NHS smartcard loss threatens privacy

Thousands of National Health Service (NHS) smartcards used to access electronic patient records have been lost or stolen, according to Pulse magazine.

The weekly magazine for GPs found that since 2004, of the 429,691 smartcards issued to NHS staff, 4,147 had been reported lost or stolen.

The magazine got the data from Government agency Connecting for Health (CfH) under the Freedom of Information Act. Pulse said despite claims from both CfH and the Department of Health (DoH) that strict protection and disciplinary processes were in place, it had found no action had been taken by NHS trusts against staff members who had lost their card.

It said in almost every case, lost or stolen smartcards were reissued automatically, and there were no investigations; even more concerning was the fact that one NHS trust in 10 had no idea how many of the cards they had issued had gone missing.

Currently only NHS employees such as doctors, nurses and care workers should use these cards to access patient care records and prescriptions. However, the scheme is expected to be widened to allow GPs and pratice nurses to view their patients' hosptial records.

Professor Ross Anderson warned that the problem would get worse. The computer security specialist at the University of Cambridge said: "You can't expect such a large network to remain confidential if a few hundred thousand people have access.

"There will be several hundred at any time who've lost their smartcards and thousands who leave terminals logged on or share cards in other ways,” he warned.

When contacted by Computeractive, both the Department of Health and CfH denied that any security breaches had occurred.

A representative for CfH said: “There is no evidence that any security breaches have ever arisen from lost or stolen cards. All records are subject to an audit trail which gives detailed information on who accessed any record and through what process.

“Contrary to some media reports, smartcard loss or theft is less than one per cent nationally."

See also:

HMRC loses data for 25 million people

Loss is "one of the world's biggest ID protection failures"  20 Nov 2007

Fasthosts customers advised to reset passwords

Web host server hacked  22 Oct 2007

Organisations lose confidential data

Experts warn that password security is not sufficient  25 Sep 2007

Lords calls on technology firms to protect surfers

House of Lords committee makes Government and service providers responsible  13 Aug 2007

UK customers caught up in TK Maxx data theft

Has your card been maxed out to the limit?  30 Mar 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!