WIREDGOV

North Tees and Hartlepool NHS Foundation Trust has been ordered by the ICO to review its data protection policy after a file containing sensitive patient information was found at a bus stop.

It was one of a number of incidents over the last year which resulted in data being lost or disclosed without authorisation leading to an enforcement notice being issued to the Trust. Other incidents included letters, notes and reports containing patient data being sent to the wrong people.

Investigations carried out by the ICO revealed that at least one department had been knowingly breaching the organisation’s data protection policy on a regular basis, saying they found the rules around secure transportation of documents impractical.

Steve Eckersley, Head of Enforcement at the ICO said: “The careless way this highly sensitive personal information has been handled is embarrassing for the Trust involved.

“Even though the organisation had over-arching policies in place, they obviously weren’t being followed and didn’t seem to be suitable for every department. It’s important that every organisation not only has the correct policies and procedures in place but also that those policies are followed. That includes providing the right training for staff so everyone can take their data protection responsibilities seriously.

“An action plan was put in place after earlier breaches but clearly parts of the plan have been ineffective and after consideration we decided to issue an enforcement notice to improve compliance and to protect individuals.”

North Tees and Hartlepool NHS Foundation Trust enforcement notice

Notes to Editors

1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003.
3. The ICO is on Twitter, Facebook and LinkedIn. Read more in the ICO blog and e-newsletter.Our Press Office page provides more information for journalists.
4. Anyone who processes personal information must comply with eight principles of the Data Protection Act, which make sure that personal information is:

• Fairly and lawfully processed
• Processed for limited purposes
• Adequate, relevant and not excessive
• Accurate and up to date
• Not kept for longer than is necessary
• Processed in line with your rights
• Secure
• Not transferred to other countries without adequate protection

If you need more information, please contact the ICO press office on 0303 123 9070 or visit the website at: www.ico.org.uk.