Skip to content
01482 586 550
Remote support
Selectgroup

Care providers

IT and security for care providers

Care providers hold some of the most sensitive personal data there is, usually with no IT person, often across several sites, and with staff who are rarely sitting at a desk.

Care providers are an unusual IT customer. The data is as sensitive as any bank’s, the budget is not, and the people using the systems are busy doing something far more important than logging in.

That means the right answer is almost never the most sophisticated one. It is individual logins instead of a shared tablet. Encryption switched on. Leavers removed the day they go. Training short enough that somebody can do it between shifts.

Those are not impressive things to sell. They are the things that decide whether a lost phone is a shrug or a report to the ICO.

What we see

What this sector is up against

  • The data is as sensitive as it gets

    Care records are special category data under UK GDPR. A breach is not an inconvenience, it is a notifiable incident involving people who cannot easily protect themselves.

  • Staff turnover and shared logins

    High turnover plus shift work plus a tablet at the nurses' station is how shared logins happen. It is understandable and it is the single biggest thing we fix.

  • CQC expects you to evidence it

    Inspectors ask how records are kept secure and who has access to what. Being able to show it is a different thing from doing it.

  • Nobody is at a desk

    Care is delivered in rooms and in people's homes, not in an office. Systems that assume a desktop do not survive contact with the work.

What we do about it

In the order it usually matters

  1. 1

    Get every member of staff their own login

    No shared accounts, with leavers removed the day they leave. It sounds basic and it is the control that matters most here, because without it you cannot show who accessed what.

  2. 2

    Encrypt the devices that leave the building

    Phones and tablets encrypted and remotely wipeable, so a device left on a bus is an inconvenience rather than a reportable breach.

  3. 3

    Evidence you can hand an inspector

    Written policies, signed by staff, plus access records. The work is only half of it. Being able to prove it is the other half.

  4. 4

    Training that fits a shift pattern

    Short monthly modules people can do on a phone, not a half-day workshop nobody can be released for.

Care providers: common questions

Our staff share a login on the tablet. How bad is that?

It is the most common thing we find and the most worth fixing. Without individual logins you cannot show who accessed a record, which matters both for UK GDPR and for anything CQC asks. It is usually a quick fix, and it removes a whole category of problem.

What happens if a carer loses their phone?

If the device is encrypted and enrolled, you wipe it remotely and it is an inconvenience. If it is not, you are potentially making a report to the ICO. That difference is a setting, and it costs nothing to turn on.

Do you work with our care management system?

We support the IT around it: the devices, the accounts, the network and the backups. We are not the supplier of your care records system, but we are usually the ones who get it working properly on the devices your staff actually use.

Is Cyber Essentials worth it for a care provider?

Often, yes. It is a sensible baseline whoever you are, and it is increasingly asked for by local authorities and NHS bodies when you tender. It also covers most of the technical measures UK GDPR expects.

Start somewhere

Find out where you stand

Want a straight answer about your IT?

Tell us what is not working. We will tell you what we would do about it, with no sales pitch and no obligation.

Book a free IT review Call 01482 586 550