Feeds

NHS record access pilot due next year

I am whoever I say I am

Intelligent flash storage arrays

The Care Records Development Board (CRDB) is preparing to pilot online patient access to medical records, it said this week, but it hasn't yet worked out what kind of authentication procedures or security system it will use.

The pilot, which is expected to involve around 50 patients initially, is slated for "some time next year", and the CRDB wants to get stakeholder feedback on how the authentication and security should be run.

Mat Jordan, who works on the HealthSpace project, explained that the problem was making sure the registration is easy enough that people will do it, but robust enough that no one can impersonate anyone else. Similarly, the security of login has to balance safety and confidentiality with a system that people will use, he noted.

Access to patient care records stored on the spine will be through the HeathSpace website. This is where you go to use the Choose and Book service, and you can elect to store certain details about yourself in a private HealthSpace of your own.

At the moment there is no link to any external database from a HealthSpace account and the only information stored there is what a user chooses to put in, so there is no authentication at sign up.

When the site becomes the gateway for access to the summary care record, this will change and a much more robust identification and sign in system will be deployed. The question is, what will it look like?

The CRDB has several solutions in mind, ranging from a basic username and password system to a key token in conjunction with a username and password login. Biometric technologies have been ruled out as they are considered too immature to be relied upon. A lesson there for the ID card project, perhaps.

Delegates at the CRDB conference in London this week were divided on what they thought was adequate proof of identity to sign up, and what kind of access security they would be happy with, but there were some common threads.

Most thought some form of established identification - passport or drivers licence, for instance - should be provided to register for access, and many said that original documents, not photocopies, should be required. Delegates did suggest the CRDB think carefully about making the system accessible to those without traditional forms of identification, such as those with no fixed address.

As for logging on, the majority thought holding any token - be it a USB key or a one time pad, would be too much hassle, and that username and password, plus some additional facts, would be enough. "The banking model should work," one delegate said.

Another point that needs to be rectified is access for those who opt not to share their medical records. If I opt out, I can't access my own record online without flagging a priority one alert - signalling access to a restricted record. That throws up all kinds of audit flags.

Jordan told El Reg that sorting this was just a technical issue, rather than a question of policy, and that it was on the list of things they needed to rectify. ®

Internet Security Threat Report 2014

More from The Register

next story
The 'fun-nification' of computer education – good idea?
Compulsory code schools, luvvies love it, but what about Maths and Physics?
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Yes, yes, Steve Jobs. Look what I'VE done for you lately – Tim Cook
New iPhone biz baron points to Apple's (his) greatest successes
Lords take revenge on REVENGE PORN publishers
Jilted Johns and Jennies with busy fingers face two years inside
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Doctor Who's Flatline: Cool monsters, yes, but utterly limp subplots
We know what the Doctor does, stop going on about it already
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.