You are here: News > News > Sensitive information on British health patients stolen
| » IT Security NEWS |
| |
| » 02 May 2009 |
| Sensitive information on British health patients stolen |
Data breaches of four trusts have led the Information Commissioner's Office to remind all trusts of the National Health Service (NHS) of the United Kingdom of patient records privacy.
These breaches were at Cambridge University Hospital, Central Lancashire Primary Care, North West London Hospitals and Hull & East Yorkshire NHS trusts.
In the Cambridge University Hospital, a staff member left an unencrypted memory stick in an unattended motor vehicle. The memory stick held medical treatment details of over 700 patients. A car wash attendant gained access to its contents and downloaded information without the trust's awareness.
The same event happened in Central Lancashire, where it is assumed that a staff member lost a memory stick containing treatment details of over 6,000 incarcerated patients. Although its contents were encrypted, details of the password are attached to the memory stick.
Meanwhile, a desktop computer and two laptops were looted from the North West London Hospitals trust. Test results and hospital numbers of over 300 patients were documented in these computers. This time, though the computers were password protected, the data they contained were not encrypted.
At Hull & East Yorkshire, a computer and a laptop were stolen from a locked office in two separate events. The two stolen computers held unencrypted medical details of over 2,000 patients.
The Data Protection Act of the UK requires trusts to undertake protective measures with regards to personal information. It also requires the encryption of all devices used in recording and conveying personal data of patients.
Mick Gorrill, assistant information commissioner at the ICO reiterated, "The Data Protection Act clearly states that organisations must take appropriate measures to ensure that personal information is kept secure. These four organisations recognise the seriousness of these data losses and have agreed to take immediate remedial action." |
|