Healthcare organisation closes a serious security and compliance gap

Benefits

• Migrated 5.5TB of PST files to Microsoft 365 without loss of data or fidelity
• Uncovered huge volumes of data that would otherwise have been overlooked, thanks to automated PST discovery across a wide variety of sources
• Provided “superstar” migration services that freed up the internal IT team to focus on communication and training
• Slashed the project timeline in half, from one year to just six months

The Story

PST files put security, business continuity and compliance at risk.

Torbay and South Devon NHS Foundation Trust was the first NHS organisation in England to join hospital and community care with social care and are proud pioneers in integrating health and social care nationally. It provides health and social care services to people in their own homes or in their local community, and runs Torbay Hospital (providing acute hospital services) as well as five community hospitals. Torbay and South Devon employs over 6,500 staff and has over 350 volunteers.

As a healthcare institution, Torbay and South Devon NHS Foundation Trust is subject to strict government mandates, including policies that can require lengthy data retention periods — even as long as 20 years. But until recently, users at the trust had only 4GB mailboxes. As commonly happens in such situations, many users created PST files to store the excess data that needed to be kept for business, personal or compliance reasons.

Though this workaround satisfies users’ immediate needs, it has important drawbacks. PST files cannot be centrally tracked or managed, so they are often poorly protected and easily corrupted. Moreover, they may not be covered by IT backup processes, and they make thorough and accurate eDiscovery impossible. As a result, PSTs put security, business continuity and compliance at risk.

Given that the trust’s IT ecosystem includes some 8,000 users, including people who had been with the organisation for decades, the IT team was seriously concerned. They proposed a project to discover the PST files and migrate them to Microsoft 365, where they could be properly managed and secured.

“One reason for this proposal was that our trust is part of the national NHS shared tenant, so Microsoft 365 is provided at a basic level at no cost to us,” explains Jai Ragwani, technical delivery manager at Torbay and South Devon NHS Foundation Trust. “In addition, it would be efficient to host the data in one place rather than in various file shares and personal drives. Finally, by migrating the data to the cloud, we could reserve our expensive on-prem storage for workloads that we can’t move to the cloud.”

Migration projects are complex and risky — especially when they involve critical and regulated data.

Although the IT team had proposed the migration project, when it was approved, they felt a bit of a shock as they realized the scale of data and work involved. One clear challenge was a lack of migration experience. “My team did not have much experience with this type of migration,” Ragwani says. “We’ve been very much an on-prem-first organization and that’s very much where our knowledge lies. We thought we could probably do the work internally, but we weren’t sure of the process and the best practices to follow. That was definitely a risk in my head.”

Another key concern was lack of insight into the data. “At a high level, we knew how many file shares we had and a guesstimate of how many PSTs,” he adds. “But we didn’t have any kind of robust mechanism to be sure that this file share contains this type of data. Therefore, there was a real risk that we could accidentally migrate data that needed to remain on premises, such as data that’s used by older on-prem applications or clinical records that weren’t in scope.”

Finally, there was the risk of service disruption. “Like many organisations, we’ve experienced shadow IT. In our case, clinicians and administrators develop something to meet their needs, and we don’t even know it’s there,” notes Ragwani. “Accordingly, there was definitely a risk that by migrating data to the cloud, we might disrupt a service that we provide. Obviously, as a healthcare organization, that could be quite bad.”

An experienced and flexible partner is essential for a successful migration.

With those concerns in mind, the team put together a requirements document. “Definitely at the top of our list of criteria were a solid understanding of NHS shared tenant and how we operate as an NHS trust, as well as a willingness and ability to collaborate with the people who manage the tenant nationally, namely NHS England and Accenture,” Ragwani says. “The NHS moves quite rapidly at times and every few years there are huge changes in how it operates, so we knew that flexibility to adapt to ever-changing landscapes would be critical to success.”

After carefully reviewing all the tenders they received, the team found that only Quest had the requisite experience, knowledge and flexibility to handle the project. “Not only had NHS England worked with Quest in the past, but we learned that Quest was slated to become an approved migration partner for the shared tenants,” Ragwani adds. “That was another big tick in our book.” Specifically, the team chose PST Flight Deck and the associated fully managed PST migration service.

Finding all files, instead of just 80% of them, is critical to security and compliance.

The first step was PST discovery. PST Flight Deck automatically discovers all PST files — not just on user workstations but in other locations that other solutions tend to exclude, such as local drives, attached USB devices, network shares, and OneDrive for Business.

“A key benefit of PST Flight Deck was that it scanned users’ machines, so we dug up a lot of PSTs that we didn’t know existed,” recalls Ragwani. “Finding all the different places where people had stashed the files and forgotten about them over the years was definitely a shock to us. If we had done the discovery manually, I think we would have been able to find at most 80% of the files because we wouldn’t have looked in locations where we didn’t expect PST data to be stored.”

Plus, the discovery process was far faster with PST Flight Deck. “After just one or two weeks, we already had a pretty complete picture of what PST files we had,” Ragwani says. “Without PST Flight Deck, it would’ve taken us months to do just the discovery piece, and we still wouldn’t have found all the PST files that were in scope for migration.”

A thorough discovery was absolutely essential for Torbay and South Devon NHS Foundation Trust. “The files on users’ personal drives were not only consuming space, they were very liable to corruption and improper deletion, which could have meant loss of important information,” notes Ragwani. “Similarly, PSTs that had been accidentally stored on a shared file share were a clear security and compliance risk, so it was incredibly valuable to us that PST Flight Deck discovered them.”

5.5TB of PST data is migrated in just six months, with no loss of data fidelity.

After the discovery phase, the team began moving the data to Microsoft 365. “We migrated 5.5TB of PST data in just six months,” reports Ragwani. “We initially put aside a whole year for the project. The Quest tool automated the work and cut that timeline in half.”

But that speed did not come at the cost of quality. “The PST files being migrated may well have included really important emails that are subject to data retention requirements and might be required as evidence years down the line,” Ragwani notes. “If that data hadn’t gone across correctly or had remained on premises and become corrupt, the trust could have been left in quite a precarious position. But thanks to the Quest solution and migration service, the success rate for our PST migration was incredibly high; it definitely surpassed my expectations.”

In fact, PST Flight Deck can even automatically repair corrupted files using industry best practices. “We had already had years of experience with people having huge PST files that had become corrupted. We’d try to repair them. Probably 60% of the time the repair would seem to be successful but actually they’d end up losing data,” explains Ragwani. “If a source file was corrupted, PST Flight Deck would try to repair it itself. We had high confidence that if the tool couldn’t repair it, neither could we. So, it handled a very time-consuming part of the process for us and did the job well.”

Engaging a migration service frees up the internal IT team for vital user communication and training.

With the Quest team handling the migration jobs, the internal IT team had time to focus on making the migration a success in the eyes of users. “We would simply compile a list of data that we wanted to migrate and ping that off to the migration-as-a-service team, and we knew that the job would run at the designated time.” Ragwani explains. “That freed up our time internally to focus on elements like communication, training and support. As a result, we were able to let users know what to expect in advance, which helped ensure that they had a positive experience.”

Indeed, the IT team at the trust raves about the quality of the Quest team. “I rarely say this about anyone, but our program manager at Quest was an absolute superstar,” says Ragwani. “We’re an incredibly busy team with many plates spinning at the same time, but he was very good at keeping us and the Quest resources on track and aligned to the project plan. For example, there were scenarios where we needed to adjust resources or timelines to cater to changes in priorities at the trust, and he managed those situations expertly. I’ve rarely seen it work better.”

Ragwani offers similar accolades for the Quest professional services team. “The team leader was incredibly knowledgeable — he almost made it his mission to understand how the NHS shared tenant worked, down to all the intricacies and special parts,” Ragwani recalls. “Aside from that, his general knowledge, experience and wisdom were incredibly helpful for us in terms of making internal decisions and planning the migration as we went forward.”

In short, Torbay and South Devon NHS Foundation Trust knows that it made the right decision in selecting Quest for its PST migration project. “Without the help of Quest professional services, I think we would have got some of the way to our goal, but definitely nowhere near as far; we just didn’t have the knowledge and experience,” says Ragwani. “Plus, we would not have had time to focus on the support, training, communication and planning aspects that were equally critical to success. Knowing that the technical guff and migration jobs were being handled by experts was a huge weight and resource drain lifted from us.”