back to article NHS is top sector for data losses

The NHS has reported 305 data breaches to the Information Commissioner's Office (ICO) since November 2007. The figure for the NHS compares to 288 for the private sector, 132 for local government and 18 for central government. "It could be because of reporting differences or the NHS could be more prone to data breaches because …

COMMENTS

This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward

    Just 2 days left to opt-out of the Summary Care Record

    If you haven't opted-out yet, you have until Thursday June 3rd to do so.

    1. Anonymous Coward
      Anonymous Coward

      Once your records

      have been accessed even once you will not be able to have them deleted.

      And do not for a minute think that the records will only be accessed by your doctor/s.

      Local taxation departments across the country are gearing-up for the data, and the DofH will soon be selling it like DVLA does your licence info....

  2. Anonymous Coward
    Anonymous Coward

    They're clueless...

    From top to bottom in the NHS, 80% of staff are totally clueless about IT. In my experience, far too often ESPECIALLY those entrusted with IT security. Those staff who are in the know are invariably those who have educated themselves at home - and even they invariably end up just deciding life's too short and keeping their heads down.

    After a digital eye scan at my small local hospital, I was told the result would be available within a week or two. A WEEK or two?? Had they somehow missed the whole point of digital technology? Oh no - but the results had to be sent off to some central place to be checked. Well - how many seconds did that take online, for heaven's sake?! Oh - they couldn't send them online - that part of their brand new multi-million pound IT scheme had never worked. In fact the scan results were collected and burned to disk once a week. The disk was then taken by car the 50 miles to HQ. Was the disk encrypted? Er... how do you mean?

    I kid you not.

    1. Anonymous Coward
      Stop

      The thing is...

      The lack of detail regarding safe transit of your scan is a fair point but to be honest you aren't likely to get an informed answer on data encryption techniques and policies from front-line healthcare staff. Better to direct that kind of enquiry to the business manager or clinical governance bod.

      As for the two week wait... well that scan needs to be reported by somebody who knows how to interpret it. Data transfer times aside, the bottleneck will be the caseload on the desk of the person charged with looking at the scan. There are lots of patients and relatively few people qualified to pass comment on your eyes...

      1. Anonymous Coward
        Anonymous Coward

        Fair points, BUT....

        ...it's at the front line that data security is understood and enacted - or not. If front-line staff don't understand the issues, they shouldn't be allowed to handle and transfer data. I didn't need to go any further to conclude there was little care or understanding - and that's management's fault by definition.

        Of course I fully understand that I wasn't the only patient. But a week's delay in even getting the test data delivered was unacceptable, and the month's delay in returning the result hugely so. As was the delay in getting the test itself - I waited over 2 years (of regularly banging on desks) for a test that should have taken place within weeks of diagnosis of my first symptoms. Thankfully they've been conducted reasonably regularly since. Worries about eyesight are quite obviously a high stress area for patients, and delays seem to be shrugged off far too lightly in the NHS.

        Reasons and excuses - they're never the same.

        1. Anonymous Coward
          Anonymous Coward

          But maybe...

          Yes, I totally agree that data security and patient confidentiality is everybody's responsibility. In fact it is enshrined in the Caldicott principles that all healthcare staff are bound to observe. My point really is that sufficient data encryption may well have been in place to protect your privacy - it's just that the staff aren't conversant enough with the technology to be able to give you the information you needed. They were more than likely just following a written protocol that tells them which buttons to press when burning the CD, the underlying technical matters are not necessarily describe or explained.

          Of course there is also the possibility that no such protection existed and the data was accessible to anybody putting the CD into their laptop... If thats the case then they will no doubt be in breach of existing trust policy on such matters. The thing is that a lot of these procedures are written up by people who don't have extensive backgrounds in IT - not an excuse, just a fact.

          I am being sincere when I say you have a legitimate concern regarding data safety but it is only going to be addressed if people raise their concerns so that potential weaknesses in the system can be identified. Asking the person examining you is not necessarily going to get the information or response that you need.

  3. chr0m4t1c
    Joke

    But...

    The SCR system will fix all of this, won't it? After all, they told us it was 100% secure.

    It is, isn't it?

    Isn't it?

    Hello?

  4. gimbal
    WTF?

    29 Percent of the incidents...

    ...were ... .lost ... hardware? How on earth do these people manage to keep a job? I mean, seriously.

    It sounds like it was a 100% procedural failure, from this seat.

  5. Winkypop Silver badge
    FAIL

    Data just wants to be free

    Just like the truth, it eventually finds a way to get out...

  6. Ascylto
    Big Brother

    Earns(?) more than the PM

    And the NHS departmental top official gets paid what?

    Take £10,000 per data breach from his salary and watch the data breach numbers fall!

This topic is closed for new posts.