London hospital loses 20,000 unencrypted patient files
'Nobody expects thieves to break into locked drawers'
Posted in Management, 18th June 2008 15:02 GMT
Watch Now : Virtual Machine Movement with Hyper-V
Providing proof, if it were needed, that every single piece of personal data in the UK has now been lost - probably several times over, by multiple corporations and government offices - news has just broken of another theft of laptops crammed with easily accessed info. This time the there-but-for-the-grace-of-god bonehead users were hospital staff at St George's hospital in Tooting.
"We could not anticipate a determined thief who was prepared to force open a filing cabinet and locked drawers," said Chief Executive David Astley.
The six laptops in question belonged to the cardiac department, and contained information about some 20,000 patients, including their name, date of birth and postcode.
They were stolen from hospital offices during the weekend 7/8 June. The machines' drives were not encrypted. However, hospital staff were keen to stress that the laptops were "password protected". Which should stymie anyone incapable of booting them up using an alternative operating system.
“We believe the data will almost certainly be wiped by the thief so he can get a quick sale," speculated Astley.
"Nonetheless we owe it to our patients to protect their personal information and we have reminded our staff not to store this kind of data on laptops in the future. We have also set up a helpline for patients to ring for further information.”
The St George's NHS Trust has written today - ten days after the theft - to every patient, apologising for the potential risk to their confidentiality.
Trust spokespersons told the Reg that the data had only been placed on the laptops due to a "temporary problem" with the hospital's network, which has since been rectified.
Asked how long the network outage had lasted, and for comment on whether it was thought to justify placing 20,000 effectively unprotected personal records on six different machines, the Trust had not yet responded as of publication. ®
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
Sack them
Copying confidential data = the bullet. Likewise with the Wolverhampton Wanker.
Mountain out of a mole hill ?
No it isn't. A lost Laptop can not be compared to losing a hardcopy file, its like losing the entire "Filing Cabinet", in fact 20 cabinets. Think about it!
Though NHS Staff need to be better educated on data security to be able to comply with the Data Protection Act, I believe that the IT Departments are really at fault. The IT department supply the laptops to the staff and they should have secured the laptops using Safeboot or any other encrypted software to ensure the data could not be viewed.
Would you be so forgiving, if a shop in the high street had left your credit card information for anyone to look at and use. When it started costing you money I fear not, then data protection would be very imfortant to you. If you care about protecting one form of data, then you have to care about all forms, no matter how trivial to you.
Data is protected for a reason, Would you like poeple to know if ?
1: You had an abortion when you were young
2: You had/have a drink/drugs problem
3: You have aids.
4: You have mental problems.
5: You have cancer, HIV.
6: You have had an STD
7: Your children are sexually active.
This is private information and is "TRUSTED" to the poeple who are there to help you. If the trust is not respected, the the patient may feel he/she does not want to disclose vitally important information to their Consultants/GPs/Nurses etc.
Data Security has to start with a well trained and educated ICT Department.
Smart Cards
Why were the PC protected by passwords. According to the Information Governance Toolkit (Question 303 IGT watchers) all trusts have, as part of their obligation as a Registration Authority, to have "established business processes that ensure all staff smartcards and access profiles issued are appropriate".
Passwords should not be the authenitcation method used. Perhaps as well as breaching the Data Protection Act the executives of the trust have made a false declaration in their IGT return and so could be found guilty of perjury?
PH because she protects her assets better.
As a member of NHS IT staff
I can say that attempting to implement any security measure will quickly be stomped on by the first Consultant (Medical, not IT) whom the change slightly inconveniences.
"I have to put my password in *again* if I leave my PC unattended for more than 10 minutes? I'm a very busy man, doncherknow?!"
Anonymous, for obvious reasons
associated
I work for a company that assists the NHS with technology 'solutions' *AHEM* So I handle laptops (for training purposes) provided from local trusts and re-fit software and databases to be in line with current live systems.
Now we, are very careful with the data with which we're charged, but when I get these laptops, they rarely have passwords (even though we send them off secured, the cretins in NHS just remove them, and start dilligently filling said DBs with sensitive data) and even if they do have them, they're so highly enigmatic, they would require a thief to actually use their though processes to try the name of the city said laptop has been lifted from.
What i'm trying to say is that IT contractors for the NHS do the upmost to ensure security, but the good old 'stuck in a techno-rutt' NHS just seem to think that these policies just plain don't apply to them.
Anyway, i'm off to fit a new lock to my drawers...
The new Office Garage series:
Enabling efficient data center monitoring
Top 10 SIEM implementer’s checklist
