NHS Failing to Invest in Cyber Security

A number of NHS trusts spent up to £100,000 on IT security last year, with others spending nothing, say new Sky News figures.

The investigation by Sky News concluded that NHS trusts are failing to invest adequately and claimed that there were seven trusts in Wales and England that chose not to invest at all in cyber security.

The Northern Lincolnshire and Goole NHS Foundation Trust had to cancel several days of scheduled operations in three hospitals after a significant malware infection.

A survey conducted by security software and hardware company Sophos revealed inadequate encryption procedures in the NHS. From 250 IT managers, CTOs and CIOS, 84% referred to encryption as a necessity, although it has been well established in only one in ten organisations.

Jonathan Lee, sector manager for UK healthcare at Sophos, said:

“The Sky News findings are shocking, but not entirely surprising. NHS organisations face significant IT security issues, and IT decision makers still have big challenges to address gaps in their security…. Budget cuts and changes to working practices, such as the increase in mobile working, all present significant challenges within the sector.”

The lack of spending in this area is a surprise for an organisation such as the NHS, but risking sensitive customer data is unacceptable, and we have seen a number of high-profile companies forced to apologise to their customers for various breaches in recent years. Businesses would be wise to learn from those errors and make cyber security jobs available to those with the skills to ensure the protection of customer data.