NHS is top sector for data losses
300 breaches in 3 years
Posted in Management, 1st June 2010 13:36 GMT
Watch Now : Virtual Machine Movement with Hyper-V
The NHS has reported 305 data breaches to the Information Commissioner's Office (ICO) since November 2007.
The figure for the NHS compares to 288 for the private sector, 132 for local government and 18 for central government. "It could be because of reporting differences or the NHS could be more prone to data breaches because they are dealing with sensitive data," an ICO spokesperson said.
The greatest cause of NHS data breaches was theft of hardware, with 116 incidents where equipment containing personal data was stolen. A further 87 incidents involved health service organisations losing hardware containing personal information.
The figure also includes 43 incidents where information was wrongly disclosed, 17 where data was "lost in transit", 13 cases involving the non-secure disposal of IT and 17 because of technical or procedural failures.
In July 2009 five NHS trusts were reprimanded by the ICO for failing to encrypt data. They included London's Royal Free Hampstead trust, which lost an unencrypted CD containing data on 20,000 cardiology patients, and Hampshire Partnership trust, after an unencrypted laptop with data on 349 patients and 258 staff was stolen at a conference.
The ICO began publishing data breaches after the loss of 25 million child benefit records by HM Revenue and Customs.
David Smith, the deputy information commissioner, said: "Extra vigilance is required so that people's personal information does not end up in the wrong hands.
"Organisations should have clear security and disclosure procedures that staff can understand, properly implement these and ensure that they are being followed by staff. Staff must be adequately trained not just in the value of personal information, but in how to protect it."
This article was originally published at Kable.
Kable's GC weekly is a free email newsletter covering the latest news and analysis of public sector technology. To register click here.
Watch Now : Virtual Machine Movement with Hyper-V
COMMENTS
They're clueless...
From top to bottom in the NHS, 80% of staff are totally clueless about IT. In my experience, far too often ESPECIALLY those entrusted with IT security. Those staff who are in the know are invariably those who have educated themselves at home - and even they invariably end up just deciding life's too short and keeping their heads down.
After a digital eye scan at my small local hospital, I was told the result would be available within a week or two. A WEEK or two?? Had they somehow missed the whole point of digital technology? Oh no - but the results had to be sent off to some central place to be checked. Well - how many seconds did that take online, for heaven's sake?! Oh - they couldn't send them online - that part of their brand new multi-million pound IT scheme had never worked. In fact the scan results were collected and burned to disk once a week. The disk was then taken by car the 50 miles to HQ. Was the disk encrypted? Er... how do you mean?
I kid you not.
Earns(?) more than the PM
And the NHS departmental top official gets paid what?
Take £10,000 per data breach from his salary and watch the data breach numbers fall!
Once your records
have been accessed even once you will not be able to have them deleted.
And do not for a minute think that the records will only be accessed by your doctor/s.
Local taxation departments across the country are gearing-up for the data, and the DofH will soon be selling it like DVLA does your licence info....
Just 2 days left to opt-out of the Summary Care Record
If you haven't opted-out yet, you have until Thursday June 3rd to do so.
But maybe...
Yes, I totally agree that data security and patient confidentiality is everybody's responsibility. In fact it is enshrined in the Caldicott principles that all healthcare staff are bound to observe. My point really is that sufficient data encryption may well have been in place to protect your privacy - it's just that the staff aren't conversant enough with the technology to be able to give you the information you needed. They were more than likely just following a written protocol that tells them which buttons to press when burning the CD, the underlying technical matters are not necessarily describe or explained.
Of course there is also the possibility that no such protection existed and the data was accessible to anybody putting the CD into their laptop... If thats the case then they will no doubt be in breach of existing trust policy on such matters. The thing is that a lot of these procedures are written up by people who don't have extensive backgrounds in IT - not an excuse, just a fact.
I am being sincere when I say you have a legitimate concern regarding data safety but it is only going to be addressed if people raise their concerns so that potential weaknesses in the system can be identified. Asking the person examining you is not necessarily going to get the information or response that you need.
Enabling efficient data center monitoring
The new Office Garage series:
IT infrastructure monitoring strategies
