NHS clinicians risking patient data

UK clinicians are putting patient data at risk by carrying information on unprotected USB sticks, according to a new report.

Research by two clinicians at a London teaching hospital published in Health Service Journal found that 92 out of 105 doctors carried memory sticks with them.

But only five out of the 79 USB devices which held confidential patient information were password protected.

This contravenes data protection rules and exposes the NHS to the kind of data loss scandal that has affected several central government departments in recent months.

Matthew Brown, vice president of products at data loss prevention firm Workshare, said that the first step towards correcting the problem should be an "information audit" to gain insight into how data flows in and out of the organisation.

This should be complemented by technologies such as encryption and access controls, he added.

"Implementing policies is not enough. You cannot simply stop employees from downloading information onto USB devices as they will just find a way around it to do their job," said Brown.

"The NHS must proactively look at how its information is being used, and take steps to ensure that risks are stopped before they have a chance to happen."

Neil Yeomans, partner in the IT security practice at consultancy firm Deloitte, explained that the Department of Health has already issued information governance standards and guidelines, and warned that unintended breaches can be as damaging as criminal acts.

"It is clear that the solution to managing such a risk requires flexibility and is as much about people and culture and changing behaviour as it is about process and technology," he added.

See also:

Prisoners' data at large after Home Office slip

A Home Office contractor has lost a memory stick containing data on all UK prisoners  22 Aug 2008

HMRC missing disc investigation cost nearly £500,000

Tories critical over government waste  18 Jul 2008

Cabinet Office publishes data handling review

Data will be encrypted, staff trained and privacy impact assessments carried out on all projects  25 Jun 2008

UK lawyers risk data loss

A third of the country's legal firms are reliant on onsite archiving methods  04 Jun 2008

Symantec purchase of Vontu approved

Deal will help boost buyer's data loss prevention business  03 Dec 2007

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!