Re:Health Service laptop goes missing with over eight millio...
by arctangent on Wednesday June 15, 2011 @12:14PM
(#2657711)
I work for a very-well-known-and-frequently-mentioned-in-the-press organisation in the UK healthcare sector and I can assure you that everyone here has encrypted laptops.
In many ways it's a pain in the ass, because almost exactly none of us will ever use Patient Identifiable Data but we have to put up with machines that run much slower than they should due to the on-the-fly encryption. We're also physically incapable of burning CDs/DVDs or using USB sticks etc.
OK so that isn't a perfect solution (the user could keep their passwords on a bit of paper clearly marked "passwords" in the laptop's bag, if the user loses their passwords the data is lost to them (unless a multi-key system is used and the IT dept keeps their own key so they can reset the user's access, though that probably requires the user sending the laptop into central IT for a time), data could still be emailed out to insecure places by the user, and so on) but it is a far better situation than leaving the data unencrypted on the easily liftable device.
It really does surprise me that after the last five or more years a proper encryption regime isn't mandated on laptops holding such data.