Cyber Essentials for Care Homes and Care Providers

Why the care sector is targeted

• Care records combine health, medication, financial and next-of-kin data.
• Electronic care planning apps are used on shared tablets and staff phones.
• Staff turnover is high, so account management is harder to keep tidy.
• IT is often outsourced to a small local provider with limited documentation.
• Downtime has an immediate operational and safety impact, which makes ransomware pressure effective.

What commissioners and the NHS expect

Local authority and NHS contracts increasingly ask for Cyber Essentials, and some ask for Cyber Essentials Plus where you hold larger volumes of patient identifiable data or connect into NHS systems. Cyber Essentials is separate from the DSP Toolkit but evidences its technical requirements – see NHS DSPT supplier requirements.

Scoping a care provider

• Office and manager devices, plus the care planning system you administer.
• Shared tablets or handsets in the home, or carers' devices in domiciliary care.
• Cloud email and storage, including any mailbox receiving GP or hospital correspondence.
• Rostering, payroll and medication administration platforms your staff administer.
• The site network and Wi-Fi, keeping resident and guest Wi-Fi separated from care systems.

The three fixes that make the biggest difference

1. Individual accounts and MFA. Shared logins on communal tablets are common and must be replaced with named accounts.
2. Supported devices. Older tablets that no longer receive updates need replacing – the cheapest and most effective single change.
3. A reliable leaver process. With high turnover, prompt removal of accounts must be evidenced.

Cost, timescale and support

• £320 + VAT, priced by organisation size, with £25,000 cyber insurance for eligible UK organisations.
• 24 to 48 hours when prepared; two to four weeks where tablets or MFA need attention.
• If your IT is outsourced, we work directly with your provider so you are not stuck relaying technical questions.

If your organisation also needs to evidence governance, risk and business continuity to commissioners, look at IASME Cyber Assurance.