NHS has much to do on data security

The NHS has much to do on data security and is still making “far too many” mistakes in securing patients’ personal and sensitive information, says the Information Commissioner’s Office.

The ICO says it remains highly concerned that data breaches involving people’s personal information are continuing to occur in NHS organisations.

NHS Stoke on Trent and Basingstoke and North Hampshire NHS Foundation Trust are the latest NHS bodies that have been found to have breached the Data Protection Act.

NHS Stoke on Trent has been criticised for having potentially "destroyed or misfiled" about 2,000 paper physiotherapy records.

Basingstoke and North Hampshire NHS Foundation Trust, meanwhile, has been found to have emailed an Excel spreadsheet containing 917 patients' pathology results to a department with "no business need to have access to the excessive amount of clinical records."

The spreadsheet was not password protected and was sent via unsecured email.

The chief executives of both NHS organisations have signed formal undertakings outlining that they will process personal information in line with the DPA. The ICO says that a quarter of all data breaches reported to it are from the NHS.

Mick Gorrill, head of enforcement at the ICO, said: “Everyone makes mistakes, but regrettably there are far too many within the NHS.

"Health bodies must implement the appropriate procedures when storing and transferring patients’ sensitive personal information.”

NHS Stoke on Trent will apply physical security measures in respect of paper medical records, particularly when they are in transit.

Basingstoke and North Hampshire NHS Foundation Trust says it will only extract and transfer the minimum amount of personal information necessary for any processing requirement.

With immediate effect, it will encrypt all portable and mobile devices used to store and transmit personal data.