Acceptable use policy: Patients Know Best’s Acceptable Use Policy outlines the expected standards of all who have access to PKB systems and information ensuring that services are used responsibly and in compliance with legal and ethical standards. It prohibits any misuse, abuse, or unauthorised activities, safeguarding the integrity and security of the platform.

Business continuity policy: Patients Know Best has implemented a comprehensive Business Continuity and Disaster Recovery plan with measures to ensure data resilience, disaster recovery, and service continuity which is reviewed and approved annually.

Data retention and disposal policy: Patients Know Best maintain a Data Retention and Disposal Policy to ensure data is retained only for the required duration, as per the Data Controller’s instruction, to support patient care and meet legal obligations. Secure disposal methods are employed when records reach the end of their retention period. These policies are reviewed at least annually.

Incident response policy: Patients Know Best maintains an Incident Response policy that describes the process for identifying and addressing potential security incidents. The policy details steps to take if an incident is suspected. Plans for detecting, responding to, and recovering from incidents are included in the policy and post-incident activity requirements are defined.

Information security policy: Patients Know Best have a documented Information Security Policy to help ensure that employees understand their roles and responsibilities related to security. This includes security procedures to ensure that employee workstations have proper virus protection software, the most recent operating system and security patches installed.

Risk management policy: Patients Know Best has established a risk assessment process to identify, analyse, mitigate, and manage risks relevant to its services and organisation. Various types of risks are considered, including, but not limited to, operational, strategic, technological, compliance, security, and vendor risks.

Patients Know Best incident response plan is intended to establish controls to ensure detection of security vulnerabilities and incidents, as well as quick reaction and response to security breaches. The plan also provides implementing instructions for security incident response, to include definitions, procedures, responsibilities, and performance measures (metrics and reporting mechanisms).

All Patients Know Best employees complete annual training in security measures, including anti-phishing and social media security training.

Patients Know Best’s database is encrypted with industry standard AES 256. The database is stored off-site and backed up nightly for system-wide recovery purposes. All UK customer data is kept in the UK.

Incremental backups between full backups also take place, archiving changes to the data set.

Access to the Patients Know Best portal is over a secure link (https/TLS). There are multiple layers of intrusion protection, intrusion detection and firewalls between the internet, our application servers and the databases. Our production infrastructure is has no direct access from the internet.

Networks are protected by enterprise-class firewalls and appropriate virus protection is in place. PKB restrict direct access to Google Cloud Platform’s servers i.e PKB’s production environment, to specified IP addresses and security groups to prohibit unauthorised access to confidential data.

Multiple controls are installed to monitor traffic and patterns to identify malicious programs or code. Penetration tests are performed annually by a third-party vendor to measure the security posture of target systems and environments and to expose potential vulnerabilities to the production environment and data.

Request access to our latest public-facing Penetration Test

Patients Know Best (PKB) uses UK Google Cloud Platform (GCP) instances for all UK customer and patient data. All data stored is encrypted at rest and in transit using AES-256 and up to TLS 1.3.

The current status of PKB’s TLS configuration can be verified here.

Access to data is highly restricted, PKB use Role-Based Access Control and strictly monitor access to customer data and only permit it on an as-needed basis. PKB maintain very strict policies, security and procedures governing any data access and only authorised employees can access the application and database servers.

Access by healthcare organisation customers are monitored and events are stored in the Access Log of individual patient records. PKB additionally maintain a forensic-level audit of metadata pertaining to datapoints.

Patients Know Best have a strong internal password policy that includes a requirement for MFA for accounts that do not support SSO. Passwords are stored in a company managed password manager.

Patients Know Best supports OTP Single-Sign-On (SSO) for secure identity management and credentials including systems such as EMIS and SystmOne. Additionally, PKB allows patients to open their PKB healthcare record using NHS login.

Patients Knows Best pushes security updates within patch remediation objectives. Upon finding an issue in the production environment PKB evaluate to determine the impact. If an issue highlights a significant disruption to functionality or performance of the system or is considered a potential clinical/IG risk then a patch/release is scheduled as soon as a fix is ready. For critical issues downtime may occur during the day otherwise the fix will be scheduled in the evening when usage is lower.

Patients Know Best’s approach includes peer review, automated testing, and static code analysis prior to deployment into production.

Responsive software development means new features, resiliency improvements and bug fixes arrive bi-weekly (or more frequently in the case of critical patching).

Patients Know Best practices Agile software development, with a general lifecycle enforced by CI/CD controls. Customer data is never used as part of development lifecycle and testing.

Patients Know Best (PKB) provides a real time, service status webpage, including service performance statistics for service providers and administrators to access (PKB status), users can subscribe for proactive alerts.

Patients Know Best (PKB) stores all data for UK patients in secure, geographically dispersed UK Data Centres.

The Patients Know Best platform is is deployed as a multi-tenant, Software as a Service architecture run on fault-tolerant servers at Google Cloud Platform (GCP).

In addition to managed services for Patient Knows Best infrastructure, GCP provides physical security and environmental protection controls, including the use of secure perimeter defence systems, comprehensive camera coverage, biometric authentication, and a 24/7 guard staff. In addition, they enforce a strict access and security policy at data centres, ensuring all staff are trained to be security minded.

For more information see here

Patients Know Best's Business Continuity and Disaster Recovery (BCDR) strategy is a proactive and comprehensive plan designed to ensure uninterrupted operations and data protection. Data security is a top priority, with encryption and access controls in place. Regular testing and validation are performed and reviewed and approved annually.