Feeds

ICO: NHS data security breaches are just 'plain daft'

As bad as gossiping about patients down the pub, says watchdog

Application security programs and practises

NHS staff should be more aware of data security risks as patient confidentiality "is at the heart of what they do", Jonathan Bamford, head of strategic liaison at the Information Commissioner's Office has said.

Speaking at an event on healthcare efficiency, he said that he was confounded by the disconnect between staff awareness on the subject and the number of breaches that occur in the health service.

"The conundrum for me is that those very same people who wouldn't dream of chatting about patient information at Costa Coffee or down the curry house on a Friday evening, or down the Coach and Horses, are the very same people who are losing memory sticks with lots of information on it, who are doing daft things with people's personal information," Bamford, to the Healthcare Efficiency Through Technology event in London.

"Why is there that disconnect there? Why have things fallen down in that way?" he asked. "Because I don't believe that any of those people who are involved in those security blunders are ill informed in terms of the need to look after people's information, or information that is entrusted to them."

He used the Dartford and Gravesham trust's data security issues as an example of lax data security awareness within the NHS. The ICO recently took action against the trust after it mistakenly destroyed 10,000 health records that were left in a destruction room, because the archiving room was full. He said that these kind of breaches occur because people find "work-arounds" such as someone logging into a computer and then allowing colleagues to use the same access.

Bamford explained that it was important for the NHS to realise that security was not all about technical measures, but about organisational changes as well. "It's about standards that are set by organisations, it's about what people are told. You have to ensure the reliability of staff that have access to information and data," he added.

He said that there are lots of issues that need to be addressed, but stressed that the situation could be improved.

"Information governance is at the heart of this and there are lots of lessons we can learn from the data losses over the years. We're really great supporters of the information governance (IG) toolkit and the fact there is a lot of effort put into that, but there has to be something which is meaningful that people embrace in their daily lives, in their professional lives when they go around and use personal information, that's very very important," said Bamford.

Fiona Caldicott, chair of the National Information Governance Board for Health and Social Care, also spoke at the event, acknowledging that some within the NHS had experienced problems with the IG toolkit due to its complexity.

She said that the board plans to support and train people who are having difficulties with understanding the system. She also disclosed that the organisation, which is set to become part of the Care Quality Commission (CQC) in 2013 under proposals in the health and social care bill, was working on transitional guidance to help healthcare professionals with the changes to the NHS.

Caldicott said that NIGB will place ideas online in the next few weeks. "What we would like to do is publish it and then be very open to responses from the readership and those that wish to use it for more amendments," she said.

She also spoke of an emerging contradiction between health secretary Andrew Lansley's "mantra" of 'no decision about me, without me' and the delivery of good quality information governance.

"That is not a simple concept, and I think one of the things we have to think about is how the issues of information governance fit with that statement and how members of the public understand what we're doing with their data," said Caldicott, adding that it was important with information to give them patients "the assurance that this is fully safeguarded within the services with which they present".

This article was originally published at Guardian Government Computing.

Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.

HP ProLiant Gen8: Integrated lifecycle automation

More from The Register

next story
Arrr: Freetard-bothering Digital Economy Act tied up, thrown in the hold
Ministry of Fun confirms: Yes, we're busy doing nothing
ONE EMAIL costs mining company $300 MEEELION
Environmental activist walks free after hoax sent share price over a cliff
'Blow it up': Plods pop round for chat with Commonwealth Games tweeter
You'd better not be talking about the council's housing plans
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
Apple smacked with privacy sueball over Location Services
Class action launched on behalf of 100 million iPhone owners
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
You! Pirate! Stop pirating, or we shall admonish you politely. Repeatedly, if necessary
And we shall go about telling people you smell. No, not really
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Securing Web Applications Made Simple and Scalable
Learn how automated security testing can provide a simple and scalable way to protect your web applications.