CfH condemns smartcard sharing

Tags: CfH GPs Security

24 Nov 2008

One in six GPs claim that NHS staff in their area have shared smartcards, according to a survey by doctors’ magazine Pulse.

The poll of more than 300 GPs found that one in six family doctors said they were aware of NHS staff sharing smartcards in their area, and one in 20 GPs admitted they sharing their own smartcard.

Reasons given included the time taken to log-on to systems or to access data at multiple terminals, and losing cards or leaving them at home.

A spokesperson for NHS Conecting for Health said the sharing of smarcards was unacecceptable and a serious discplinary offence.

“The smartcard only takes seconds to authenticate the user, not much longer than conventional logging on but to a much higher security standard," the spokesperson told EHI Primary Care. "Any delays are likely to be due to the start up time of the local application being used.

“GPs could also help themselves by making sure their reception and administration staff have enough PCs so they don't need to share, particularly where their staff should not be accessing patients' clinical data.”

Last month, EHI Primary Care revealed that position-based access control was being introduced for National Programme for IT in the NHS applications to reduce administration costs and deliver a more consistent allocation of access rights, while also eliminating the development of workarounds.

CfH has also issued guidance to users of the NHS secure network on the use of temporary smartcards when staff lose, forget or break their cards or need to provide services in a location or role for which they do not have an appropriate access profile.

It said the latter situation should be solved by the introduction of position based access control.

This week, CfH told EHI Primary Care: “All organisations have guidance on how to set up temporary access for people such as locums or those who leave their smartcard at home - so there is definitely no need and it's not acceptable to share smartcards.”

Fiona Barr

Reader's Comments

GPs not in control - and lack space!

maryhawking@tigers.demon.co.uk

24 Nov 08 17:11

“GPs could also help themselves by making sure their reception and administration staff have enough PCs so they don't need to share"

CfH, FYI, since 2003 PCTs have been responsible for supplying hardware as well as software to GP practices. Should this message be directed at PCTs rather than GPs? Also, in most GP surgeries, there would not be enough space to have one PC per user in reception, and probably not in admin either.

Hm. Could I invite anyone from CfH who does not understand the problem to visit my surgery in Dunstable? I would be happy to explain some of the practical problems involved in this solution...

User swap time

25 Nov 08 11:11

On my GP clinical system, a change of user without smart cards takes 20 seconds . (Out of appointment system, switch user and back into appointment system)

With smart cards it takes 55 seconds to perform the same swap.

We don't share cards but I can understand the temptation to do so.

Re: User swap time

26 Nov 08 11:11

This cannot be done in the timescale that you state. According to Information Governance policies, the user should log out of their Windows profile as well.

I refuse to discuss whether all your staff have individual Windows accounts ;-)

As in eatery pubs

26 Nov 08 13:11

You see the staff swipe their cards in as they use the till. Up pops their session. This would mean in the background there are multiple sessions can can be called up in a flash. But I very much doubt the liceces are in place to allow for that!

Clearly in surgery reception with sometimes more staff than desktops, and all multitasking, one should be able to have a pub type swipe in system. The chip and pin is less easy to swipe This should have been thought of from the start. It was pointed out the problems and that shared cards would HAVE to be used, but of course GP surgeries were the last place they thought of.

Stating the 'bleepin' obvious

26 Nov 08 15:11

Tell us something we don't already know and did even before the system went live.

I'm surprised the receptionists are not mentioned in the report. imagine one front desk, one PC four receptionists, rotating.

It doesn't take a phD to figure out what happens, and as for extra PC's; I fell on the floor laughing - its hard enough to keep the ageing fleet of current PC's going -where's all this promised cash coming from?

Sure NPfIT promised all the medics shiny new PC's to use C&B; but in reality that never happened. Evidence-based on an entire home counties patch in the real world, where I still see kit that can only display 800x600 pixels. Nuff said.

Make it easy to make it work

26 Nov 08 21:11

People, like water, will always find the path of least resistance. If doing it right makes it easier, they will do it. Make it a time consuming, unreliable, frustrating, unworkable lashup is not really the way to carry the vote of the ordinary harassed NHS worker. Perhaps if CfH dipped their toes in the real world occasionally they would start to unblock the flow rather than building ever bigger dams. How difficult is it?

Top down approach

roseneath@ntlworld.com

27 Nov 08 09:11

Yet again we have the bureaucratic approach of devising a system and expecting the front-end users to adapt to suit it even though this may be to the detriment of the task they are doing.

Why don't CfH look at how staff work and devise systems that will fit in with that. They can moan as much as they like, but if systems are not designed to fit the way staff work, they will be circumvented.

Top down approach

27 Nov 08 13:11

I agree with the previous comment. The cart is too far ahead of the horse. The purpose of CfH is to support clinical care, not the other way round. Therefore, by condemning smart-card sharing, CfH are implicitly admitting that the smart-card system isn't good enough to stop people needing to share smart-cards. And that means that it's just not good enough to support clinical care. And that means they should take it away and work on it until it is good enough. And only then should they ask us to use it.