Patient records are under attack. Hackers want them. Thieves want them. Even accidental mistakes can expose them.
But keeping records safe is not complicated. You do not need a degree in cybersecurity. You just need good habits.
This blog gives you 15 practical tips. Paper records. Digital records. Phone records. All covered. Pick 3 to start today.
Digital Records Safety (10 Tips)
Tip 1: Use Strong Passwords
Weak passwords are easy to guess.
-
Bad: password123, letmein, your name
-
Good: BlueTiger$Jump7, Coffee&Rain44, SummerNights#9
Make passwords at least 12 characters. Use a mix of letters, numbers, and symbols. Do not use the same password everywhere.
Tip 2: Turn On Two-Factor Authentication (2FA)
2FA asks for a second code after your password. Usually sent to your phone.
Without 2FA: Hacker steals password → They get in.
With 2FA: Hacker steals password → They still cannot get in without your phone.
Turn on 2FA for every work system that offers it.
Tip 3: Lock Your Screen When You Walk Away
You leave your desk. Your computer is unlocked. Anyone can sit down and see patient records.
Make locking automatic. Set screen to lock after 2 minutes of no activity. Also learn the manual lock shortcut: Windows key + L or Control + Command + Q.
Tip 4: Encrypt Everything
Encryption scrambles data. Only someone with the key can read it.
-
Laptop hard drives should be encrypted
-
USB sticks should be encrypted
-
Emails with patient data should be encrypted
-
Backups should be encrypted
Ask your IT team: "Is this encrypted?" If not, do not use it.
Tip 5: Be Careful with USB Sticks
USB sticks are dangerous. They are small. They get lost. They get stolen. They carry viruses.
Better option: Use secure file sharing instead of USB. If you must use USB, use an encrypted one. Never leave it in a computer overnight.
Tip 6: Update Software Promptly
Those annoying update reminders? Do not ignore them.
Updates fix security holes. Hackers know about old holes. Every day you delay is a day you are vulnerable.
Set updates to happen automatically. Or install within 48 hours.
Tip 7: Use Approved Cloud Services Only
Not all cloud services are safe for patient data.
-
Safe: Your organisation's approved system, NHSmail, Office 365 for Healthcare
-
Not safe: Personal Google Drive, Dropbox, iCloud
If you are not sure, ask. Do not assume.
Tip 8: Log Out of Shared Computers
Hospitals and clinics have shared computers. You log in. You walk away. The next person uses your login.
Always log out completely. Do not just close the browser. Click "log out" or "sign out".
Tip 9: Back Up Data Securely
Backups protect against data loss. But backups must be protected too.
-
Backups should be encrypted
-
Backups should be stored separately from main data
-
Backup access should be limited
Your IT team handles this. Ask them about their backup security.
Tip 10: Watch for Phishing
Fake emails try to steal your password. One click can expose thousands of records.
Never click links in unexpected emails. Never download attachments you did not ask for. When in doubt, ask IT.
Paper Records Safety (3 Tips)
Tip 11: Lock Paper Files
Paper records are easy to steal. Someone just picks them up and walks out.
-
Keep paper files in locked cabinets
-
Lock the cabinet every time, even for 5 minutes
-
Keep the key with you, not in the lock
Tip 12: Clear Your Desk at Night
Every night before you leave:
-
Put all patient files in locked cabinets
-
Remove sticky notes with patient information
-
Close notebooks and put them away
-
Turn papers face down
A clean desk is a safe desk.
Tip 13: Shred, Do Not Bin
When you throw away patient information, shred it first.
-
Use a cross-cut shredder (not strip-cut)
-
Shred everything with patient identifiers
-
Do not put patient data in normal rubbish
People go through rubbish bins. Do not make it easy for them.
Phone and Mobile Safety (2 Tips)
Tip 14: Secure Your Work Phone
Work phones contain patient data. Treat them like computers.
-
Set a strong passcode (not 0000 or 1234)
-
Enable remote wipe (so IT can delete data if lost)
-
Report lost phones immediately
-
Do not leave phones in cars
Tip 15: Be Careful What You Text
Text messages are not secure. Do not send patient data by text.
-
No patient names in texts
-
No medical information in texts
-
No appointment details in texts
Use secure messaging apps approved by your organisation. If you are not sure, do not text.
Quick Reference: The 3 Golden Rules
If you remember nothing else, remember these 3:
Golden Rule 1: Lock everything
Computer. Cabinet. Phone. If it has patient data, lock it.
Golden Rule 2: Share only what is needed
Give the minimum information. Only to people who need it.
Golden Rule 3: Report problems fast
Made a mistake? Lost something? Tell someone immediately.
What About Working from Home?
More healthcare workers work from home now. Safety still matters.
Home office safety checklist:
-
Computer screen is not visible from windows
-
Family members do not have access to your work device
-
Paper records are not left on the kitchen table
-
You use a VPN to connect to work systems
-
You lock your computer when you get coffee
-
You shred paper notes after use
Working from home is not an excuse for unsafe practices.
Learn More in Our Course
Our Information Governance in Healthcare CPD course includes video demonstrations of all 15 tips. You get printable checklists and a CPD certificate.
Frequently Asked Questions
Q: How often should I change my password?
Most organisations require every 60-90 days. Follow your organisation's policy. Do not reuse old passwords.
Q: Is it safe to use public Wi-Fi for work?
No. Public Wi-Fi (cafés, airports, hotels) is not secure. Use a VPN or mobile hotspot instead. Better yet, do not work on public Wi-Fi.
Q: What if I lose my work phone?
Report it to IT immediately. They can remotely wipe patient data from the phone. Then change all your passwords.
Q: Can I take photos of patient records for my notes?
No. Never. Photos on personal phones are not secure. If you need notes, write them on approved paper or type into the secure system.
Q: What is the biggest risk to patient records?
People. Not hackers. Not technology. People making mistakes. That is why training is so important.