Backing up of Pharmacy data

This article aims to get you to recognise the vital importance to your pharmacy and your patients of your PMR and your other business data. It guides you as to best practice with regard to how to safeguard that data and encourages regular daily backing up.

Regularly daily backing up your data makes good business sense. Even before prescription claims are made electronically, the destruction or loss of current pharmacy data could already easily:

1. compromise patient confidentiality
2. interrupt clinical services
3. risk losing clinical information or even risk missing an interaction

Lindsay McClure from PSNC says that “Pharmacies are contractually required to ensure compliance with the Data Protection Act (DPA), as well as with approved NHS procedures for information management and security. Backing up data is essential to ensure compliance with the DPA and the NHS Information (IG) requirements”.

The PSNC Information Governance (IG) Workbook issued to contractors in 2010 makes some reference to Data security and to secure data transfer methods in Appendix 6. The workbook confirms that the NHS has specific minimum technical standards for the encryption of patient data. PSNC recommend that pharmacy data is always encrypted when being transferred (which means that 3rd parties cannot read it). The UK 1998 Data Protection Act also specifies that UK data should not be transferred outside of the EEA. The Updated 2011 PSNC workbook requires pharmacists to “Map, Risk-assess and put in place mitigating controls on data transfers”. PSNC are negotiating with the DOH concerning Business Continuity Planning requirements. Perhaps one of the largest business continuity problems a pharmacy could have is not being able to access stored PMR patient data and having to start over to recreate it? It is evident that the more frequently a pharmacy backs up its data, the less data is at risk at any time, and therefore the less effort would be required to re-create it should there ever be a data loss.

Here are a few examples of what back up service/s are on offer:

Cegedim offers Pharmacy Manager and its Nexphase customers two options. The standard and no-charge option is backing up locally every day using removable media like CDs. An enhanced automatic daily back-up service: “CRxDefence” creates an encrypted on-line back-up and restore service to and from a secure UK data centre.

Rx systems Proscript & Link offers a similar service to the above called “Datasafe”: an encrypted off-site daily automatic back-up as a standard Release 2 service at all EPS sites in England and in Wales, but not yet in Scotland or N Ireland. The £20/month additional charge for this is covered by the additional funding to pharmacy for ETP. Customers without R2 of EPS have on-site backups as standard.

Positive Solutions Analyst software prompts daily back-ups. They recommend that pharmacists use Pen Drives to back up the Analyst master terminal every day and to take the back-ups off site.

As a fall-back position, in most cases, PMR software will automatically prompt or demand that a back-up is run, if one has not been taken within at most about 5 working days.

Pharmacists should talk to their PMR system provider to find out exactly back up services are currently available to them. Pharmacists should also specify the level of their back-up needs to their provider.

Should the PMR provider not currently offer the desired level of back-up service, there are also external back-up service providers who work to NHS data encryption standards such as for example www.depositit.com

Best Practice & Top Tips

A daily off-site automated and encrypted back-up of PMR and other business critical data is the gold standard for backing up PMR and business data. The main benefit of such a service, is that if pharmacy computers are ever damaged or stolen, the back-up service can fully restore the data on the replacement computer/s to the point of the most recent back-up (so a maximum of 1 days work only could only ever be lost)

Top Tips

1. Talk to your PMR provider about secure DAILY back-ups, find out what they are already offering you and can offer you and at what cost. Ask for the details of the various service options available in writing. Verify that all the critical files and folders are being backed up.
2. Decide what level of back-up service you want to have for your pharmacy - what level of risk are you comfortable with taking both for your PMR data and your business data?
3. There are potential IG issues around taking unencrypted data home or away from the pharmacy
4. Fire proof safes are used by some pharmacists in the pharmacy, to store the back-up disks or tapes or pens, although they may not also be flood proof
5. A daily encrypted back-up should be considered the absolute minimum, although as mentioned above on-site storage of the back-up may not always adequately protect the data in all circumstances.
6. You need to risk assess any changes to the way you decide to manage data in the future and remember to update your IG workbook when you make any such changes.

Richard King
Pharmacy Consulting Ltd