Dumfries and Galloway secures USB sticks

Tags: A Data Information Infrastructure iS South

09 Mar 2009

NHS Dumfries and Galloway has held a USB stick amnesty for staff and issued 1,100 SanDisk Cruzer Enterprise USB flash drives in return, in order to secure patient information.

Andrew Turner, information infrastructure manager at NHS Dumfries and Galloway, told E-Health Insider: “The trust has held an amnesty so that staff could bring in old USBs containing confidential information, and all of those have now been shredded.

“The distribution of the USBs was quite difficult as we are very dispersed throughout Scotland, so we arranged distribution days where we went to various different locations to give out the new sticks. It is now against policy to use any device other than those supplied by us.”

The organisation has deployed the new USBs with SanDisk CMC Server software to protect otherwise unencrypted, personally identifiable information. The new system will be used at the health board’s headquarters and at 50 field offices across South West Scotland.

Turner said the organisation wanted to make sure that employees could still access information quickly and easily by using USB sticks, but said the old drives were “leaving the doors wide open” for data breaches.

The health board is also planning to roll out AppSense software to tell it who is connecting to what devices and at what PCs, in order to track any misuse of information.

Graham Gault, head of information management and technology, said: “I’ve been in the business a long time and I’ve yet to see a comparable solution. We know that our data is now safe and secure.”

Related article: Scottish NHS gets £1million to secure USB ports

Link: SanDisk

Sarah Bruce

Readers Comments

Surely they are missing the point!

tony.donoghue@iseeuglobal.com

13 Mar 09 09:40

After reading your article about the Dumfries and Galloway USB stick amnesty, I was shocked to find that this practice is being endorsed by the Trusts. The practice of using a USB stick to remove patient related data from the Trust just seems to be a way of avoiding tackling the real problem which is to enable people to work and move data between locations in a secure and manageable way. There is no audit of what the staff are carrying on the USB sticks, no method of stopping them being used to carry inappropriate non-work related information (a perfect way to transmit viruses into the corporate infrastructure) etc. Better products exist that enable remote working without the need to remove the data from the organisation and others that can set up the transfer of information from hospital A to Hospital B that would audit the transaction and enable the work to be carried out but in a controlled manor that would benefit both the organisation and also be easy for the user to operate.

A little more effort should go into the solutions chosen to eradicate the security concerns of organisations, rather than endorse a practice that is not considered acceptable and replacing it with another poor choice.

Regards,

Tony.

EHI Tweets HIMSS10’

Past: 24 hrs|7 days|Month