Policy for cryptography in healthcare — a view from the NHS

Abstract

Effective security arrangements, which both protect and assure those information assets of healthcare providers, doctors and patients, are fundamental requirements in a modern electronic healthcare culture. At the heart of healthcare information systems in future will be those infrastructure components and services, which underpin the principles of confidentiality, integrity and availability. Before embarking upon any major implementation of cryptographic support services, there are a number of critical policy issues, which must first be considered and addressed. To address these successfully will maximise the potential values of these services and facilities to their users on a broad front. A primary consideration for all information security projects, is the need to establish clear scope and objectives for the security services to be implemented. When considering the policy, scope and design implications of a large scale cryptography programme, a number of external issues also need to be considered not least of which are the legal liabilities, implications and obligations of the country or countries where the system(s) will operate. Where such legislation exists, regulatory arrangements may potentially influence how secure information sharing across international healthcare boundaries can be achieved.