Feeds

ICO chastises NHS over data losses

A very leaky vessel indeed

Choosing a cloud hosting partner with confidence

NHS organisations were responsible for 30 per cent of the security breaches reported to the Information Commissioner's Office over the last two years.

The ICO said that, of the 711 reports of security breaches it has received since HM Revenue and Customs reported its loss of 25m child benefit records in November 2007, 209 came from the NHS.

"We have investigated organisations, including several NHS bodies, that have failed to adequately secure their premises and hardware, which has left people's personal details at risk," said Mick Gorrill, the assistant commissioner with responsibility for investigations.

"I encourage organisations, especially NHS bodies, to ensure that the level of security at premises is commensurate with the type of data they are holding. Many breaches are avoidable and are often the result of poor management processes."

The figures came in the same week as three trusts were reprimanded by the ICO for poor information security. Two primary care trusts, Great Yarmouth and Waveney and Gloucestershire, signed formal undertakings to improve their data security after putting thousands of patients' sensitive personal information at risk.

Great Yarmouth and Waveney reported the theft of two PCs to the ICO, containing the personal details of more than 1,000 occupational therapy patients and staff. The personal information had been held on the computers, rather than on a network server, and was not password protected.

In addition, their offices did not have a burglar alarm, internal doors were unlocked and the computers were unencrypted.

Gloucestershire Primary Care Trust reported the theft of six laptops containing the personal data of 2,270 patients. The computers, used by medical secretaries for preparing letters and patient notes, were password protected and held in a locked office, but the ICO said the data should have been held on a server.

Maidstone and Tunbridge Wells NHS Trust, an acute trust, reported the theft of an unencrypted laptop computer from its audiology department. This held test results on 33 patients, as well as other personal details on an unknown number of patients. The trust reported a further three laptops as stolen during August 2009 from its Maidstone site, but these were encrypted.

As with the primary care trusts, Maidstone and Tunbridge Wells has signed an undertaking to improve information security, in its case by encrypting all personal data on laptops and removable media within six months.

The ICO said its research showed that burglaries and theft are the single biggest security risks for organisations processing people's personal details.

This article was originally published at Kable.

Kable's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.

Intelligent flash storage arrays

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Google Glassholes are UNDATEABLE – HP exec
You need an emotional connection, says touchy-feely MD... We can do that
Just don't blame Bono! Apple iTunes music sales PLUMMET
Cupertino revenue hit by cheapo downloads, says report
US court SHUTS DOWN 'scammers posing as Microsoft, Facebook support staff'
Netizens allegedly duped into paying for bogus tech advice
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Verizon bankrolls tech news site, bans tech's biggest stories
No agenda here. Just don't ever mention Net neutrality or spying, ok?
Inside the EYE of the TORnado: From Navy spooks to Silk Road
It's hard enough to peel the onion, are you hard enough to eat the core?
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The Heartbleed Bug: how to protect your business with Symantec
What happens when the next Heartbleed (or worse) comes along, and what can you do to weather another chapter in an all-too-familiar string of debilitating attacks?