4 ms·

It's less shocking when you recognise that these are simply sites to tell patients when surgeries are open etc. As I said, you can say exactly the same about ot

It's less shocking when you recognise that these are simply sites to tell patients when surgeries are open etc. As I said, you can say exactly the same about other informational sites too like hospitals, universities, etc: http://www.gosh.nhs.uk/ http://www.gosh.nhs.uk/ http://www.cam.ac.uk/ http://www.cam.ac.uk/ http://nyp.org/ http://nyp.org/ http://www.highlands.state.nj.us/ http://www.highlands.state.nj.us/ It would not surprise me to find similar vulnerabilities in all of those picked at random, given the budget they are typically run on. I agree it's far from ideal and a situation they should sort out given these are hosted on .nhs.uk, particularly as we move more and more of our lives online, there need to be clear rules about which sites are secured and safer and which are less important. However, these sites do not host patient data.

Silhouette 13y ago
It's less shocking when you recognise that these are simply sites to tell patients when surgeries are open etc The question is, do patients realise that, or will they tend to assume that because a site is part of the privileged .nhs.uk hierarchy, it is properly run by the NHS? The real problem here is about trust, specifically about what should or should not appear trustworthy to patients because it is or isn't really. Given the increasing moves to do things like making appointments on-line, the much-reported efforts to share sensitive health data more widely, and the ever-changing sources of information and ways to contact the NHS, it seems to me that it is long past time these issues were resolved. IMHO it has to be done properly and from the top to have sufficient credibility and enforcement.
- grey-area 13y ago
  For appointments, just as an example, I believe emis and others offer their own separate systems and apps for this and also provide hosted sites. No idea if they are more secure but that's where the important data lives, on systems like that, not on these wordpress sites. There are 2-3 that almost all gps use, not sure on hospitals. http://www.emis-online.com http://www.emis-online.com I do agree with most of what you're saying though, and this is far from an ideal situation. Probably a central system makes most sense long term but gov seems unable (or more recently unwilling) to deliver.
  - vertex-four 13y ago
    The point is that if I send you an email, claiming to be your GP, telling you about "our new appointments system", and linking to something like: http://yourgpwebsite.nhs.uk/some-vulnerable-page?xss=.. http://yourgpwebsite.nhs.uk/some-vulnerable-page?xss=... And my XSS replaces the page with something that looks like an appointments system, the average person has no way of knowing that they shouldn't trust this. There's certainly none of the usual indicators.

Silhouette 13y ago

It's less shocking when you recognise that these are simply sites to tell patients when surgeries are open etc The question is, do patients realise that, or will they tend to assume that because a site is part of the privileged .nhs.uk hierarchy, it is properly run by the NHS? The real problem here is about trust, specifically about what should or should not appear trustworthy to patients because it is or isn't really. Given the increasing moves to do things like making appointments on-line, the much-reported efforts to share sensitive health data more widely, and the ever-changing sources of information and ways to contact the NHS, it seems to me that it is long past time these issues were resolved. IMHO it has to be done properly and from the top to have sufficient credibility and enforcement.

grey-area 13y ago
For appointments, just as an example, I believe emis and others offer their own separate systems and apps for this and also provide hosted sites. No idea if they are more secure but that's where the important data lives, on systems like that, not on these wordpress sites. There are 2-3 that almost all gps use, not sure on hospitals. http://www.emis-online.com http://www.emis-online.com I do agree with most of what you're saying though, and this is far from an ideal situation. Probably a central system makes most sense long term but gov seems unable (or more recently unwilling) to deliver.
- vertex-four 13y ago
  The point is that if I send you an email, claiming to be your GP, telling you about "our new appointments system", and linking to something like: http://yourgpwebsite.nhs.uk/some-vulnerable-page?xss=.. http://yourgpwebsite.nhs.uk/some-vulnerable-page?xss=... And my XSS replaces the page with something that looks like an appointments system, the average person has no way of knowing that they shouldn't trust this. There's certainly none of the usual indicators.