Feeds

Council loses USB of patient records

Worker 'had problems' using encrypted stick

New hybrid storage solutions

Cambridgeshire County Council has had its wrist slapped for losing an unencrypted memory stick containing the details of vulnerable adults.

The unencrypted memory stick contained the personal details of at least six individuals. The stick including case notes and minutes of meetings where staff discussed the care of the at-risk individuals.

The Council had previously gone to some lengths to get workers to only use encrypted storage for such sensitive information, including asking staff to hand in unencrypted discs and running internal campaigns to promote its newly established encryption policy.

Despite the council's warnings, an unnamed member of staff went back to using unencrypted USB sticks after having problems getting an encrypted stick to work properly.

This unscrambled stick subsequently went missing, obliging the council to report the loss of the sensitive data to privacy watchdogs at the ICO (Information Commissioner’s Office) last November, resulting in a mild rebuke from the ICO in its judgment on the case.

In a statement, Sally Anne-Poole, enforcement group manager at the ICO, commented: “While Cambridgeshire County Council clearly recognise the importance of encrypting devices in order to keep personal data secure, this case shows that organisations need to check their data protection policies are continually followed and fully understood by staff."

Council officials reaffirmed their commitment to the tightened data security policy and promised to carry out "regular and routine monitoring" of its encryption policy to make sure staff were following the approved procedures.

Chris McIntosh, chief exec of encryption supplier Stonewood, said that the case illustrated that user education sessions need to be applied whenever security policies are tightened up or else bad old habits will simply continue under a new regime.

He said: “What is clear is that in Cambridge County Council’s case, the loss wasn’t a failure on the part of security strategy, but rather one of employee education. An organisation can have the best security technology and protocols in the world, but without an educated workforce they’re worthless." ®

Website security in corporate America

More from The Register

next story
Hey, Scots. Microsoft's Bing thinks you'll vote NO to independence
World's top Google-finding website calls it for the UK
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
Apple CEO Tim Cook: TV is TERRIBLE and stuck in the 1970s
The iKing thinks telly is far too fiddly and ugly – basically, iTunes
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
OECD lashes out at tax avoiding globocorps' location-flipping antics
You hear that, Amazon, Google, Microsoft et al?
Show us your Five-Eyes SECRETS says Privacy International
Refusal to disclose GCHQ canteen menus and prices triggers Euro Human Rights Court action
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.