Wrong people making decisions..
The telling thing is that there's a distinct lack of high level data protection or information security personnel within the NHS in general, they may have senior information risk owners, they may have caldicott guardians but those aren't typically experts in the field, they'll usually be taking advice from others within the organisation who are - and then get over-ruled later.
It's not always the case that those at the top know best especially when it comes to ethics and legislation.
Biting the hand that feeds IT
