Following up on the Hull Royal Infirmary and Castle Hill Hospital incident:
Dan Raywood quotes a hospital spokesperson who indicates that the doctor had emailed the data to himself. It seems that while the hospital had controls in place to prevent downloading data, its controls to prevent emailing data were not adequate to prevent this incident.