Feeds

ICO: NHS data security breaches are just 'plain daft'

As bad as gossiping about patients down the pub, says watchdog

Choosing a cloud hosting partner with confidence

NHS staff should be more aware of data security risks as patient confidentiality "is at the heart of what they do", Jonathan Bamford, head of strategic liaison at the Information Commissioner's Office has said.

Speaking at an event on healthcare efficiency, he said that he was confounded by the disconnect between staff awareness on the subject and the number of breaches that occur in the health service.

"The conundrum for me is that those very same people who wouldn't dream of chatting about patient information at Costa Coffee or down the curry house on a Friday evening, or down the Coach and Horses, are the very same people who are losing memory sticks with lots of information on it, who are doing daft things with people's personal information," Bamford, to the Healthcare Efficiency Through Technology event in London.

"Why is there that disconnect there? Why have things fallen down in that way?" he asked. "Because I don't believe that any of those people who are involved in those security blunders are ill informed in terms of the need to look after people's information, or information that is entrusted to them."

He used the Dartford and Gravesham trust's data security issues as an example of lax data security awareness within the NHS. The ICO recently took action against the trust after it mistakenly destroyed 10,000 health records that were left in a destruction room, because the archiving room was full. He said that these kind of breaches occur because people find "work-arounds" such as someone logging into a computer and then allowing colleagues to use the same access.

Bamford explained that it was important for the NHS to realise that security was not all about technical measures, but about organisational changes as well. "It's about standards that are set by organisations, it's about what people are told. You have to ensure the reliability of staff that have access to information and data," he added.

He said that there are lots of issues that need to be addressed, but stressed that the situation could be improved.

"Information governance is at the heart of this and there are lots of lessons we can learn from the data losses over the years. We're really great supporters of the information governance (IG) toolkit and the fact there is a lot of effort put into that, but there has to be something which is meaningful that people embrace in their daily lives, in their professional lives when they go around and use personal information, that's very very important," said Bamford.

Fiona Caldicott, chair of the National Information Governance Board for Health and Social Care, also spoke at the event, acknowledging that some within the NHS had experienced problems with the IG toolkit due to its complexity.

She said that the board plans to support and train people who are having difficulties with understanding the system. She also disclosed that the organisation, which is set to become part of the Care Quality Commission (CQC) in 2013 under proposals in the health and social care bill, was working on transitional guidance to help healthcare professionals with the changes to the NHS.

Caldicott said that NIGB will place ideas online in the next few weeks. "What we would like to do is publish it and then be very open to responses from the readership and those that wish to use it for more amendments," she said.

She also spoke of an emerging contradiction between health secretary Andrew Lansley's "mantra" of 'no decision about me, without me' and the delivery of good quality information governance.

"That is not a simple concept, and I think one of the things we have to think about is how the issues of information governance fit with that statement and how members of the public understand what we're doing with their data," said Caldicott, adding that it was important with information to give them patients "the assurance that this is fully safeguarded within the services with which they present".

This article was originally published at Guardian Government Computing.

Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.

Remote control for virtualized desktops

More from The Register

next story
Bladerunner sequel might actually be good. Harrison Ford is in it
Go ahead, you're all clear, kid... Sorry, wrong film
Euro Parliament VOTES to BREAK UP GOOGLE. Er, OK then
It CANNA do it, captain.They DON'T have the POWER!
Musicians sue UK.gov over 'zero pay' copyright fix
Everyone else in Europe compensates us - why can't you?
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Megaupload overlord Kim Dotcom: The US HAS RADICALISED ME!
Now my lawyers have bailed 'cos I'm 'OFFICIALLY' BROKE
Forget Hillary, HP's ex CARLY FIORINA 'wants to be next US Prez'
Former CEO has political ambitions again, according to Washington DC sources
prev story

Whitepapers

10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Choosing a cloud hosting partner with confidence
Download Choosing a Cloud Hosting Provider with Confidence to learn more about cloud computing - the new opportunities and new security challenges.