Secure File Transfer (SFT) – National RolloutIntroduction

January 2009

2

Introduction

• Purpose• To introduce the national rollout of Secure

File Transfer system (SFT)• Target Audience

• IG Managers• IT/ICT Security Managers• PACS system users

3

Contents

• What is the SFT?• The SFT so far

• What does the SFT target?• Permitted uses

• Prerequisites for use• Local actions

• Assistance from NHS CFH• Future improvements

4

What is the SFT?

• The SFT is a web service designed to allow the secure transfer of data between NHS users

N3SFT

Transfers over N3

only

National system in

Exeter

5

The SFT so far

• Successful pilot executed during early 2008• Pilot system extended into production• Phased Introduction across NHS Organisation• National Coverage scheduled for completion

by January 2009

6

What does the SFT target?

• The SFT is designed to replace physical media transfers• CD or DVD• Memory sticks, USB pen drives• Printouts

• These are often sent by courier or hand delivered, often at great expense & effort

Worse still, these regularly go missing in transit leading to Data Protection breaches, SUI & public scandal

7

Permitted uses

• Transfer of personal or other sensitive data• Not for routine sharing of PACS data• Regular but very small (<100MB)• Large but one-off, ad-hoc or occasional• Not a “blue light” service

- Available as an option in critical situations

• The SFT is not intended for a high volume of regular, large, data transfers.

NHS organisation must be one party to the transfer

8

Prerequisites for use

• Senders & recipients must currently• Have a NHSmail account• Have access to N3

9

When to use the SFT

Send your data using the Secure File Transfer (SFT)

Data larger than

20MB in size?

You can use NHSmail to send

the data

You both have

NHSmail?

Use your existing procedures to send the data securely

Data smaller

than 1GB in size?

You both have

access to N3?

No

No

No

No

Yes

Yes

Yes

Yes

https://nww.sft.nhs.uk

The SFT is not intended as a “blue light” service for critically important data

transfers

You need to send data

securely to someone

Before you might have sent CDs, DVDs, memory

sticks, USB stick/pen drives,

emails or printouts

Is this a one-off

or irregular transfer?

Yes

No

Irregular or Routine?

The SFT is not intended for routine transfers of large amounts of data e.g. PACS studies.This data can still be sent however if it is only sent occasionally or is small (up to around 100MB).If you are unsure email cfh.infosecteam@nhs.net for guidance

10

Comparing SFT & NHSmail

SFT NHSmail

Data sizes suitable for transfer

Up to 1GB Up to 20MB

Can already encrypted or password protected zip files

be sent?Yes Usually not

Number of recipients per transfer

Up to 10 Essentially unlimited

Potential recipients for secure transfers

Anyone on NHSmail with N3 access

Anyone on NHSmail or other trusted domains

Files retained in systemDeleted after 3 days

(sender can specify less)Indefinitely

11

Key SFT Features

Feature Value

Maximum data size Up to 1GB

Potential recipients for secure transfers Anyone on NHSmail with N3 access

Password sendingAutomatically via mobile text

Manually by sender

Download notifications Optional – selectable by sender

Files stored on server for Maximum of three days

Number of recipients per transfer Up to 10

12

Rollout Strategy

• Stage I• Rollout to three regions by end 2008

- East Midlands- North East- York & Humber

• Stage II• Rollout to rest of England during January

2009

13

Local Actions

• Awareness of SFT service is cascaded within your region

• Ensure users have NHSmail accounts• Review & update policies, data sharing agreements,

best practice guides• Localise user communications, awareness material,

user guides• IG/IT stakeholders familiarise themselves with service

before roll-out• Brief local IT support desks

• Use the service !

14

Assistance from NHS CFH

• NHS CFH have prepared material to assist with the introduction of SFT • User guides• This presentation

• Feedback can be provided using the following mailbox cfh.sftfeedback@nhs.net • Service performance?• What do you use SFT for now?• What improvements to SFT do you suggest?

15

Secure File Transfer

Send your data securely in three easy steps

Register once with the Secure File Transfer (SFT) service at https://nww.sft.nhs.uk

Upload your data. The SFT will automatically advise your recipients. You can specify up to 10 people per transfer

Send the password you used to your recipients securely. You could use a phone call or send it using NHSmail

16

Secure File Transfer Registration

Register to send your data securely

Enter your NHSmail address

Enter your NHSmail address

The SFT will email your PIN to you

The SFT will email your PIN to you

17

Sending files with the SFT

Sending a file at https://nww.sft.nhs.uk

Accept the terms & conditions, and click on the “Check steps” button. Once checked, you will be able to

upload your file

Accept the terms & conditions, and click on the “Check steps” button. Once checked, you will be able to

upload your file

Enter the NHSmail addresses of up to

ten people

Enter the NHSmail addresses of up to

ten people

Enter mobile numbers to send

them the password as a text message

Enter mobile numbers to send

them the password as a text message

Pick a password. If you do not give

mobile numbers, you will have to send it to

the recipients

Pick a password. If you do not give

mobile numbers, you will have to send it to

the recipients

Select this if you want to know when

the file is downloaded

Select this if you want to know when

the file is downloaded

The SFT includes the comment in its emails to the

recipients

The SFT includes the comment in its emails to the

recipients

You can ask the SFT to delete the file

sooner if you wish

You can ask the SFT to delete the file

sooner if you wish

18

Sending files with the SFT (2)

Sending a file at https://nww.sft.nhs.uk

Remember the recipients need the password you used

Remember the recipients need the password you used

You get this when your file has been

uploaded OK

You get this when your file has been

uploaded OK

Select your file. You can group multiple files together with WinZip or similar

Select your file. You can group multiple files together with WinZip or similar

19

Downloading files from the SFT

The SFT tells you about files by email

The email tells you what file is being

sent to you. Click on the link to get it

The email tells you what file is being

sent to you. Click on the link to get it

You only have a limited time to

download the file

You only have a limited time to

download the file

Log into the SFT with your NHSmail address & PIN you

received at registration

Log into the SFT with your NHSmail address & PIN you

received at registration

Enter the password you were given by

the sender & download the file

Enter the password you were given by

the sender & download the file

20

Forgotten your PIN?

Resetting your SFT PIN

You can use your new PIN immediately

You can use your new PIN immediately

Enter your NHSmail address. The SFT

will send you a new PIN

Enter your NHSmail address. The SFT

will send you a new PIN

Use this link on the main SFT screen

Use this link on the main SFT screen

21

Any Questions?