How we keep data safe

The NHS is moving towards modern, cloud-based systems because they are more reliable, faster, and allow different parts of the health and care system to share information safely when needed. This means your care can be better coordinated; reducing delays and improving services.

We follow national NHS security requirements, including:

• Zero Trust Architecture – a modern approach that assumes nothing is safe by default and checks every access request.
• NHS Data Security and Protection Toolkit (DSPT) – the NHS benchmark for data security.
• National Cyber Security Centre (NCSC) guidance – the UK’s gold standard for cyber protection.

Your data is scrambled using advanced encryption so it can’t be read by anyone who shouldn’t see it:

• In transit – when your data moves between systems, it’s protected using secure connections.
• At rest – when stored in the cloud, it’s encrypted using AES-256, the same level of security used by banks.

Only the right people can see your data. We use:

• hardware security keys, and for the most sensitive accounts we use physical security tokens.
• role-based access, which means staff only see what they need for their job.
• Multi-Factor Authentication (MFA). Even if a password is compromised, extra checks keep accounts safe.

Please visit our dedicated page to view which organisations have access to information via the Data Hub.

Your personal information (like your name and address) is stored separately from your health data. This means:

• If one part of the system was ever compromised, it wouldn’t reveal your full record.
• We also use pseudonymisation (replacing personal information with random code) and anonymisation wherever possible to ensure that it’s not possible to identify you from the data.

We continue to monitor and test our security systems using:

• automatic updates – security patches are applied quickly to keep systems safe.
• 24/7 monitoring – our systems are constantly checked for unusual activity.
• automated and ad-hoc regular vulnerability scans and penetration tests, including by independent experts.

Our cloud environment is built with multiple layers of defence:

• No public endpoints – services are hidden from the outside world unless absolutely necessary.
• Firewalls and network segregation – to block unauthorised access
• Private connections – most data flows through secure NHS networks (HSCN), not the public internet

We know that in the past, NHS data-sharing projects have raised concerns about privacy and transparency. We’ve learned from those experiences. That’s why:

• we are open about how your data is used and give you clear ways to find out more.
• we only share data when it’s necessary for your care or when the law allows it.
• every use of data is reviewed and approved through strict governance processes.

If something does go wrong, we have a clear process to respond quickly, investigate, and learn from any incident.