Secure File Transfer (SFT) – National Rollout Introduction

1. Secure File Transfer (SFT) – National RolloutIntroduction January 2009

2. Introduction • Purpose • To introduce the national rollout of Secure File Transfer system (SFT) • Target Audience • IG Managers • IT/ICT Security Managers • PACS system users

3. Contents • What is the SFT? • The SFT so far • What does the SFT target? • Permitted uses • Prerequisites for use • Local actions • Assistance from NHS CFH • Future improvements

4.  N3 National system in Exeter Transfers over N3 only SFT  What is the SFT? • The SFT is a web service designed to allow the secure transfer of data between NHS users

5. The SFT so far • Successful pilot executed during early 2008 • Pilot system extended into production • Phased Introduction across NHS Organisation • National Coverage scheduled for completion by January 2009

6. What does the SFT target? • The SFT is designed to replace physical media transfers • CD or DVD • Memory sticks, USB pen drives • Printouts • These are often sent by courier or hand delivered, often at great expense & effort Worse still, these regularly go missing in transit leading to Data Protection breaches, SUI & public scandal

7. Permitted uses • Transfer of personal or other sensitive data • Not for routine sharing of PACS data • Regular but very small (<100MB) • Large but one-off, ad-hoc or occasional • Not a “blue light” service • Available as an option in critical situations • The SFT is not intended for a high volume of regular, large, data transfers. NHS organisation must be one party to the transfer

8. Prerequisites for use • Senders & recipients must currently • Have a NHSmail account • Have access to N3

9. Irregular or Routine? The SFT is not intended for routine transfers of large amounts of data e.g. PACS studies. This data can still be sent however if it is only sent occasionally or is small (up to around 100MB). If you are unsure email cfh.infosecteam@nhs.net for guidance Is this a one-off or irregular transfer? When to use the SFT Yes You both have NHSmail? Yes No You need to send data securely to someone Before you might have sent CDs, DVDs, memory sticks, USB stick/pen drives, emails or printouts You both have access to N3? Yes No Data smaller than 1GB in size? Yes No Data larger than 20MB in size? Send your data using the Secure File Transfer (SFT) Yes No https://nww.sft.nhs.uk No The SFT is not intended as a “blue light” service for critically important data transfers Use your existing procedures to send the data securely You can use NHSmail to send the data

10. Comparing SFT & NHSmail

11. Key SFT Features

12. Rollout Strategy • Stage I • Rollout to three regions by end 2008 • East Midlands • North East • York & Humber • Stage II • Rollout to rest of England during January 2009

13. Local Actions • Awareness of SFT service is cascaded within your region • Ensure users have NHSmail accounts • Review & update policies, data sharing agreements, best practice guides • Localise user communications, awareness material, user guides • IG/IT stakeholders familiarise themselves with service before roll-out • Brief local IT support desks • Use the service !

14. Assistance from NHS CFH • NHS CFH have prepared material to assist with the introduction of SFT • User guides • This presentation • Feedback can be provided using the following mailbox cfh.sftfeedback@nhs.net • Service performance? • What do you use SFT for now? • What improvements to SFT do you suggest?

15. Send your data securely in three easy steps Secure File Transfer Register once with the Secure File Transfer (SFT) service at https://nww.sft.nhs.uk Upload your data. The SFT will automatically advise your recipients. You can specify up to 10 people per transfer Send the password you used to your recipients securely. You could use a phone call or send it using NHSmail

16. Register to send your data securely Secure File Transfer Registration Enter your NHSmail address The SFT will email your PIN to you

17. Sending a file at https://nww.sft.nhs.uk Sending files with the SFT Enter the NHSmail addresses of up to ten people Enter mobile numbers to send them the password as a text message You can ask the SFT to delete the file sooner if you wish Pick a password. If you do not give mobile numbers, you will have to send it to the recipients Select this if you want to know when the file is downloaded The SFT includes the comment in its emails to the recipients Accept the terms & conditions, and click on the “Check steps” button. Once checked, you will be able to upload your file

18. Sending a file at https://nww.sft.nhs.uk Sending files with the SFT (2) Select your file. You can group multiple files together with WinZip or similar You get this when your file has been uploaded OK Remember the recipients need the password you used

19. The SFT tells you about files by email Downloading files from the SFT The email tells you what file is being sent to you. Click on the link to get it You only have a limited time to download the file Log into the SFT with your NHSmail address & PIN you received at registration Enter the password you were given by the sender & download the file

20. Resetting your SFT PIN Forgotten your PIN? Use this link on the main SFT screen Enter your NHSmail address. The SFT will send you a new PIN You can use your new PIN immediately

21. Any Questions?