Authentication (IT)

These include those below.

NHS authentication standards:

• Identity Authentication Standards (NHS England guidance)

Multi-factor authentication (MFA) adds extra steps to verify your identity when logging in, making your online accounts much safer.

For example, in addition to your password, you might be asked to enter a code sent to your email or mobile phone, use an authenticator app, answer a security question, or scan your fingerprint.

If you use more than just a username and password makes it much harder for the incorrect persons to access data. You’ve likely experienced this outside of your pharmacy work, when using online banking or logging into social media on a new device within your personal life.

As a pharmacy owner, consider introducing MFA to your systems. To meet the “Standards Met” criteria on the Data Security and Protection Toolkit 2025 onwards, you need to demonstrate that you have considered MFA and documented any exceptions.

Steps to implement MFA

Assess current systems

• Identify systems accessible from the internet, such as email, digital social care records, and cloud-based systems.
• Consult with your software, its help and guidance, and if needed, with your IT suppliers to understand MFA options.

Identify potential challenges

• Consider scenarios where staff might share devices or logins, complicating MFA implementation.
• Evaluate if existing security controls already provide sufficient protection without MFA.

Balance security and usability

• Determine the appropriate level of security for each system based on the sensitivity of the data and ease of use for your staff.
• Balance strong security needs with the impact on daily operations, as too many security layers can lead to workarounds.

Document and report exceptions

• If you decide not to implement MFA for certain systems, document the decision and reasons.
• Ensure a clear understanding of the risks and rationale behind the decision.

Although MFA is key to protecting sensitive data, it’s crucial not to overcomplicate your security.

Aim to enhance security while maintaining a user-friendly environment for your staff, avoiding excess login burden.

Overview

Passwords should not be reused for multi systems in case of a breach in which a password is exposed by a bad actor.

Staff should create strong and memorable passwords e.g. three random words, e.g. ‘planeyellowbread’, although some systems will require additional complexity (e.g. capital letters, numbers or punctuation). Regular password change is not required unless the system demands. National Cyber Security Centre (NCSC), now recommends organisations do not force regular password expiry because they indicate that can increase the risk of workarounds. Read more: NCSC password information.

Password and access control policy and procedures

See: DSPTK Template 15 “Access control and password management procedures” and other data security templates at: cpe.org.uk/dstemplates.

Password tips

• Three random words: Three random words are recommended by NCSC although some systems will require additional complexity.
• Dictionary attacks: Avoid consecutive keyboard combinations— such as ‘qwerty’, ‘asdfg’, ‘123456’ or ‘111111’.
• Avoid using personal information within security questions: You may be able to set-up security questions and answers but be cautious of including any information available online or within your social media. This protects you from bad actors being able to take control of your account using the ‘forgotten password’ and ‘security questions’ options.
• Simple passwords: Do not use information such as your name, age, birth date, name of loved ones, pet’s name, or favourite colour/song, etc.
• Don’t reuse of passwords across multiple sites: Reusing passwords for multi accounts can lead to one breach of your credentials posing a greater threat.
• Make sure you use different passwords for each of your accounts.
• Be sure no one watches when you enter your password.
• Avoid entering passwords into computers you do not control (e.g. internet cafés or libraries)—they may ‘auto remember’ your password or even have malware that steals passwords.
• Avoid entering passwords when using unsecured Wi-Fi connections (e.g. airports or coffee shops)—hackers can intercept your passwords and data over this unsecured connection.
• Don’t tell anyone your password. Your trusted friend now might not be your friend in the future. Keep your passwords safe by keeping them to yourself.
• It’s okay to write down your passwords and keep these safe, just keep them away from your computer and mixed in with other numbers and letters so it’s not apparent that it’s a password.

Community Pharmacy IT Group (CP ITG) is in favour of smart authentication options which reduce the burden for health and care staff with logging into so many systems – e.g. NHS-related systems using ‘login with NHSmail’, NHS Care Identity Service 2, biometrics etc.

Password Managers may also be suitable for managing passwords for some systems. National Cyber Security Centre has provided guidance about Password Managers.

CP ITG helped to prepare a list of websites which pharmacy teams report requiring access to which demonstrates the multi-login burden: Website/system list which pharmacy teams access (pdf).