Lancashire Care NHS Trust has today revealed the steps it has taken to safeguard access to sensitive data transferred and stored on USB devices.
New central security management software and sanctioned USB keys will enable the trust to make sure it can minimise the possibility of a data breach and protect the systems used by its 3,500 staff, who provide mental health and substance misuse services to 1.4 million people across Lancashire.
The trust is using the Sanctuary Data Protection system provided by Lumension Security to protect USB ports by assigning user access rights, blocking any unauthorised attempts to download data and encrypting all downloaded data.
A directive to ensure that all USB memory sticks holding the trust's data were encrypted led Lancashire's data security officer Alan Boardman to hold an amnesty to collect all USB sticks that had previously been used on the network.
The new software was then rolled out and staff were issued with an officially sanctioned USB memory stick for storing and transporting work data, allowing the IT security team to create a whitelist' of approved devices that are allowed to connect to the network - as well as block unauthorised ones.
Boardman said: "We were specifically looking for a centralised data protection solution that automatically enforced encryption. We can drill down into the access permissions of a particular device model, serial number or named employee, and have complete control over movement of data to and from all USB devices."
The new system also offers the ability to assign read/write access per individual user for each officially sanctioned USB device that connects to the network, as well as shadow and log all usage of USB memory sticks for auditing and compliance purposes.
"The trust's directive has been fulfilled and we now have the guarantee that all data stored on USB devices is encrypted and cannot be accessed if a thumb drive is lost or stolen," Boardman added.
In addition, the trust is applying the whitelisting capabilities of its new security system to other removable storage devices, including digital cameras, dictation devices and printers. And it is also now used to disable write access to floppy disks and CD/DVDs across the trust, allowing data to be read from these media but not written to them.
The NHS IT group Connecting for Health is currently rolling out encryption from McAfee - read more about it here.
