A practice being denied access to its patients' medical record shuts down a practice and does not simply make it inconvenient – when a practice has potentially compromised personal data then the regulatory clock starts at that same time. Our company works with practices, clinics and care providers throughout Greater Manchester on both aspects of that – restoring clinical systems and protecting the evidence needed to answer a regulator truthfully. Done here by our own engineers in the UK.
Practice servers, imaging storage and clinical databases – recovered under a signed processing agreement, held only as long as you specify and never sent outside the UK.
When personal data may have been compromised then UK GDPR provides you with 72 hours to assess and, if necessary, notify the ICO. What the answer is lives in logs and file-system artefacts – exactly what is removed when you rebuild over the top or restore over the top. Image first – it delays the restore by almost nothing.
This obligation shapes everything about how you will respond to a healthcare data incident.
In cases where patient data may have been accessed or lost, UK GDPR gives you a 72-hour window for assessing and/or notifying the ICO about what happened to the patient data. What matters is not whether files were encrypted or a disk failed, but whether patient data was in a position to be outside your control. That can be determined through logs, access records and other file system artefacts.
All of which are destroyed when you do a restore. Restoring from an image or rebuilding a machine over top of the affected volume is the most common way for IT to respond to a problem like this. However, it will destroy the evidence needed to provide a satisfactory answer to the regulator's question. It costs nothing additional to create a read-only image of the affected system first, which preserves that evidence. Creating a read-only image will delay the restore process by almost no time at all.
From a small machine used in a single practice to large scale trust wide arrays.
Not optional in this industry and not treated as if it were.
We sign one before we do anything else, along with an NDA. The contract states that we will process the data for you – you are the controller and we are the processor.
Same person from diagnostic to delivery. The fewer contacts there are, the smaller the number of individuals who have access to patients' medical records.
No data leaves the UK, and no work is subcontracted out to another laboratory – that really sets us apart in this industry.
All working copies of the data will be securely disposed of when the retention time you specify has been reached. We confirm that all data is destroyed once it reaches its retention date.
The documented tracking history on every job, so when an incident is reportable you will have a record of who had access to the data at what time.
Where the consequences of downtime are clinical and not simply commercial.
A practice without access to patient records is a practice that cannot safely treat patients. The use of priority scheduling allows the job to move to the front of the queue and we image the database of the records first, allowing the records system to return to you while we continue imaging of the rest of the array behind it.
In addition we will always identify when speed does not affect outcome — obtaining a donor head-stack is always going to take as long as required; pushing a failing drive will lose data instead of recovering it. Recovery for servers, arrays and NAS is from £500 +VAT, after a free 48-hour diagnostic.
You have 72 hours to determine whether there has been a breach — and, if necessary, to notify the ICO. The ability to do this depends on artefacts a restore process removes — that is why the system is imaged read-only prior to all other actions.
Yes. A data processing agreement and NDA are standard in all cases. All communications are through one named point of contact. Data is stored in the UK and no subcontractors are used. Working images are destroyed after a time frame determined by you.
Yes, and returned in a format that is usable by the software application, versus simply extracted. A database contains an inherent structure for maintaining its own integrity and completeness and therefore a "byte complete" version of the file may still refuse to be attached — those are identified and affected records are reported.
Yes. As part of priority processing we will move the job to the front of the queue and process the database records image first. This means that whilst the rest of the array continues to image behind it, your records database can be back with you.
Your data is returned on fresh media, and our working copies are securely destroyed after the agreed retention period. We also confirm destruction. Media or data never leave the UK, and no records are retained longer than any agreed time frame.
For server, RAID and NAS units from £500 + VAT. For single drive units from £300 + VAT. No charge for a free 48-hour diagnostic. Fixed written quote prior to starting work, and there will be nothing to pay for the majority of cases where the data cannot be recovered.
Free diagnostic and written quote – in house, GDPR compliant, within Britain.