Another NHS Trust has misplaced an unencrypted USB stick containing sensitive data.
The East & North Hertfordshire NHS Trust has been found in breach of the Data Protection Act after the device was lost on a train.
A junior doctor accidentally took the stick home with him, according to the Information Commissioner's Office (ICO), which discovered the doctor in question had not been made aware of the Trust's data protection policies.
Furthermore, the doctor did not have access to email to receive policy reminders and updates, whilst no technical measures were in place to prevent misuse of portable devices.
The stick, which was passed between doctors, contained brief details of patients' conditions and medication.
"Storing sensitive personal data on unencrypted data sticks is a risk Trusts should not be willing to take," said Mick Gorrill, head of enforcement at the ICO.
"If it is vital to store information for handover, this must be
done with the highest security measures in place. Furthermore, it is vital that employees are fully aware of processes which could have prevented this incident from occurring."
The Trust's chief executive has subsequently signed an undertaking to ensure policy on portable device use is clear. The body is also now required to regularly monitor compliance with security procedures and implement appropriate safeguards.
The NHS has been under the spotlight numerous times for losing devices. A recent case saw Royal Wolverhampton Hospitals NHS Trust rapped by the ICO for leaving a CD at a bus stop.
However, despite numerous incidents, the ICO has still yet to impose a fine on the NHS.
Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group, said the undertaking ordered on the East & North Hertfordshire NHS Trust was vague.
"The undertakings were on non-specific issues. If they were on the specific USB matter, they would be much more effective," Room told IT PRO.
Room said it "beggars belief" the NHS is still using unencrypted USB drives.
"[The NHS] is being dealt the loosest form of sanction," he added.
"At some point the NHS is going to be fined, but when are we going to do that?"
Room also pointed to the repeated use of undertakings, rather than fines, claiming it was "like Groundhog Day."
-
New chapter, same partners: Keeping the channel aligned with changeIndustry Insights How to maintain strong channel partnerships amid evolving strategies and market change
-
Palo Alto Networks snaps up CyberArk in identity security pushNews The acquisition marks the latest in a string for Palo Alto Networks
-
23andMe 'failed to take basic steps' to safeguard customer dataNews The ICO has strong criticism for the way the genetic testing company responded to a 2023 breach.
-
Two more NHS Trusts have been hit with cyber attacks – here’s what we know so farNews A flaw in a third-party device management tool appears to be the source of the incident
-
NHS England launches cyber charter to shore up vendor security practices
News Voluntary charter follows a series of high-profile ransomware attacks
-
NHS supplier hit with £3m fine for security failings that led to attack
News Advanced Computer Software Group lacked MFA, comprehensive vulnerability scanning and proper patch management
-
Cyber attack delayed cancer treatment at NHS hospital
News A cyber attack at Wirral University Teaching Hospital in 2024 delayed critical cancer treatment for patients, documents show.
-
Alder Hey Children’s Hospital confirms hackers gained access to patient data through digital gateway serviceNews Europe’s busiest children’s hospital confirmed attackers were able to steal data from a compromised digital gateway service
-
Major incident declared as Merseyside hospitals hit by cyber attackNews The incident, which has led to cancelled appointments, is just the latest in a series of attacks on healthcare organizations
-
AI recruitment tools are still a privacy nightmare – here's how the ICO plans to crack down on misuseNews The ICO has issued guidance for recruiters and AI developers after finding that many are mishandling data
