| |
A Huge Security Challenge for Health Trust
With 60 years of protecting the health of citizens across the country, the NHS has seen many challenges, not least in the technology area, where the ability to share sensitive, private, personally identifiable data (PID) such as medical notes, x-rays and other patent data has become commonplace, opening up the need to protect this sensitive information wherever it travels.
David Nicholson, NHS Chief Executive, has directed that there should be no transfers of unencrypted personally identifiable data held in electronic format across the NHS. This default position ensures that patient and staff personal data are protected. Any data stored on a PC or other removable device in a non-secure area or on a portable device such as a laptop, PDA or mobile phone should also be encrypted. This is also now a requirement across all public sector organizations set by the Cabinet Secretary.
Protecting data comprehensively means protecting data in databases and applications, protecting files and documents and protecting information travelling via email. Voltage Security and its partners provide integrated solutions that address these areas.
Voltage SecureMail – Easy to use encryption
Voltage SecureMail is the easiest to use email encryption solution – currently in use within multiple NHS Trusts and teaching hospitals as well as in large public and private healthcare systems around the world.
Voltage SecureMail is easy to implement and provides multiple levels of integration with your environment. You can choose to implement it as a service via the Voltage Security Network, as an on premise solution – which may be fully integrated with DLP solutions such as Proofpoint, or as a hybrid – where full integration with DLP solutions is available combined with access to the service to make configuration and ongoing operations extremely straightforward.
Voltage SecureMail in fully compatible with older email encryption approaches such as OpenPGP and S/MIME.
Voltage SecureMail is now used in the world’s largest email encryption implementation of over 600,000 internal users and can be deployed at a fraction of the cost of other solutions.
Challenge Summary
- Complete protection
of sensitive data, such as patient information
- Minimising
the risk of data loss or misuse from outside
of the network
- Minimising
the risk of data loss or misuse from within
the network
- Protection of individual
and organisational reputation
- Achieve policy
compliance
- Protection from
litigation
Benefit Summary
- Ability to define policies and check encrypted content
- Adhoc ability to send encrypted email to non NHSmail users
- Integration capabilities for mobile phone and Blackberry users
- Secure archiving capabilities to achieve current legal requirements
- Supports common email standards such as IBE, OpenPGP and S/MIME
- Available as on premise, SaaS and hybrid solution for easy integration
| Frequently Asked Questions |
NHSmail |
Voltage |
| Can Patient Identifiable
Data be sent via the system, in an encrypted
format, to non NHSmail users? |
NO |
YES |
| Can
a user use their own email address and email
client? |
NO
A
separate email account has to be set to use
so multiple account to manage |
YES |
| Ad‐hoc encryption to anyone inside and outside of the NHS |
NO
NHS
Mail users can only send messages to other
NHS Mail users |
YES |
| Complete message control by only sender and recipient |
NO |
YES |
| Enforce Encryption of communication between NHS Mail users and external users |
NO
Not
without setting external party up with an NHS
Mail account |
YES |
| On‐demand key generation for encryption |
NO |
YES |
| Can users force encryption at the desktop |
NO |
YES |
| Are
messages stored anywhere outside of users Mail
box? |
NO |
YES |
| Can system integrate with internal Archiving system |
NO |
YES |
| Enforce policy at client to encrypt |
NO |
YES |
| Enforce policy at the gateway to encrypt based on potential content |
NO |
YES |
| Can external parties authenticate and read email from anywhere |
NO |
YES |
| Force encryption if a message has been previous encrypted |
NO |
YES |
| Support for AES 256, 3DES, DSA, SSL, PKCS#7 (S/MIME) |
NO
AES
128 only |
YES |
| Support for Common Criteria Certification |
NO |
YES
EAL‐2
certification |
| Support for FIPS 140‐2 certification |
NO |
YES
Part
of toolkit |
| Allow compliance checks to be carried out on email for AV, Spam, content, etc (both inbound and outbound) |
NO |
YES |
| Allow use of group keys for encryption |
NO |
YES |
|
|
|
