2.6 Security

Pukka-J Data Communications Security

Security is paramount in all Pukka-J products. Security means protecting sensitive patient information from unauthorised access. The level of security chosen should reflect the level of risk of unauthorized access, the degree of paranoia and any local, regional or statutory requirements. The vulnerabilities of computer systems attached to networks are well known. Pukka-J applications provide an environment for the reliable use of authentication, confidentiality, integrity and non-repudiation services. Pukka-J software assures and demonstrates the trust that is necessary to safeguard professional and patient confidentiality. Pukka–J systems are tailored to fit with national security policy standards by using the latest techniques and recognised standards for PKI, SSL, cryptography and encryption.

Security Standards

X509 Version 3, X509 Version 2, 3-DES, RSA 1024, DSA, RSA 2048, MD-5, SHA-1, IP-SEC, SSL V3/TLS v1.0, ESMTP

Public Key Infrastructure for Digital Certification

The use of public-key cryptography and finger printing of applications makes it possible to:

Encrypt data (e.g. when sending confidential e-mail over a mistrusted network
Detect unauthorised changes to data transmitted over networks.
Positively identify and authenticate remote users over networks (e.g. when required to provide access to sensitive systems)
Digital signatures (e.g. when authorising services electronically and where evidential value is important) ensure users cannot repudiate their actions at a later date (e.g. when required to confirm the identity of the specific user who sent a particular message or instruction over an mistrusted network)

Secure Socket Layer (SSL)

The use of web-based / browser enabled SSL (128 bit) encryption protects online communication of sensitive information.

Web Page Time-Out

In cases where the computer is left unattended the web page will automatically time out to ensure that patient identifiable data is not left visible on screens. Pukka-J's ‘No-entry’ screen provides a password protected login for the user to revert back to their work in progress.

Pukka-J Encryption

Pukka-J's technically sophisticated encryption methods provide enhanced scrambled versions of data against unauthorised disclosure between computerised transactions. As a Java enterprise application Pukka-J software can support any local security requirement. Applications are safely delivered through any firewall.

Caldicott Principles

Everyone with access to patient-identifiable information must be aware of their responsibilities. It may be sensible to consider the issues involving patient consent for data transmission and to involve your local Caldicott guardians.