1. Secure File Transfer (SFT) – National Rollout Introduction January 2009

2. 2 Introduction Purpose To introduce the national rollout of Secure File Transfer system (SFT) Target Audience IG Managers IT/ICT Security Managers PACS system users

3. 3 Contents What is the SFT? The SFT so far What does the SFT target? Permitted uses Prerequisites for use Local actions Assistance from NHS CFH Future improvements

4. 4 What is the SFT? The SFT is a web service designed to allow the secure transfer of data between NHS users N3 SFT   Transfers over N3 only National system in Exeter

5. 5 The SFT so far Successful pilot executed during early 2008 Pilot system extended into production Phased Introduction across NHS Organisation National Coverage scheduled for completion by January 2009

6. 6 What does the SFT target? The SFT is designed to replace physical media transfers CD or DVD Memory sticks, USB pen drives Printouts These are often sent by courier or hand delivered, often at great expense & effort Worse still, these regularly go missing in transit leading to Data Protection breaches, SUI & public scandal

7. 7 Permitted uses Transfer of personal or other sensitive data Not for routine sharing of PACS data Regular but very small (<100MB) Large but one-off, ad-hoc or occasional Not a “blue light” service -Available as an option in critical situations The SFT is not intended for a high volume of regular, large, data transfers. NHS organisation must be one party to the transfer

8. 8 Prerequisites for use Senders & recipients must currently Have a NHSmail account Have access to N3

9. 9 When to use the SFT Send your data using the Secure File Transfer (SFT) Data larger than 20MB in size? You can use NHSmail to send the data You both have NHSmail ? Use your existing procedures to send the data securely Data smaller than 1GB in size? You both have access to N3? No Yes https://nww.sft.nhs.uk The SFT is not intended as a “blue light” service for critically important data transfers You need to send data securely to someone Before you might have sent CDs, DVDs, memory sticks, USB stick/pen drives, emails or printouts Is this a one-off or irregular transfer? Yes No Irregular or Routine? The SFT is not intended for routine transfers of large amounts of data e.g. PACS studies. This data can still be sent however if it is only sent occasionally or is small (up to around 100MB). If you are unsure email cfh.infosecteam@nhs.net for guidance

10. 10 Comparing SFT & NHSmail SFTNHSmail Data sizes suitable for transfer Up to 1GBUp to 20MB Can already encrypted or password protected zip files be sent? YesUsually not Number of recipients per transfer Up to 10Essentially unlimited Potential recipients for secure transfers Anyone on NHSmail with N3 access Anyone on NHSmail or other trusted domains Files retained in system Deleted after 3 days (sender can specify less) Indefinitely

11. 11 Key SFT Features FeatureValue Maximum data sizeUp to 1GB Potential recipients for secure transfersAnyone on NHSmail with N3 access Password sending Automatically via mobile text Manually by sender Download notificationsOptional – selectable by sender Files stored on server forMaximum of three days Number of recipients per transferUp to 10

12. 12 Rollout Strategy Stage I Rollout to three regions by end 2008 -East Midlands -North East -York & Humber Stage II Rollout to rest of England during January 2009

13. 13 Local Actions Awareness of SFT service is cascaded within your region Ensure users have NHSmail accounts Review & update policies, data sharing agreements, best practice guides Localise user communications, awareness material, user guides IG/IT stakeholders familiarise themselves with service before roll-out Brief local IT support desks Use the service !

14. 14 Assistance from NHS CFH NHS CFH have prepared material to assist with the introduction of SFT User guides This presentation Feedback can be provided using the following mailbox cfh.sftfeedback@nhs.net cfh.sftfeedback@nhs.net Service performance? What do you use SFT for now? What improvements to SFT do you suggest?

15. 15 Secure File Transfer Send your data securely in three easy steps Register once with the Secure File Transfer (SFT) service at https://nww.sft.nhs.uk Upload your data. The SFT will automatically advise your recipients. You can specify up to 10 people per transfer Send the password you used to your recipients securely. You could use a phone call or send it using NHSmail

16. 16 Secure File Transfer Registration Register to send your data securely Enter your NHSmail address The SFT will email your PIN to you

17. 17 Sending files with the SFT Sending a file at https://nww.sft.nhs.uk Accept the terms & conditions, and click on the “Check steps” button. Once checked, you will be able to upload your file Enter the NHSmail addresses of up to ten people Enter mobile numbers to send them the password as a text message Pick a password. If you do not give mobile numbers, you will have to send it to the recipients Select this if you want to know when the file is downloaded The SFT includes the comment in its emails to the recipients You can ask the SFT to delete the file sooner if you wish

18. 18 Sending files with the SFT (2) Sending a file at https://nww.sft.nhs.uk Remember the recipients need the password you used You get this when your file has been uploaded OK Select your file. You can group multiple files together with WinZip or similar

19. 19 Downloading files from the SFT The SFT tells you about files by email The email tells you what file is being sent to you. Click on the link to get it You only have a limited time to download the file Log into the SFT with your NHSmail address & PIN you received at registration Enter the password you were given by the sender & download the file

20. 20 Forgotten your PIN? Resetting your SFT PIN You can use your new PIN immediately Enter your NHSmail address. The SFT will send you a new PIN Use this link on the main SFT screen

21. 21 Any Questions?