How to manage cyber security in a hybrid-working practice

The way general practices work is changing. Remote triage, digital consultations, cloud-based platforms, and flexible working mean that many staff now access sensitive systems from outside the surgery. Whether it’s a GP working from home, a PCN manager joining a meeting on the move, or admin staff logging in remotely - hybrid working is here to stay. But with new working patterns come new risks. Laptops in kitchens, unsecured Wi-Fi, shared devices, and distracted multitasking can all create cyber vulnerabilities that wouldn’t exist in the surgery. This guide sets out how to manage cyber security in a hybrid-working general practice - protecting patient data without making flexible working impossible.

What does hybrid working look like in general practice? 

Hybrid working varies across practices, but might include: 

• GPs and clinicians working from home for telephone triage or virtual clinics. 

• Practice managers working remotely on admin tasks or meetings. 

• PCN staff logging in from shared spaces or hot desks. 

• ICB or CSU colleagues accessing your systems for joint working. 

• Staff using personal phones or home Wi-Fi to access platforms like NHSmail, MS Teams, or EMIS Web. 

The benefits - better work–life balance, improved access, greater efficiency - are real. But so are the risks. 

Common cyber risks in hybrid models 

A single mistake can expose the practice to a serious breach, even if it happens miles from the building. 

How to build hybrid-friendly cyber resilience 

1. Start with a clear remote working policy 

Your IG or IT policy should explicitly cover: 

• Who can work remotely and on what tasks. 

• What equipment they should use (personal vs practice-owned). 

• Minimum standards for device security and Wi-Fi. 

• Rules for printing, storing and disposing of data off-site. 

• Expectations around incident reporting. 

If your policy doesn’t cover hybrid working, it’s time to update it. 

2. Issue practice-approved equipment where possible 

Where budgets allow, provide: 

• Practice-owned laptops or tablets. 

• Devices with pre-installed encryption and antivirus protection. 

• Secure VPN access for remote connection. 

• Multi-factor authentication (MFA) for system access. 

This reduces variability - and allows your IT support to manage risks more effectively. If staff use personal devices, require them to: 

• Set strong passcodes. 

• Keep software up to date. 

• Avoid saving files locally. 

• Use secure platforms (for example, NHSmail, AccuRx). 

3. Use platforms that are designed for NHS remote use 

Stick to tools that meet NHS cyber security standards: 

• NHSmail - secure email with MFA.

• MS Teams - encrypted messaging and video. 

• AccuRx - approved patient messaging platform. 

• Citrix / VPN portals - secure access to clinical systems from outside the surgery. 

Avoid sending or storing patient information via: 

• Personal email accounts (Gmail, Outlook, etc.). 

• Consumer cloud platforms (Google Drive, Dropbox). 

• Messaging apps like WhatsApp for sensitive discussions. 

4. Train staff specifically on hybrid working risks 

Generic IG training won’t always cover the nuance of home working. Include: 

• How to spot phishing emails - even when busy or distracted.

• Why shared household devices are a risk. 

• What to do if a device is lost, stolen or compromised. 

• How to log out fully after a session. 

• What to do before printing or viewing confidential material at home. 

Use short refreshers, case studies, or “what would you do?” scenarios. 

5. Maintain logs and audit trails 

Ensure that: 

• Remote logins are auditable (via EMIS, SystmOne, or your CSU). 

• User access levels are appropriate for the tasks they perform. 

• Devices are returned and access revoked promptly when staff leave.. 

• VPN and email logs are reviewed periodically 

This helps detect suspicious behaviour and proves you have oversight - even if people are working off-site.

6. Foster a culture of reporting

If someone clicks on a suspicious email, leaves their laptop unattended, or realises they’ve sent a file to the wrong recipient - they need to feel confident in reporting it immediately. Make clear that: 

• Early reporting limits damage. 

• There is no shame in mistakes. 

• The team is responsible for helping each other stay secure. 

Final word: secure doesn’t mean inflexible

Cyber security in a hybrid-working world is about balance. You want to enable flexible, modern ways of working - but you also need to protect patient data and uphold your obligations under the DSPT and UK GDPR. By updating your policies, improving training, and supporting staff with the right tools and habits, you can make remote working safer - and smarter. Because cyber security isn’t just about firewalls and passwords. It’s about people - wherever they happen to be working.