ICO concerned about data protection at NHS

crn/27-10-2008/theft

The Information Commissioner’s Office (ICO) is “highly concerned” about the data security procedures put in place by NHS trusts and medical facilities.

A quarter of the 1,000 data breaches reported to the privacy watchdog since 2007 came from the NHS.

Today the ICO revealed that NHS Stoke-on-Trent failed to file 2,000 paper physiotherapy records within its archive system and these may have accidentally been destroyed or misfiled.

Basingstoke and North Hampshire NHS Trust emailed a spreadsheet, containing 917 patients’ pathology results via an unsecure address to another department.

The spreadsheet was not password protected and the receiving department had no business need to have access to the excessive amount of clinical records.

Earlier this month the ICO revealed that in March a member of staff at the Lampeter Medical Practice downloaded details of 8,000 patients onto an unencrypted memory key. This was posted by recorded deliverly to the Health Boards Business Service Centre but never arrived.

Mick Gorrill, head of enforcement at the ICO, said: “Everyone makes mistakes, but regrettably there are far too many within the NHS. Health bodies must implement the appropriate procedures when storing and transferring patients’ sensitive personal information.

“We have taken a number of steps to explain the importance of personal data to NHS bodies and help them comply with the law. We will continue to do so.”

The NHS organisations have agreed to implement a number of security measures to protect personal information more effectively.

All staff will be made aware of the organisations’ policies for the retention and use of personal data and will receive training on how to follow those policies.