Another NHS Trust has misplaced an unencrypted USB stick containing sensitive data.
The East & North Hertfordshire NHS Trust has been found in breach of the Data Protection Act after the device was lost on a train.
A junior doctor accidentally took the stick home with him, according to the Information Commissioner's Office (ICO), which discovered the doctor in question had not been made aware of the Trust's data protection policies.
Furthermore, the doctor did not have access to email to receive policy reminders and updates, whilst no technical measures were in place to prevent misuse of portable devices.
The stick, which was passed between doctors, contained brief details of patients' conditions and medication.
"Storing sensitive personal data on unencrypted data sticks is a risk Trusts should not be willing to take," said Mick Gorrill, head of enforcement at the ICO.
"If it is vital to store information for handover, this must be
done with the highest security measures in place. Furthermore, it is vital that employees are fully aware of processes which could have prevented this incident from occurring."
The Trust's chief executive has subsequently signed an undertaking to ensure policy on portable device use is clear. The body is also now required to regularly monitor compliance with security procedures and implement appropriate safeguards.
The NHS has been under the spotlight numerous times for losing devices. A recent case saw Royal Wolverhampton Hospitals NHS Trust rapped by the ICO for leaving a CD at a bus stop.
However, despite numerous incidents, the ICO has still yet to impose a fine on the NHS.
Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group, said the undertaking ordered on the East & North Hertfordshire NHS Trust was vague.
"The undertakings were on non-specific issues. If they were on the specific USB matter, they would be much more effective," Room told IT PRO.
Room said it "beggars belief" the NHS is still using unencrypted USB drives.
"[The NHS] is being dealt the loosest form of sanction," he added.
"At some point the NHS is going to be fined, but when are we going to do that?"
Room also pointed to the repeated use of undertakings, rather than fines, claiming it was "like Groundhog Day."
-
The IT industry’s shift to circular, low-carbon solutionsMaximize your hardware investment and reach your sustainability goals with HP’s Renew Solutions
-
Lenovo ThinkPad X9 14 Aura Edition reviewReviews This thin and light ultraportable will draw you in with its vibrant screen – but it isn't as powerful as some of its competitors
-
NHS supplier hit with £3m fine for security failings that led to attackNews Advanced Computer Software Group lacked MFA, comprehensive vulnerability scanning and proper patch management
-
Cyber attack delayed cancer treatment at NHS hospital
News A cyber attack at Wirral University Teaching Hospital in 2024 delayed critical cancer treatment for patients, documents show.
-
Alder Hey Children’s Hospital confirms hackers gained access to patient data through digital gateway serviceNews Europe’s busiest children’s hospital confirmed attackers were able to steal data from a compromised digital gateway service
-
Major incident declared as Merseyside hospitals hit by cyber attackNews The incident, which has led to cancelled appointments, is just the latest in a series of attacks on healthcare organizations
-
AI recruitment tools are still a privacy nightmare – here's how the ICO plans to crack down on misuseNews The ICO has issued guidance for recruiters and AI developers after finding that many are mishandling data
-
“You must do better”: Information Commissioner John Edwards calls on firms to beef up support for data breach victimsNews Companies need to treat victims with swift, practical action, according to the ICO
-
LinkedIn backtracks on AI training rules after user backlashNews UK-based LinkedIn users will now get the same protections as those elsewhere in Europe
-
UK's data protection watchdog deepens cooperation with National Crime AgencyNews The two bodies want to improve the support given to organizations experiencing cyber attacks and ransomware recovery
