From the press release:
The Information Commissioner’s Office (ICO) remains highly concerned that data breaches involving people’s personal information are continuing to occur in NHS organisations. Today NHS Stoke-on-Trent and Basingstoke and North Hampshire NHS Foundation Trust are the latest NHS bodies found to have breached the Data Protection Act (DPA). Both NHS organisations’ chief executives have signed formal Undertakings outlining that they will process personal information in line with the DPA. A quarter (250) of all data breaches reported to the ICO are from the NHS.
Mick Gorrill, Head of Enforcement at the ICO, said: “Everyone makes mistakes, but regrettably there are far too many within the NHS. Health bodies must implement the appropriate procedures when storing and transferring patients’ sensitive personal information. We have taken a number of steps to explain the importance of personal data to NHS bodies and help them comply with the law. We will continue to do so.”
2,000 paper physiotherapy records were not filed within NHS Stoke-on-Trent’s archive system and may have accidentally been destroyed or misfiled. At Basingstoke and North Hampshire NHS Trust an excel spreadsheet, containing 917 patients’ pathology results, was emailed via an unsecure address to another department. The spreadsheet was not password protected and the receiving department had no business need to have access to the excessive amount of clinical records.
The NHS organisations have agreed to implement a number of security measures to protect personal information more effectively. All staff will be made aware of the organisations’ policies for the retention and use of personal data and will receive training on how to follow those policies.
NHS Stoke-on-Trent will also apply physical security measures in respect of paper medical records, particularly when they are in transit.
Basingstoke and North Hampshire NHS Trust will only extract and transfer the minimum amount of personal information necessary for any processing requirement. With immediate effect, it will encrypt all portable and mobile devices used to store and transmit personal data.
The ICO can issue a monetary penalty for serious breaches of the Data Protection Act. Monetary penalties are reserved for the most serious cases and this power can only be exercised in limited circumstances. The ICO has made full use of the most appropriate regulatory powers in the two cases highlighted here.
A full copy of the Undertakings can be viewed here:
http://www.ico.gov.uk/what_we_cover/data_protection/enforcement.aspx
Source: Information Commissioner’s Office