IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

NHS loses more sensitive data

A junior doctor working at East & North Hertfordshire NHS Trust has lost a USB stick, containing sensitive data, on a train.

USB

Another NHS Trust has misplaced an unencrypted USB stick containing sensitive data.

The East & North Hertfordshire NHS Trust has been found in breach of the Data Protection Act after the device was lost on a train.

A junior doctor accidentally took the stick home with him, according to the Information Commissioner's Office (ICO), which discovered the doctor in question had not been made aware of the Trust's data protection policies.

Furthermore, the doctor did not have access to email to receive policy reminders and updates, whilst no technical measures were in place to prevent misuse of portable devices.

The stick, which was passed between doctors, contained brief details of patients' conditions and medication.

"Storing sensitive personal data on unencrypted data sticks is a risk Trusts should not be willing to take," said Mick Gorrill, head of enforcement at the ICO.

"If it is vital to store information for handover, this must be

done with the highest security measures in place. Furthermore, it is vital that employees are fully aware of processes which could have prevented this incident from occurring."

The Trust's chief executive has subsequently signed an undertaking to ensure policy on portable device use is clear. The body is also now required to regularly monitor compliance with security procedures and implement appropriate safeguards.

The NHS has been under the spotlight numerous times for losing devices. A recent case saw Royal Wolverhampton Hospitals NHS Trust rapped by the ICO for leaving a CD at a bus stop.

However, despite numerous incidents, the ICO has still yet to impose a fine on the NHS.

Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group, said the undertaking ordered on the East & North Hertfordshire NHS Trust was vague.

"The undertakings were on non-specific issues. If they were on the specific USB matter, they would be much more effective," Room told IT PRO.

Room said it "beggars belief" the NHS is still using unencrypted USB drives.

"[The NHS] is being dealt the loosest form of sanction," he added.

"At some point the NHS is going to be fined, but when are we going to do that?"

Room also pointed to the repeated use of undertakings, rather than fines, claiming it was "like Groundhog Day."

Featured Resources

Four strategies for building a hybrid workplace that works

All indications are that the future of work is hybrid, if it's not here already

Free webinar

The digital marketer’s guide to contextual insights and trends

How to use contextual intelligence to uncover new insights and inform strategies

Free Download

Ransomware and Microsoft 365 for business

What you need to know about reducing ransomware risk

Free Download

Building a modern strategy for analytics and machine learning success

Turning into business value

Free Download

Recommended

MoJ faces £17.5m GDPR fine over subject access request backlog
data protection

MoJ faces £17.5m GDPR fine over subject access request backlog

20 Jan 2022
Cabinet Office fined £500,000 for New Year Honours data leak
data breaches

Cabinet Office fined £500,000 for New Year Honours data leak

3 Dec 2021
ICO publishes new data protection standards for the adtech industry
data protection

ICO publishes new data protection standards for the adtech industry

25 Nov 2021
Secretary of State retires NHS Digital and NHSX
public sector

Secretary of State retires NHS Digital and NHSX

23 Nov 2021

Most Popular

Windows Server admins say latest Patch Tuesday broke authentication policies
Server & storage

Windows Server admins say latest Patch Tuesday broke authentication policies

12 May 2022
16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
How full-stack observability can accelerate IT innovation
Sponsored

How full-stack observability can accelerate IT innovation

3 May 2022