NHS security blunders put patients at risk

Poor IT security has put patient care at risk in several NHS Trusts

NHS devices in England were infected with more than 8,000 computer viruses last year, 12 of which affected patient care, according to a new investigation by Channel 4's More4 News.

The TV programme wrote to every NHS Trust in England requesting information on successful attacks, and had responses from 75 per cent. The results suggest that IT networks in these organisations are not being properly managed, and are putting patient care at risk in some cases.

Several trusts told More4 News that their networks had been attacked because anti-virus protection had been turned off or not properly applied, while in other cases staff had actually turned off automatic Windows updates.

Around 800 PCs in Sheffield were infected after one computer in an operating theatre had its anti-virus software switched off, More4 News said. And on 18 November last year, the Mytob worm overloaded systems at Barts, the Royal London and the London Chest Hospital, affecting access to blood tests, X-rays and patient administration.

As well as these security concerns, patient data was also revealed to have been put at risk from hackers due to poor processes.

The NHS told More4 News that the new records system being implemented will have better levels of security than is currently the case at many local trusts.

"Electronic patient records systems are protected by the highest levels of access controls and other security measures," said the NHS in a statement. " These levels of security are far higher than any which can be imposed on access to paper records or the majority of local NHS IT solutions."

Gary Steele, chief executive of messaging security firm Proofpoint, argued that revelations such as this about the NHS could trigger tighter legislation to regulate the security of IT systems.

"Patients will demand this - they won't tolerate their data not being treated correctly," he added. "Creating more productivity and efficiency in the [NHS] will be important and using email makes sense, but it needs to be done securely. "