Feeds

UK.gov fines itself harshly for hurling NHS records to the winds

Even managed to lose records showing how many records were lost

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

A defunct NHS board has been posthumously fined £200,000 after thousands of patients' records were found on a second-hand computer sold on eBay.

The Information Commissioner's Office (ICO) slapped NHS Surrey with the fine because they failed to ensure that 3,000 records were wiped off a computer before it was flogged.

A member of the public bought the computer in March 2012 and immediately phoned the health board to complain. When NHS bods picked up the hardware, they found it was packed with confidential sensitive personal data and HR records, including patient records relating to approximately 900 adults and 2000 children.

The breach was blamed on the IT security firm NHS Surrey employed from March 2010 to get rid of their knackered computers. The unnamed company did not charge for its service, on the basis that it was allowed to sell off any salvageable parts as long as the hard drives were securely wiped.

But the health board did not sign a contract with the firm which clearly explained its legal requirements under the Data Protection Act. The board also "failed to observe and monitor the data destruction process".

Panicked apparatchiks quickly reclaimed 39 computers from the IT destruction firm and found that three still contained sensitive personal data.

The ICO found that NHS Surrey also "mislaid" records pertaining to the destruction of all computers between March 2010 and February 2011. The board was only able to confirm that 1,570 computers were processed between 10 February 2011 and 28 May 2012. The data destruction company was unable to say where the computers ended up or confirm how many might still contain personal data.

Stephen Eckersley, ICO head of enforcement, said: “The facts of this breach are truly shocking. NHS Surrey chose to leave an approved provider and handed over thousands of patients’ details to a company without checking that the information had been securely deleted. The result was that patients’ information was effectively being sold online.

“This breach is one of the most serious the ICO has witnessed and the penalty reflects the disturbing circumstances of the case. We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.”

NHS Surrey has been broken up into six clinical commissioning groups, which means that the fine will be paid by NHS England - a centralised body which used to be called the NHS Commissioning Board.

Unless NHS England appeals, it will have to pay the £200,000 by July 19.

The cash is paid into the Treasury's Consolidated Fund, which is the government's main bank account.

Just in case anyone from NHS Surrey is reading, here's a wee ICO briefing on how to get rid of computers packed full of sensitive information. ®

Beginner's guide to SSL certificates

More from The Register

next story
Facebook pays INFINITELY MORE UK corp tax than in 2012
Thanks for the £3k, Zuck. Doh! you're IN CREDIT. Guess not
Happiness economics is bollocks. Oh, UK.gov just adopted it? Er ...
Opportunity doesn't knock; it costs us instead
YARR! Pirates walk the plank: DMCA magnets sink in Google results
Spaffing copyrighted stuff over the web? No search ranking for you
In the next four weeks, 100 people will decide the future of the web
While America tucks into Thanksgiving turkey, the world will be taking over the net
Microsoft EU warns: If you have ties to the US, Feds can get your data
European corps can't afford to get complacent while American Big Biz battles Uncle Sam
Don't bother telling people if you lose their data, say Euro bods
You read that right – with the proviso that it's encrypted
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.