Yet another NHS Trust fined by ICO.

18 Jul 2012

Information Commissioner’s Office issues fourth financial penalty against an NHS organisation in just two months.

By issuing four financial penalties in just two months to NHS organisations, the Information Commissioner’s Office (ICO) has sent out a clear signal that it will not tolerate data protection breaches in the health service and is notching up an impressive hit rate as it cracks down on the problems. That’s not without good reason, because what could be more personal, after all, than a patient’s medical records?

The latest NHS trust to fall foul of the ICO is St George’s NHS Trust in south London. It twice sent medical records, by post, to an address that the patient in question hadn’t lived at for five years.

Its punishment for this offence was a £60,000 fine and a public dressing-down from the ICO’s head of enforcement, Stephen Eckersley.

“It’s hard to imagine a more distressing situation for a vulnerable person than the thought of their sensitive health information being sent to someone who had no reason to see it,” he said. “This breach was clearly preventable and is the result of the Trust’s failure to make sure the contact details they have for their patients are accurate and up to date.”

It’s just the latest in a series of NHS data protection errors that the ICO has uncovered. In June, it served a £225,000 monetary penalty notice on the Belfast Health and Social Care Trust, for leaving 100,000 patient records and 15,000 staff records in an abandoned hospital. Earlier that month, it fined the Brighton and Sussex University Hospitals NHS Trust £325,000, after patient data was found on hard drives sold on an online auction site, as reported at the time by IP EXPO Online.

And in May, a monetary penalty notice for £90,000 was served on Central London Community Healthcare NHS Trust, after it was discovered that patient data was faxed to an incorrect and unidentified number – not just once, but on 45 occasions over a number of weeks. The ICO reckons that 59 individuals’ personal data was compromised.

The ICO insists that the purpose of monetary penalties is not to “impose undue financial hardship” and that, when deciding the amount of a fine, it takes into account not just the seriousness of the breach, “but also other factors including the size, financial and other resources of a data controller.”

In a recent interview in Computing, deputy Information Commissioner David Smith suggested that the reason why so many NHS cases come to light is because, for most organisations, reporting a breach of the Data Protection Act is not a legal requirement. However, in the NHS, it is a “management instruction” to report all data breaches – both of computerised data and paper records – to the ICO. Meanwhile, his boss, Christopher Graham, has previously warned of “systemic” problems in the health service.

Critics argue that these financial penalties are a kick in the teeth for the taxpayers who fund and use the NHS, further undermining quality of service and forcing them to cough up twice when the government effectively fines itself. Some believe that the Coalition’s proposed NHS reforms could exacerbate the problems with data protection.

Either way, it’s clear that data protection is an issue that the NHS needs to tackle urgently. It is also, arguably, further evidence of inherent flaws in NHS Spine, the national care records service, or at least in the way that staff are using the system: in the most recent St George’s NHS Trust case, the patient’s correct, current address had already been entered onto Spine, but the ICO found that staff within the Trust were regularly bypassing prompts on Spine to cross-check patient records against the computerised system.

Related articles

UK ICO hands out largest ever data breach penalty

Is the CIO an endangered species?

IT security has much to learn from social media use, says Gartner

Expert Opinion: Speed, power and resilience are what count for data networks in 2012