Feeds

ICO: NHS data security breaches are just 'plain daft'

As bad as gossiping about patients down the pub, says watchdog

Securing Web Applications Made Simple and Scalable

NHS staff should be more aware of data security risks as patient confidentiality "is at the heart of what they do", Jonathan Bamford, head of strategic liaison at the Information Commissioner's Office has said.

Speaking at an event on healthcare efficiency, he said that he was confounded by the disconnect between staff awareness on the subject and the number of breaches that occur in the health service.

"The conundrum for me is that those very same people who wouldn't dream of chatting about patient information at Costa Coffee or down the curry house on a Friday evening, or down the Coach and Horses, are the very same people who are losing memory sticks with lots of information on it, who are doing daft things with people's personal information," Bamford, to the Healthcare Efficiency Through Technology event in London.

"Why is there that disconnect there? Why have things fallen down in that way?" he asked. "Because I don't believe that any of those people who are involved in those security blunders are ill informed in terms of the need to look after people's information, or information that is entrusted to them."

He used the Dartford and Gravesham trust's data security issues as an example of lax data security awareness within the NHS. The ICO recently took action against the trust after it mistakenly destroyed 10,000 health records that were left in a destruction room, because the archiving room was full. He said that these kind of breaches occur because people find "work-arounds" such as someone logging into a computer and then allowing colleagues to use the same access.

Bamford explained that it was important for the NHS to realise that security was not all about technical measures, but about organisational changes as well. "It's about standards that are set by organisations, it's about what people are told. You have to ensure the reliability of staff that have access to information and data," he added.

He said that there are lots of issues that need to be addressed, but stressed that the situation could be improved.

"Information governance is at the heart of this and there are lots of lessons we can learn from the data losses over the years. We're really great supporters of the information governance (IG) toolkit and the fact there is a lot of effort put into that, but there has to be something which is meaningful that people embrace in their daily lives, in their professional lives when they go around and use personal information, that's very very important," said Bamford.

Fiona Caldicott, chair of the National Information Governance Board for Health and Social Care, also spoke at the event, acknowledging that some within the NHS had experienced problems with the IG toolkit due to its complexity.

She said that the board plans to support and train people who are having difficulties with understanding the system. She also disclosed that the organisation, which is set to become part of the Care Quality Commission (CQC) in 2013 under proposals in the health and social care bill, was working on transitional guidance to help healthcare professionals with the changes to the NHS.

Caldicott said that NIGB will place ideas online in the next few weeks. "What we would like to do is publish it and then be very open to responses from the readership and those that wish to use it for more amendments," she said.

She also spoke of an emerging contradiction between health secretary Andrew Lansley's "mantra" of 'no decision about me, without me' and the delivery of good quality information governance.

"That is not a simple concept, and I think one of the things we have to think about is how the issues of information governance fit with that statement and how members of the public understand what we're doing with their data," said Caldicott, adding that it was important with information to give them patients "the assurance that this is fully safeguarded within the services with which they present".

This article was originally published at Guardian Government Computing.

Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.

The smart choice: opportunity from uncertainty

More from The Register

next story
Yorkshire cops fail to grasp principle behind BT Fon Wi-Fi network
'Prevent people that are passing by to hook up to your network', pleads plod
UK government officially adopts Open Document Format
Microsoft insurgency fails, earns snarky remark from UK digital services head
Major problems beset UK ISP filth filters: But it's OK, nobody uses them
It's almost as though pr0n was actually rather popular
HP, Microsoft prove it again: Big Business doesn't create jobs
SMEs get lip service - what they need is dinner at the Club
ITC: Seagate and LSI can infringe Realtek patents because Realtek isn't in the US
Land of the (get off scot) free, when it's a foreign owner
MPs wave through Blighty's 'EMERGENCY' surveillance laws
Only 49 politcos voted against DRIP bill
Help yourself to anyone's photos FOR FREE, suggests UK.gov
Copyright law reforms will keep m'learned friends busy
prev story

Whitepapers

Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.