Feeds

ICO: NHS data security breaches are just 'plain daft'

As bad as gossiping about patients down the pub, says watchdog

Intelligent flash storage arrays

NHS staff should be more aware of data security risks as patient confidentiality "is at the heart of what they do", Jonathan Bamford, head of strategic liaison at the Information Commissioner's Office has said.

Speaking at an event on healthcare efficiency, he said that he was confounded by the disconnect between staff awareness on the subject and the number of breaches that occur in the health service.

"The conundrum for me is that those very same people who wouldn't dream of chatting about patient information at Costa Coffee or down the curry house on a Friday evening, or down the Coach and Horses, are the very same people who are losing memory sticks with lots of information on it, who are doing daft things with people's personal information," Bamford, to the Healthcare Efficiency Through Technology event in London.

"Why is there that disconnect there? Why have things fallen down in that way?" he asked. "Because I don't believe that any of those people who are involved in those security blunders are ill informed in terms of the need to look after people's information, or information that is entrusted to them."

He used the Dartford and Gravesham trust's data security issues as an example of lax data security awareness within the NHS. The ICO recently took action against the trust after it mistakenly destroyed 10,000 health records that were left in a destruction room, because the archiving room was full. He said that these kind of breaches occur because people find "work-arounds" such as someone logging into a computer and then allowing colleagues to use the same access.

Bamford explained that it was important for the NHS to realise that security was not all about technical measures, but about organisational changes as well. "It's about standards that are set by organisations, it's about what people are told. You have to ensure the reliability of staff that have access to information and data," he added.

He said that there are lots of issues that need to be addressed, but stressed that the situation could be improved.

"Information governance is at the heart of this and there are lots of lessons we can learn from the data losses over the years. We're really great supporters of the information governance (IG) toolkit and the fact there is a lot of effort put into that, but there has to be something which is meaningful that people embrace in their daily lives, in their professional lives when they go around and use personal information, that's very very important," said Bamford.

Fiona Caldicott, chair of the National Information Governance Board for Health and Social Care, also spoke at the event, acknowledging that some within the NHS had experienced problems with the IG toolkit due to its complexity.

She said that the board plans to support and train people who are having difficulties with understanding the system. She also disclosed that the organisation, which is set to become part of the Care Quality Commission (CQC) in 2013 under proposals in the health and social care bill, was working on transitional guidance to help healthcare professionals with the changes to the NHS.

Caldicott said that NIGB will place ideas online in the next few weeks. "What we would like to do is publish it and then be very open to responses from the readership and those that wish to use it for more amendments," she said.

She also spoke of an emerging contradiction between health secretary Andrew Lansley's "mantra" of 'no decision about me, without me' and the delivery of good quality information governance.

"That is not a simple concept, and I think one of the things we have to think about is how the issues of information governance fit with that statement and how members of the public understand what we're doing with their data," said Caldicott, adding that it was important with information to give them patients "the assurance that this is fully safeguarded within the services with which they present".

This article was originally published at Guardian Government Computing.

Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.

Internet Security Threat Report 2014

More from The Register

next story
Facebook, Apple: LADIES! Why not FREEZE your EGGS? It's on the company!
No biological clockwatching when you work in Silicon Valley
Lords take revenge on REVENGE PORN publishers
Jilted Johns and Jennies with busy fingers face two years inside
Yes, yes, Steve Jobs. Look what I'VE done for you lately – Tim Cook
New iPhone biz baron points to Apple's (his) greatest successes
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
Ex-US Navy fighter pilot MIT prof: Drones beat humans - I should know
'Missy' Cummings on UAVs, smartcars and dying from boredom
Sysadmin with EBOLA? Gartner's issued advice to debug your biz
Start hoarding cleaning supplies, analyst firm says, and assume your team will scatter
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.