Board rapped for losing patients' records

Published on Tuesday 28 July 2009 19:49

A HEALTH board has been criticised by data protection chiefs after patients' medical records were lost.

The Information Commissioner's Office (ICO) ruled that NHS Lothian breached the Data Protection Act.

An unencrypted USB memory stick containing details of 137 patients was lost last June. It belonged to an employee and should not have been used to ((store personal data held by NHS Lothian, the ICO said.

Also last June, a document wallet with 25 paper files about patients was left in a shop.

The ICO said that in both cases staff involved failed to comply with NHS Lothian security requirements.

The health board has undertaken to improve its data protection security.

Ken Macdonald, assistant information commissioner Scotland, said: "It is vital that people's personal details are handled securely in line with the Data Protection Act.I am pleased NHS Lothian is taking remedial action to improve data security."

The health board has agreed to ensure that portable and mobile devices, such as memory sticks, are encrypted and that networks are introduced to prevent unauthorised memory devices or computer systems being used to store patient data.