Information Commissioner's Office
Garages, new homes and old offices: the records management mistakes that put health records at risk
Blog posted by: Leanne Doherty, Group Manager, 29 March 2017.
When Cabinet Office Minister Ben Gummer announced the government was spending £1.9bn on UK cyber security, he highlighted health data as needing strong protection.
But while money is (rightly) invested in hi-tech cyber security solutions in the health sector, our experience is that data breaches in the sector are often caused by far more basic mistakes.
Indeed, a quick look through the health cases seen by the ICO enforcement team suggests work to do around garages and decommissioning as well as gigabytes and denial of service attacks.
We’re all guilty of keeping things we don’t need in the back of the garage, but we’ve seen a surprising number of cases of health records being left among the half tins of paint and old furniture.
In Hertfordshire several boxes of documents relating to a care home were found in a derelict garage, including staff details, medication and other personal and sensitive personal data.
While late last year we had a similar case, but this time with old care home records found in a loft.
Having proper records tracking in place would have helped the care homes to realise records were missing, and be able to do something about it in a far more timely fashion. There’s top tips on record tracking as part of our new health resources.
You might think that sensitive paperwork would be near the top of the list of things to securely transport to a new home, but the examples we’ve seen suggest otherwise.
Take the locum doctor who took patient information home, and left it there when she moved house. The information included 11 pages of ward handover sheets including details of nearly 50 patients.
Or the case where the ICO was contacted by someone who’d found highly sensitive and confidential medical records left behind by a consultant anaesthetist. The previous owner had instructed a removal company to pack and remove everything and was unaware of any issue until contacted by the ICO.
The doctor had been sent the data in his capacity as a medical expert, but was given no advice about data security or retention schedules.
There’s a clear point about information being taken off site here. Our new health resources include posters reminding staff of the importance of seeing the value of personal data before taking it out of the office.
Leaving records behind is a trend when moving offices too. Only last week the ICO issued a fine to Norfolk County Council who’d left social care files in an old filing cabinet, which had found its way to a second hand shop.
It was a similar case in Staffordshire, when a Trust moved to a new premises, but left behind details from more than a thousand patient records, containing sensitive information
Fortunately the records were safely recovered from a locked room, but that didn’t prevent the Trust’s embarrassment, with a local newspaper story headlined “Private NHS files on vulnerable patients left in old centre”.
Again, better records tracking would have shown the trust the records were missing. There’s a video demonstrating the importance of records tracking to staff on our health resources page.
Latest News from
Information Commissioner's Office
ICO fines three companies £415,000 for nuisance marketing10/06/2021 12:25:00
The Information Commissioner’s Office (ICO) has fined three separate companies a total of £415,000 for sending nuisance marketing to people about car finance, solar panels and funeral plans.
Elizabeth Denham welcomes a delay to the launch of the GPDPR10/06/2021 10:38:00
Elizabeth Denham recently (08 June 2021) welcomed a delay to the launch of the GPDPR.
Statement in response to concerns around the GP Data for Planning and Research programme08/06/2021 16:15:00
Statement in response to concerns around the GP Data for Planning and Research programme.
Conservative Party fined £10,000 for sending unlawful emails03/06/2021 12:05:00
The Information Commissioner’s Office (ICO) has fined the Conservative Party £10,000 for sending 51 marketing emails to people who did not want to receive them.
Blog: How the digital design community can help shape the ICO’s work on the Children’s Code28/05/2021 12:25:00
A blog by Georgina Bourke, Principal Technology Adviser specialising in UX Design.
Blog: Spotlight on the Children’s Code standards – data protection impact assessments28/05/2021 09:10:00
A blog by Michael Murray, ICO’s Head of Regulatory Strategy.
Amex fined for sending four million unlawful emails21/05/2021 12:25:00
The Information Commissioner’s Office (ICO) has fined American Express Services Europe Limited (Amex) £90,000 for sending more than four million marketing emails to customers who did not want to receive them.
ICO and CMA set out blueprint for cooperation in digital markets19/05/2021 14:20:00
The Information Commissioner’s Office (ICO) and the Competition and Markets Authority (CMA) have published a joint statement, setting out their shared views on the relationship between competition and data protection in the digital economy.