Feeds

UK.gov fines itself harshly for hurling NHS records to the winds

Even managed to lose records showing how many records were lost

  • alert
  • submit to reddit

Gartner critical capabilities for enterprise endpoint backup

A defunct NHS board has been posthumously fined £200,000 after thousands of patients' records were found on a second-hand computer sold on eBay.

The Information Commissioner's Office (ICO) slapped NHS Surrey with the fine because they failed to ensure that 3,000 records were wiped off a computer before it was flogged.

A member of the public bought the computer in March 2012 and immediately phoned the health board to complain. When NHS bods picked up the hardware, they found it was packed with confidential sensitive personal data and HR records, including patient records relating to approximately 900 adults and 2000 children.

The breach was blamed on the IT security firm NHS Surrey employed from March 2010 to get rid of their knackered computers. The unnamed company did not charge for its service, on the basis that it was allowed to sell off any salvageable parts as long as the hard drives were securely wiped.

But the health board did not sign a contract with the firm which clearly explained its legal requirements under the Data Protection Act. The board also "failed to observe and monitor the data destruction process".

Panicked apparatchiks quickly reclaimed 39 computers from the IT destruction firm and found that three still contained sensitive personal data.

The ICO found that NHS Surrey also "mislaid" records pertaining to the destruction of all computers between March 2010 and February 2011. The board was only able to confirm that 1,570 computers were processed between 10 February 2011 and 28 May 2012. The data destruction company was unable to say where the computers ended up or confirm how many might still contain personal data.

Stephen Eckersley, ICO head of enforcement, said: “The facts of this breach are truly shocking. NHS Surrey chose to leave an approved provider and handed over thousands of patients’ details to a company without checking that the information had been securely deleted. The result was that patients’ information was effectively being sold online.

“This breach is one of the most serious the ICO has witnessed and the penalty reflects the disturbing circumstances of the case. We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.”

NHS Surrey has been broken up into six clinical commissioning groups, which means that the fine will be paid by NHS England - a centralised body which used to be called the NHS Commissioning Board.

Unless NHS England appeals, it will have to pay the £200,000 by July 19.

The cash is paid into the Treasury's Consolidated Fund, which is the government's main bank account.

Just in case anyone from NHS Surrey is reading, here's a wee ICO briefing on how to get rid of computers packed full of sensitive information. ®

Gartner critical capabilities for enterprise endpoint backup

More from The Register

next story
'Stop dissing Google or quit': OK, I quit, says Code Club co-founder
And now a message from our sponsors: 'STFU or else'
Top beak: UK privacy law may be reconsidered because of social media
Rise of Twitter etc creates 'enormous challenges'
Ex US cybersecurity czar guilty in child sex abuse website case
Health and Human Services IT security chief headed online to share vile images
Uber, Lyft and cutting corners: The true face of the Sharing Economy
Casual labour and tired ideas = not really web-tastic
Don't even THINK about copyright violation, says Indian state
Pre-emptive arrest for pirates in Karnataka
The police are WRONG: Watching YouTube videos is NOT illegal
And our man Corfield is pretty bloody cross about it
Oz biz regulator discovers shared servers in EPIC FACEPALM
'Not aware' that one IP can hold more than one Website
Apple tried to get a ban on Galaxy, judge said: NO, NO, NO
Judge Koh refuses Samsung ban for the third time
prev story

Whitepapers

Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Backing up distributed data
Eliminating the redundant use of bandwidth and storage capacity and application consolidation in the modern data center.
The essential guide to IT transformation
ServiceNow discusses three IT transformations that can help CIOs automate IT services to transform IT and the enterprise
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.