A defunct NHS board has been posthumously fined £200,000 after thousands of patients' records were found on a second-hand computer sold on eBay.

The Information Commissioner's Office (ICO) slapped NHS Surrey with the fine because they failed to ensure that 3,000 records were wiped off a computer before it was flogged.

A member of the public bought the computer in March 2012 and immediately phoned the health board to complain. When NHS bods picked up the hardware, they found it was packed with confidential sensitive personal data and HR records, including patient records relating to approximately 900 adults and 2000 children.

The breach was blamed on the IT security firm NHS Surrey employed from March 2010 to get rid of their knackered computers. The unnamed company did not charge for its service, on the basis that it was allowed to sell off any salvageable parts as long as the hard drives were securely wiped.

But the health board did not sign a contract with the firm which clearly explained its legal requirements under the Data Protection Act. The board also "failed to observe and monitor the data destruction process".

Panicked apparatchiks quickly reclaimed 39 computers from the IT destruction firm and found that three still contained sensitive personal data.

The ICO found that NHS Surrey also "mislaid" records pertaining to the destruction of all computers between March 2010 and February 2011. The board was only able to confirm that 1,570 computers were processed between 10 February 2011 and 28 May 2012. The data destruction company was unable to say where the computers ended up or confirm how many might still contain personal data.

Stephen Eckersley, ICO head of enforcement, said: “The facts of this breach are truly shocking. NHS Surrey chose to leave an approved provider and handed over thousands of patients’ details to a company without checking that the information had been securely deleted. The result was that patients’ information was effectively being sold online.

“This breach is one of the most serious the ICO has witnessed and the penalty reflects the disturbing circumstances of the case. We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.”

NHS Surrey has been broken up into six clinical commissioning groups, which means that the fine will be paid by NHS England - a centralised body which used to be called the NHS Commissioning Board.

Unless NHS England appeals, it will have to pay the £200,000 by July 19.

The cash is paid into the Treasury's Consolidated Fund, which is the government's main bank account.

Just in case anyone from NHS Surrey is reading, here's a wee ICO briefing on how to get rid of computers packed full of sensitive information. ®