Feeds

UK.gov fines itself harshly for hurling NHS records to the winds

Even managed to lose records showing how many records were lost

  • alert
  • submit to reddit

Top three mobile application threats

A defunct NHS board has been posthumously fined £200,000 after thousands of patients' records were found on a second-hand computer sold on eBay.

The Information Commissioner's Office (ICO) slapped NHS Surrey with the fine because they failed to ensure that 3,000 records were wiped off a computer before it was flogged.

A member of the public bought the computer in March 2012 and immediately phoned the health board to complain. When NHS bods picked up the hardware, they found it was packed with confidential sensitive personal data and HR records, including patient records relating to approximately 900 adults and 2000 children.

The breach was blamed on the IT security firm NHS Surrey employed from March 2010 to get rid of their knackered computers. The unnamed company did not charge for its service, on the basis that it was allowed to sell off any salvageable parts as long as the hard drives were securely wiped.

But the health board did not sign a contract with the firm which clearly explained its legal requirements under the Data Protection Act. The board also "failed to observe and monitor the data destruction process".

Panicked apparatchiks quickly reclaimed 39 computers from the IT destruction firm and found that three still contained sensitive personal data.

The ICO found that NHS Surrey also "mislaid" records pertaining to the destruction of all computers between March 2010 and February 2011. The board was only able to confirm that 1,570 computers were processed between 10 February 2011 and 28 May 2012. The data destruction company was unable to say where the computers ended up or confirm how many might still contain personal data.

Stephen Eckersley, ICO head of enforcement, said: “The facts of this breach are truly shocking. NHS Surrey chose to leave an approved provider and handed over thousands of patients’ details to a company without checking that the information had been securely deleted. The result was that patients’ information was effectively being sold online.

“This breach is one of the most serious the ICO has witnessed and the penalty reflects the disturbing circumstances of the case. We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.”

NHS Surrey has been broken up into six clinical commissioning groups, which means that the fine will be paid by NHS England - a centralised body which used to be called the NHS Commissioning Board.

Unless NHS England appeals, it will have to pay the £200,000 by July 19.

The cash is paid into the Treasury's Consolidated Fund, which is the government's main bank account.

Just in case anyone from NHS Surrey is reading, here's a wee ICO briefing on how to get rid of computers packed full of sensitive information. ®

SANS - Survey on application security programs

More from The Register

next story
Putin tells Snowden: Russia conducts no US-style mass surveillance
Gov't is too broke for that, Russian prez says
Did a date calculation bug just cost hard-up Co-op Bank £110m?
And just when Brit banking org needs £400m to stay afloat
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Whoever you vote for, Google gets in
Report uncovers giant octopus squid of lobbying influence
Lavabit loses contempt of court appeal over protecting Snowden, customers
Judges rule complaints about government power are too little, too late
MtGox chief Karpelès refuses to come to US for g-men's grilling
Bitcoin baron says he needs another lawyer for FinCEN chat
Don't let no-hire pact suit witnesses call Steve Jobs a bullyboy, plead Apple and Google
'Irrelevant' character evidence should be excluded – lawyers
EFF: Feds plan to put 52 MILLION FACES into recognition database
System would identify faces as part of biometrics collection
Ex-Tony Blair adviser is new top boss at UK spy-hive GCHQ
Robert Hannigan to replace Sir Iain Lobban in the autumn
Banks slap Olympus with £160 MEEELLION lawsuit
Scandal hit camera maker just can't shake off its past
prev story

Whitepapers

Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.