The NHS has yet again been found in breach of the Data Protection Act (DPA) after personal data of 87 patients was lost.
A medical student on placement at the University Hospital of South Manchester NHS Foundation Trust copied data onto a personal, unencrypted memory stick for research purposes.
HS bodies have a duty to make sure their staff both permanent and temporary understand their responsibilities on day one in the job.
It was then lost in December last year. The hopsital had assumed the student had received the appropriate training and so decided not to refresh them on their data protection practices, the Information Commissioner's Office (ICO) discovered.
"Medics handle some of the most sensitive personal information possible and it is vital that they understand the need to keep it secure at all times, especially when they are completing placements at several health organisations," said Sally Anne Poole, acting head of enforcement at the ICO.
"NHS bodies have a duty to make sure their staff both permanent and temporary understand their responsibilities on day one in the job."
The hospital has moved to ensure students are aware of its data protection policy.
Another undertaking has been signed by the London Ambulance Service, which breached the DPA after a personal laptop containing data relating to 2,664 patients was stolen from a contractor's home.
The NHS has repeatedly been caught out by the ICO, yet the data protection watchdog has been reluctant to issue a fine, possibly because of the nature of the body's work.
The last fine handed out by the ICO was in June, when Surrey County Council was hit with a 120,000 penalty. The local authority misdirected emails containing sensitive data on three separate occasions.
