A series of Freedom of Information (FOI) requests submitted by Redscan to NHS trusts in the UK have found that, on average, trusts have just one member of staff with professional security credentials per 2,628 employees.

Some large trusts (with up to 16,000 total employees) have no formally qualified security professionals whatsoever.

Expenditure on cybersecurity training over the last 12 months ranged from less than £250 to nearly £80,000 per trust, with no apparent link between the size of trust and money spent.

A significant proportion of trusts have spent nothing on specialist cybersecurity or GDPR training for staff, requiring only that all their employees complete free Information Governance (IG) training provided by NHS Digital.

“These findings shine a light on the cyber security failings of the NHS, which is struggling to implement a cohesive security strategy under difficult circumstances,” said Redscan director of cybersecurity, Mark Nicholls. “Individual trusts are lacking in-house cybersecurity talent and many are falling short of training targets; meanwhile investment in security and data protection training is patchy at best. The extent of discrepancies is alarming, as some NHS organisations are far better resourced, funded and trained than others.

“WannaCry severely disrupted critical healthcare services across the country in 2017, costing the NHS an estimated £92m. The Government has subsequently increased funding for cybersecurity in the NHS by £150m, while introducing a number of new security policies. There are certainly green shoots of progress, but this doesn’t mask the fact that the NHS is under tremendous financial pressure, is struggling to recruit the skills it needs and must continue to refine its cybersecurity strategy across the UK.”

A breakdown of key stats is as follows:

Cybersecurity qualifications – On average, NHS trusts employ one qualified security professional per 2,582 employees. Nearly a quarter of trusts have no employees with security qualifications (24 out of 108 trusts), despite some employing as many as 16,000 full and part-time personnel. Several NHS organisations that employee no qualified cybersecurity professionals reported having staff members in the process of obtaining relevant security qualifications – which Redscan says is perhaps an indication of the difficulties hiring trained professionals.

Money spent – Trusts spent an average of £5,356 on data security training, although Redscan says it’s worth noting that a significant proportion conducted such training in-house at no cost or only used free NHS Digital training tools. GDPR-related training was the most common course type procured for staff. Other training programmes cited included: BCS Practitioner Certificate in Data Protection, Senior Information Risk Owner and ISO27001 Practitioner.

Spending on training varied significantly between trusts, from £238 to £78,000. However, the size of each trust was not always a determining factor. For example, of mid-sized trusts with 3000-4000 employees, training expenditure ranged from £500 to £33,000.

NHS Digital training targets – NHS Digital’s mandatory information governance training requirements state that 95% of all staff must pass IG training every 12 months. The FOI responses revealed that, currently, only 12% of trusts had met the >95% training target and the majority of trusts had trained between 80% and 95% of their staff. A quarter of trusts had trained less than 80% of their staff (some reporting that less than 50% had been trained).

A separate FOI request was also sent to NHS Digital, which declined to provide data on how many trusts had met its Information Governance targets, or how many IT staff and board members had completed dedicated training. NHS Digital did however reveal that 139 Trusts had now undertaken a Data Security Onsite Assessment ⁽³⁾. This is a marked improvement on the figure released in July 2018 (60), showing that NHS trusts are taking these assessments more seriously and that measures are being implemented at trust level.