Feeds

UK.gov fines itself harshly for hurling NHS records to the winds

Even managed to lose records showing how many records were lost

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

A defunct NHS board has been posthumously fined £200,000 after thousands of patients' records were found on a second-hand computer sold on eBay.

The Information Commissioner's Office (ICO) slapped NHS Surrey with the fine because they failed to ensure that 3,000 records were wiped off a computer before it was flogged.

A member of the public bought the computer in March 2012 and immediately phoned the health board to complain. When NHS bods picked up the hardware, they found it was packed with confidential sensitive personal data and HR records, including patient records relating to approximately 900 adults and 2000 children.

The breach was blamed on the IT security firm NHS Surrey employed from March 2010 to get rid of their knackered computers. The unnamed company did not charge for its service, on the basis that it was allowed to sell off any salvageable parts as long as the hard drives were securely wiped.

But the health board did not sign a contract with the firm which clearly explained its legal requirements under the Data Protection Act. The board also "failed to observe and monitor the data destruction process".

Panicked apparatchiks quickly reclaimed 39 computers from the IT destruction firm and found that three still contained sensitive personal data.

The ICO found that NHS Surrey also "mislaid" records pertaining to the destruction of all computers between March 2010 and February 2011. The board was only able to confirm that 1,570 computers were processed between 10 February 2011 and 28 May 2012. The data destruction company was unable to say where the computers ended up or confirm how many might still contain personal data.

Stephen Eckersley, ICO head of enforcement, said: “The facts of this breach are truly shocking. NHS Surrey chose to leave an approved provider and handed over thousands of patients’ details to a company without checking that the information had been securely deleted. The result was that patients’ information was effectively being sold online.

“This breach is one of the most serious the ICO has witnessed and the penalty reflects the disturbing circumstances of the case. We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.”

NHS Surrey has been broken up into six clinical commissioning groups, which means that the fine will be paid by NHS England - a centralised body which used to be called the NHS Commissioning Board.

Unless NHS England appeals, it will have to pay the £200,000 by July 19.

The cash is paid into the Treasury's Consolidated Fund, which is the government's main bank account.

Just in case anyone from NHS Surrey is reading, here's a wee ICO briefing on how to get rid of computers packed full of sensitive information. ®

Intelligent flash storage arrays

More from The Register

next story
WHY did Sunday Mirror stoop to slurping selfies for smut sting?
Tabloid splashes, MP resigns - but there's a BIG copyright issue here
Spies, avert eyes! Tim Berners-Lee demands a UK digital bill of rights
Lobbies tetchy MPs 'to end indiscriminate online surveillance'
How the FLAC do I tell MP3s from lossless audio?
Can you hear the difference? Can anyone?
Inequality increasing? BOLLOCKS! You heard me: 'Screw the 1%'
There's morality and then there's economics ...
Google hits back at 'Dear Rupert' over search dominance claims
Choc Factory sniffs: 'We're not pirate-lovers - also, you publish The Sun'
EU to accuse Ireland of giving Apple an overly peachy tax deal – report
Probe expected to say single-digit rate was unlawful
While you queued for an iPhone 6, Apple's Cook sold shares worth $35m
Right before the stock took a 3.8% dive amid bent and broken mobe drama
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.