Medical files found on disks bought on eBay

Published on Thursday 7 May 2009 22:07

CONFIDENTIAL Scottish patient medical records have been found on a second-hand hard drive bought on the internet.

Security researchers working for BT bought hard drives from the UK, the United States, Germany, France and Australia through computer auctions, technology fairs and eBay.

They revealed yesterday that more than 300 hard drives were studied, two of which uncovered images of X-rays, medical staff shifts and confidential letters from the Monklands and Hairmyres hospitals in Lanarkshire. Other sensitive information retrieved included the launch procedures for a US military missile air defence system used to shoot down Scud missiles in Iraq.

Dr Andy Jones, head of information security research at BT, who led the survey, said: "This is the fourth time we have carried out this research and it is clear that a majority of organisations and private individuals still have no idea about the potential volume and type of information that is stored on computer hard disks.

"For a very large proportion of the disks we looked at we found enough information to expose both individuals and companies to a range of potential crimes such as fraud, blackmail and identity theft."

An NHS Lanarkshire spokeswoman said the hard disks were disposed of in 2006 via a contractor that disposed of redundant computer equipment. She did not know how they ended up on the internet. No legal action is being taken, as the company has gone bust.

All equipment containing data is now destroyed on NHS premises in the presence of witnesses, and the trust has also banned the use of unencrypted memory sticks. All NHS laptops are also being encrypted. "In this instance, the hard drives had been subjected to a basic level of data removal by the company and had then been disposed of inappropriately," she said.