Health Insider: “Essentially, we needed a solution that would prevent anyone from storing patient data or any other health board information, onto a CD, DVD, USB stick or laptop, without having express permission to do so.
“We decided that although the health boards were making these improvements themselves, the £1m could be used more effectively if it was allocated from the centre and a large purchase was made all at one time.”
NHS Services Scotland reviewed products from ten vendors using a strict specification and technical review.
Salveta said: “It turned out that there was very little difference between the final three vendors other than the price, which made us choose Lumension. From a value for money point of view the procurement process allowed us to sign a contract worth £3m for just £1m.”
The software has already been rolled out at NHS Lothian and NHS Grampian, and roll-out will continue over the coming weeks. The health boards will retain the option to choose a different product, but have an obligation to comply regarding the protection of data stored on portable devices.
Salveta said: “So far, it has been really well received and we’ve already had extremely positive feedback. Now it is just a case of moving everyone to the same level of security.”
Andrew Clarke, senior vice president of international sales for Lumension, said: “We are delighted to have been chosen by NHS National Services Scotland, particularly after following such a rigorous product specification and selection process.
“Public sector organisations have recognised their responsibilities as the custodians of person identifiable records and are constantly refining best practice in data handling.
"NHS Scotland has demonstrated the value of using our technology to reinforce existing policies designed to safeguard patient data, by gaining control and visibility of all data transferred to portable devices.”
Links