Data Loss: NHS

The data loss by the NHS, just keeps pilling up. Below is a list of recent data breaches, by the NHS, provided under the Freedom of Information Act, following a request by the Independent.

This list is just staggering, in both scale and breadth.

Data Loss within the NHS

‘Serious Untoward Incidents’ involving data loss obtained through Freedom of Information requests to the Strategic Health Authorities (SHA) or taken directly from the website.

  1. NHS London:

55 Serious Untoward Incidents (SUIs) which have involved the loss of patient data since 1 January 2007

13/02/2007 – Laptop stolen from GP practice.

12/02/2007 – Patients names released in an FOI request by a Trust – 50 patients affected.

02/04/2008 – Bag containing patient data was stolen from locked car – 8 patients affected.

07/04/2008 – Laptop containing patient data stolen – 5 patients affected.

15/04/2008 – Patient records found by member of the public and handed back to the patient – 1 patient affected.

22/04/2008 – Laptop containing patient data lost – presumed stolen

10/05/2008 – Patient notes left in public place and stolen

04/06/2008 – Laptop containing patient data was stolen.

05/06/2008 – CD containing patient data was stolen

08/06/2008 – 6 laptops containing patient based details stolen.

09/06/2008 – Bag containing some patient notes found by a member of the public and handed to a member of staff.

11/06/2008 – 8 patient files were lost

12/06/2008 – Patient records found by a member of the public and Trust notified – data retrieved.

12/06/2008 – Memory stick with patient data lost – confirmed data loss 27 patients affected.

15/06/2008 – Memory stick and mobile phone stolen with patient data

08/07/2008 – Laptop bag containing CDs with patient data stolen

11/08/2008 – Notebook containing patient data lost – presumed stolen.

2. NHS West Midlands:

03/10/2007 – Laptop stolen from third party contractor. Flu vaccination database attached to e-mail in archive file – unconfirmed numbers lost.

05/10/2007 – 3 to 4 reports being used for audit lost in a public area – information about 3 to 4 deceased patients lost.

23/10/2007 – Back up tape of patient information lost in the post – back up tapes need special equipment to read – unconfirmed numbers lost.

31/10/2007 – Video consultations for use in reflective practise sessions lost in public area – tape found – information about a small number of patients.

26/11/2007 – Medical records missing during transfer from off –site storage contractor to trust – 4 patient records lost.

26/11/2007 – Back up tape of Trust’s systems containing subset of patient identifiable information – tape returned – no data loss.

29/11/2007 – Break in at unoccupied health centre. Some patient records remained on premises – unconfirmed number of records lost.

18/12/2007 – Laptop and datastick containing details of a database stolen from a doctor’s home – unconfirmed personal data loss

08/01/2008 – Laptop stolen from office in the outpatient department which contained 5,123 patient details – information about 5,123 patients lost.

09/01/2008 – member of staff’s car broken into. Domiciliary bag containing patient notes stolen – information about 5 patients lost.

21/01/2008 – District nurse took home activity sheets with patient names and addresses, which were taken during a burglary – 25 of these patients considered to be vulnerable and were visited by a PCT manager and police officer – unconfirmed numbers.

02/02/2008 – Laptop stolen from member of staff’s home, information regarding patient assessments for care/nursing homes on laptop – unconfirmed numbers.

05/02/2008 – Clinic sheet and envelope containing tape missing from drawer – information about 2 patients.

11/02/2008 – More than 30 patient personal details have reached other patients due to inserting machine inserted more than one letter per envelope – information about 30 patients.

15/02/2008 – Computer containing patient identifiable details stolen from office – unconfirmed numbers lost.

18/02/2008 – Patient’s notes lost in street, but were returned by a member of the public – information about 1 patient – patient informed.

19/02/2008 – Set of court papers (including claim form, order form, statement from doctor and copies of medical records ) suspected stolen from a solicitor firm’s employee’s bag whole travelling on a train – information lost about 2 patients.

22/02/2008 – Copy of patient records sent to solicitors via recorded delivery not received. Health Records Policy adhered to and full consent had been obtained from patient via solicitor – information about 1 patient lost.

27/02/2008 – Laptop stolen whole member of staff was running a clinic in adjacent room. Although the laptop was fitted with encryption software, an unencrypted memory stock with 238 reports on patients was also taken – information on 238 patients lost.

  1. NHS South East Coast (info on data in 2006 and 2007 also available):

03/01/2008 – External agency staff data – Personal information about employment agency staff released to media in error in response to an information request – all data released destroyed by recipient.

08/01/2008 – Patient information on Dictaphone – Dictaphone holding patient identifiable information stolen from GP practise room – data lost.

13/01/2008 – Release of confidential data to the courts within without correct authority.

29/01/2008 – verbal disclosure – Nurse gave details of patient’s diagnosis to patients work colleague.

04/02/2008 – GP records – GP records delivered to wrong address.

12/02/2008 – personal records and confidential papers went missing while waiting to be filed.

18/02/2008 – Health professional left diary on bus containing a small number of patient’s names, but not addresses – data recovered.

29/02/2008 – Health professional took patient records home inappropriately – records recovered.

18/03/2008 – Occupational therapy records went missing from a hospital office – records subsequently found.

28/03/2008 – Patient letter sent to wrong address.

4. NHS North East:

Briefcase stolen from member of staff’s car which contained three sets of medical records – 3 records stolen.

Missing set of case notes – 1 record lost.

Confidential information lost when loading into a van – 3 records lost.

Patient healthcare records stolen from car – 1 record.

Theft of PC containing patient information – unknown numbers lost.

Patient identifiable information has been lost in the post – unknown numbers lost.

USB memory stick missing from service – 100 records

Two password protected laptops and digital camera were stolen – unknown numbers lost.

Service lost one USB memory stick with patient information – 35 records lost.

Patient identifiable data went missing in transit – 32 records lost.

5. NHS South West:

1st December 2007 to 31st March 2008 – 0 incidents.

1st April 2008 to 31st July 2008 – 1 incident. This one incident did not actually involve any loss of patient records. It was reported as there was a potential loss of paper documents from NHS premises, due to a member of public gaining access to an unlocked area where patient records were stored.

6. NHS East Midlands:

10/10/2007 – Loss of IT equipment (palmtop) – not stated how many people affected.

22/10/2007 – theft of laptop – more than 1 affected.

07/12/2007 – package lost in the post – not stated how many affected.

18/01/2008 – Administration error – 1 person affected.

07/02/2008 – Data lost – 0 persons affected.

25/02/2008 – Theft of data records – more than 1 person affected

26/02/2008 –. Data lost in the post – 1 person affected.

10/03/2008 – Electronic Data Error – more than 1 person affected.

7. NHS North West:

06/01/2006 – Theft of IT equipment – more than 1 patient

18/01/2006 – Documents misplaced and later discovered – 1 patient affected

18/03/2006 – Documents found in car park – more than 1 patient

27/03/2006 – Laptop stolen – more than 1 patient

26/04/2006 – Car stolen – loss of patient records – 31 patients.

05/06/2006 – Allegation of data misuse – breach of confidentiality – 1 patient affected

13/06/2006 – Lost files found in skip – 7 patients affected

16/06/2006 – Trust identified a website that contained information and photos of patients before 1970s – more than 1 patient

20/06/2006 – Trust identified a website that contained information and photos of patients – old patient data – more than 1 patient.

28/06/2006 – PC stolen from out patient clinic – 200 patients.

13/07/2006 – Illegal entry to property of staff – theft of camcorders, 2 tapes of client sessions. – 2 patients

29/08/2006 – Handover tape and bag stolen – more than 1 patient

11/10/2006 – Desk top PC stolen – more than 1 patient.

21/11/2006 – School health records missing, sent in the post – 1 patient affected.

05/12/2006 – Clinicians brief case containing x-rays and clinic letters stolen – more than 1 patient.

12/12/2006 – Documents found on wasteland – more than 1 patient.

22/12/2006 – Computer hard drive stolen – more than 1 patient.

11/01/2007 – stolen laptop – more than 1 patient

15/01/2007 – Healthcare records stolen from car – more than 1 patient.

17/01/2007 – Letter delivered to Home not by Royal Mail or other courier – 1 patient affected.

27/01/2007 – Laptop stolen – more than 1 patient.

14/02/2007 – theft of unattended notes – more than 1 patient.

23/02/2007 – Laptop stolen – more than 1 patient.

01/05/2007 – Loss of patient paper records – 100 patients

11/05/2007 Vehicle stolen containing NHS equipment and GP post – more than 1 patient.

09/06/2007 – Staff diary stolen from car – more than 1 patient.

15/06/2007 – Staff diary stolen from car – more than 1 patient.

24/08/2007 – Loss of data Stick – 4 patients affected.

28/08/2007 – Data about patients published over internet by staff member – more than 1 patient.

02/10/2007 – Desk top PC stolen – more than 1 patient.

16/10/2007 – Document downloaded from website contained data – 1 patient affected.

10/11/2007 Theft of a PC – 300 patients.

16/11/2007 – Lost documents in Royal Mail – 1 patient affected.

19/11/2007 Loss of memory stick – 4,000 patients affected.

21/11/2007 – Paper records left in surgery for occupancy by PCT – more than 1 patient.

8. NHS East of England:

29/11/2007 – Loss of memory stick – 35 patients involved.

12/12/2007 – Loss of memory stick – found within a week of its loss – no data lost.

18/12/2007 – Patient identifiable printed information placed in waste container – 43 patients involved.

07/01/2008 – cases notes missing in transit – data lost.

29/01/2008 – Theft of GP system backup tape – data lost.

19/02/2008 – Lap top stolen, lap top was password protected – all laptop encryptions in progress

10/03/2008 – GP practice system stolen – system was encrypted.

19/03/2008 – Old appointment books found in waste container – records retrieved and returned.

10/04/2008 – Records lost in transit

19/04/2008 – Memory stick lost

19/05/2008 – Forms containing patient details missing

23/05/2008 – Staff diary stolen

01/06/2008 – papers were found on a pavement following a burglary.

18/06/2008 – Laptop stolen.

9. NHS South Central:

12/09/2007 – Computer stolen from NHS staff residence during a burglary. A member of staff had been working on 2 patients conference reports – 2 patients affected.

24/01/2008 – Member of staff lost USB containing (encrypted) patient information

01/02/2008 – Five sets of patients notes lost/stolen from drop in centre

16/02/2008 – Member of staff  had car stolen – Car contained 80 service user files and keys to 16 properties in boot of car

10. Yorkshire and the Humber

25/08/2006 – Names and addresses of 10 patients stolen from locked boot of car

10/04/2007 – Patient info found in skip behind building when GP branch being renovated

20/04/2007 – Personal data of 250 patients lost in the post

06/08/2007 – Patient info blown about outside GP surgery after bin was knocked over

09/10/2007 – Laptop stolen with digital data

06/12/2007 – Set of minutes with confidential information sent to wrong email address

21/12/2007 – Briefcase stolen from boot of car containing info of a small number of patients

05/01/2008 – Laptop stolen from NHS premises

17/01/2008 – Laptop stolen from locked office on NHS premises

01/02/2008 – Vaccination lists lost in internal post

07/02/2008 – Medical records found in closed property previously owned by NHS

14/03/2008 – GP records found in garden

11/04/2008 – Patient info of a small number of patients found in waste bin outside health centre

01/05/2008 – Data stick mislaid – containing small number of patient and staff details

06/06/2008 – Medical records found in street

23/06/2008 – Documents relating to 16 patients found in a garden and handed in to police

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: