Dear Colleague
You will be aware from previous CPNI updates that cyber incidents such as account compromises, malware attacks and phishing, are experienced by businesses worldwide on a daily basis, with home working and the COVID crisis increasing the risk of attacks.
Organisations providing healthcare appear to be particularly liable to attack with one report indicating that, since the start of November 2020, there has been a 45% increase in attacks targeting healthcare organisations globally. This is more than double the overall increase in cyber-attacks across all industry sectors worldwide seen during the same time.
The rise in attacks involves a range of vectors, however ransomware shows the largest increase and is the biggest malware threat to healthcare organisations when compared to other industry sector.
Community pharmacies hold a large volume of sensitive personal and financial data and any breach of the security systems protecting this information could be very damaging to the economic stability of the business and the welfare of patients. It may also leave contractors open to possible punitive action by the Information Commissioner’s Office under DPA and GDPR legislation, with resulting reputational damage to the individual and the profession.
CPNI has been working closely with the cyber security lead from the Police Service of Northern Ireland who has held discussions with a number of contractors here to understand the challenges that contractors face in managing their data.
There is a range of potentially vulnerable devices within the community pharmacy setting including PMR systems (which may be supported to varying levels by the supplier), and extending to routers, laptops, mobile phones and printers.
The following guidance has been issued by the police detailing five key steps that can be taken to improve cyber security in Community Pharmacy. The step-by-step packages in the guidance cover the areas detailed below and further information can be accessed by clicking on the topic headline in the guidance:
- Backing up your data.
- Protecting your organisation from malware.
- Keeping your smartphones (and computer tablets) safe.
- Using passwords to protect your data.
- Avoiding phishing attacks.
ACTION
Contractors are advised to:
- Read the guidance in the link above and ensure that they are taking all necessary precautions to protect business data; and
- Use the links on the CPNI website to keep up to date with the current threats.
Contractors are reminded that the storage and back up of patient sensitive data and any amendments to your systems should be carried out in line with advice from your PMR system provider and in line with Data Protection legislation.
CPNI and police cyber security colleagues will continue to support you in these matters.
Kind regards – Mike
SENT ON BEHALF OF PROF. MIKE MAWHINNEY Head of Regulatory Affairs
