NHS hit by new data losses

Published on 23/08/2008 22:07

THE loss of confidential personal data has become so widespread that patients' groups last night launched a campaign to tighten up security in the NHS.

The move comes as Scotland on Sunday reveals hundreds of cases of breaches concerning patients' notes. Two lost USB computer memory sticks containing clinical information are among almost 200 cases of missing patient data in the past three years, Scottish health boards have admitted.

The memory sticks were stolen from an office at NHS Dumfries and Galloway in May. The disclosure, released following a Freedom of Information request by this newspaper, follows a series of damning revelations about missing personal data that have shaken public confidence in Government computer systems.

Yesterday a spokesman for NHS Dumfries and Galloway insisted individuals could not be identified from the missing clinical information because their names were not recorded in the files.

But other breaches of patient confidentiality across the country range from staff leaving notes lying around to theft of computers. They include:

&149 Six cases of stolen IT equipment in NHS Lanarkshire;

&149 Two break-ins where computers were stolen in NHS Fife;

&149 Health visitor patient records reported missing in transit by NHS Lothian;

&#149 Patient notes being left in laundry trolleys, dining rooms and photocopiers by staff at NHS Borders.

Although many of the cases involved the notes of individual patients, some concerned electronic files which can potentially hold the details of thousands of individuals.

Last night Margaret Watt, chairwoman of the Scotland Patients Association, said: "This is totally unacceptable and it is happening so much it has become a campaign issue for us. Patients should be made aware of these breaches."

Scottish Conservative health spokeswoman Mary Scanlon said the disclosures "made a mockery" of patient confidentiality. She added: "Scottish patients have a right to expect that their records should be safe in the hands of the NHS."

The reports from Scotland's NHS boards reveal a total of 192 cases in the last three years where patient notes, medical letters and personal information on paper or computer files went missing.

NHS Grampian recorded the highest number of cases where confidential data was lost, stolen or went missing, with a total of 67 cases in the last three years. In NHS Borders there was a total of 32 incidents where the board admits "personal information was compromised". NHS Lothian recorded 24. NHS Lanarkshire has reported 21 incidents, of which six involved the theft of IT equipment and 15 involved lost or missing case notes or correspondence.

Yesterday, NHS boards defended their policies and said the high number of reported incidents was due to high staff awareness of the seriousness of data protection.

A spokeswoman for NHS Grampian said: "We take the security of data very seriously. The vast majority of these instances relate to data being misplaced – not lost or stolen."

A spokeswoman for NHS Borders said: "We encourage staff to report every single incident of data being found in inappropriate places."

Alan Boyter, NHS Lothian director of human resources and organisational development, said: "We take data safety very seriously and have a major campaign underway to highlight the risks and consequences of not following the rules."

MINISTER BLAMES PRIVATE CONTRACTOR

HOME OFFICE minister Tony McNulty yesterday blamed a private contractor for a breach of security involving the details of thousands of prisoners

A memory stick reported missing last week contained information on all 84,000 prisoners in England and Wales.

The lost computer files also contain the names, addresses and dates of birth of 30,000 people with six or more convictions in the last year, as well as the names and dates of birth of 10,000 offenders regarded as prolific, and the initials of people on drug treatment programmes.

McNulty said the loss of the data was the fault of private contractor PA Consulting which downloaded the information onto a memory stick, breaching security rules.

He said there had "clearly been a breach" of data security rules "not by the Home Office but by the private contractor".

He added: "I think this particular breach in terms of the memory stick is absolutely unforgivable and we need to deal with it."