ICO chastises NHS over data losses
A very leaky vessel indeed
What you need to know about cloud backup
NHS organisations were responsible for 30 per cent of the security breaches reported to the Information Commissioner's Office over the last two years.
The ICO said that, of the 711 reports of security breaches it has received since HM Revenue and Customs reported its loss of 25m child benefit records in November 2007, 209 came from the NHS.
"We have investigated organisations, including several NHS bodies, that have failed to adequately secure their premises and hardware, which has left people's personal details at risk," said Mick Gorrill, the assistant commissioner with responsibility for investigations.
"I encourage organisations, especially NHS bodies, to ensure that the level of security at premises is commensurate with the type of data they are holding. Many breaches are avoidable and are often the result of poor management processes."
The figures came in the same week as three trusts were reprimanded by the ICO for poor information security. Two primary care trusts, Great Yarmouth and Waveney and Gloucestershire, signed formal undertakings to improve their data security after putting thousands of patients' sensitive personal information at risk.
Great Yarmouth and Waveney reported the theft of two PCs to the ICO, containing the personal details of more than 1,000 occupational therapy patients and staff. The personal information had been held on the computers, rather than on a network server, and was not password protected.
In addition, their offices did not have a burglar alarm, internal doors were unlocked and the computers were unencrypted.
Gloucestershire Primary Care Trust reported the theft of six laptops containing the personal data of 2,270 patients. The computers, used by medical secretaries for preparing letters and patient notes, were password protected and held in a locked office, but the ICO said the data should have been held on a server.
Maidstone and Tunbridge Wells NHS Trust, an acute trust, reported the theft of an unencrypted laptop computer from its audiology department. This held test results on 33 patients, as well as other personal details on an unknown number of patients. The trust reported a further three laptops as stolen during August 2009 from its Maidstone site, but these were encrypted.
As with the primary care trusts, Maidstone and Tunbridge Wells has signed an undertaking to improve information security, in its case by encrypting all personal data on laptops and removable media within six months.
The ICO said its research showed that burglaries and theft are the single biggest security risks for organisations processing people's personal details.
This article was originally published at Kable.
Kable's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.
COMMENTS
Put a price on personal data
If personal data were given a suitable monetary value, then the fat-cats in charge of these lossy Govt facilities could be fined a percentage of the data-deficit.
Think of it as a data-performance anti-bonus scheme.
password protected!
When are these numpties going to learn, password protecting a computer is useless unless its encrypted. It would take all of 2 mins with an ubuntu live cd to bypass if someone really couldn't be bothered to remove the drive and connect it directly to another machine.
I used trucrypt to encrypt my netbook the other day, just as a bit of an experiment, it's a pretty idiot-proof process, and near invisible once done. It didn't even need to stop me using it to do the encryption and took about 4 hours.
This is a home user, who doesn't really need it, and i can't see any real reason not to do it, if only to deprive anyone who stole it of my porn collection, they can damn well find some themselves. Not doing it to a company/government laptop, even if you are too cheap to pay for pointsec or some other such commercial encryption, just seems like complete idiocy.
I am not surprised
One PCT in the North (actually in west yorkshire) has told it's IT dept there are areas they cannot go in the servers. So as a result IT are not allowed access.
As a result those members of staff that do get access have seen the downloaded film collection, the pron, the games etc.
Same PCT has a requirement for all staff to put their username and password in a ring binder / folder, in case they are on holiday and need to get access.
Routinely giving access to EVERYONES email accounts. Things I know as a result of this policy is shocking, information just flating across the email systems.
The NHS is run on pay grade not skill or professional competance. And they have procedures for counting stock (I kid you not) because some people on very high pay rates cannot even count boxes in a cupboard.
Either way the fact the ICO is actually doing his job is a shock, where was he with Phorm. Oh yeah, taking back handers.
AC because I work in another PCT and want to keep my job. However my PCT is at least trying with awareness training and limiting access, encryption etc.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
