NHS boards therefore adopt a risk based approach to determine what measures are appropriate taking into account the state of technology at the time, the cost of implementing such measures and the nature of the data to be processed and the harm that might result from, for instance, unauthorised access.