Brighton and Sussex University Hospitals NHS Trust fined over privacy breach

 

An NHS trust has been fined £325,000 by a data protection
watchdog after highly sensitive files of tens of thousands of patients,
including details of HIV treatment, ended up being sold on eBay.

Brighton and Sussex University Hospitals NHS Trust was given the penalty because it failed to ensure hard drives containing the information were wiped after they were handed over to a contractor.

The fine from the Information Commissioner's Office (ICO) is the highest issued by the watchdog since it was granted the power in April 2010.

The Trust's IT service provider, Sussex Health Informatics Service (HIS), was tasked to destroy information on around 1,000 hard drives in September and October 2010 that were held in a room accessed by key code at Brighton General Hospital.

But they handed the job over to an unnamed individual sub contractor who did not wipe the drives and he took at least 252 out of the hospital and 232 of them found their way on to the internet in October and November 2010.

He was arrested by police but no charges were brought over the incident, the trust said.

The highly sensitive personal data included details of patients' medical conditions, such as sexually transmitted diseases and treatment, disability living allowance forms and children's reports.

It also included documents containing staff details like National Insurance numbers, home addresses, ward and hospital IDs, and information referring to criminal convictions and suspected offences.

Today the trust said it disputed the ICO'S finding and said it would appeal.

It said it had recovered all the disks and no information had got into the public domain and it could not afford the fine.

The breach of data protection was discovered when a data recovery company bought four hard drives from a seller on eBay in December 2010, who had purchased them from the sub contractor.

It alerted the authorities and initially the ICO were told four hard drives were affected.

But then a university contacted the ICO in April 2011 to say that one of their students had purchased trust hard drives via the internet auction site.

The ICO said the trust has been unable to explain how the individual removed the hard drives they were supposed to wipe from the hospital during their five days on site as he was supervised and did not know the code for the door.

The ICO's deputy commissioner and director of data protection David Smith said: "The amount issued in this case reflects the gravity and scale of the data breach.

"It sets an example for all organisations - both public and private - of the importance of keeping personal information secure.

"That said, patients of the NHS in particular rely on the service to keep their sensitive personal details secure. In this case, the Trust failed significantly in its duty to its patients, and also to its staff."

Chief executive of Brighton and Sussex University Hospitals, Duncan Selbie said in a statement: "We dispute the Information Commissioner's findings, especially that we were reckless, a requirement for any fine.

"We arranged for an experienced NHS IT service provider to safely dispose of our redundant hard drives and acted swiftly to recover, without exception, those that their sub-contractor placed on eBay.

"No sensitive data has therefore entered the public domain. We reported all of this voluntarily to the Information Commissioner's Office, who told me last summer that this was not a case worthy of a fine.

"The Information Commissioner has ignored our extensive representations. It is a matter of frank surprise that we still do not know why they have imposed such an extraordinary fine despite repeated attempts to find out, including a freedom of information request which they interestingly refused on the basis that it would "prejudice the monetary penalty process".

"In a time of austerity, we have to ensure more than ever that we deliver the best and safest care to our patients with the money that we have available.

"We simply cannot afford to pay a £325,000 fine and are therefore appealing to the Information Tribunal."

The trust said that the fine would pay for the delivery of 300 babies, 50 hip operations, 30 heart bypasses and 360 chemotherapy treatments.

The Trust is now providing a secure central store for hard drives and other media and reviewing the process for vetting potential IT suppliers.

PA

Suggested Topics
Life and Style
ebookNow available in paperback
ebooks
ebookPart of The Independent’s new eBook series The Great Composers
Arts and Entertainment
Books should be for everyone, says Els, 8. Publisher Scholastic now agrees
booksAn eight-year-old saw a pirate book was ‘for boys’ and took on the publishers
Life and Style
Mary Beard received abuse after speaking positively on 'Question Time' about immigrant workers: 'When people say ridiculous, untrue and hurtful things, then I think you should call them out'
tech
Life and Style
Most mail-order brides are thought to come from Thailand, the Philippines and Romania
life
News
i100
Life and Style
tech
Voices
Margaret Thatcher, with her director of publicity Sir Gordon Reece, who helped her and the Tory Party to victory in 1979
voicesThe subject is being celebrated by the V&A museum, triggering some happy memories for former PR man DJ Taylor
  • Get to the point
Latest stories from i100
Have you tried new the Independent Digital Edition apps?

ES Rentals

    Independent Dating
    and  

    By clicking 'Search' you
    are agreeing to our
    Terms of Use.

    iJobs Job Widget
    iJobs General

    Recruitment Genius: Installation and Service / Security Engineer

    £22000 - £40000 per annum: Recruitment Genius: This company is part of a Group...

    Recruitment Genius: Service Charge Accounts Assistant

    £16000 - £18000 per annum: Recruitment Genius: Are you a a young, dynamic pers...

    Cancer Research UK: Corporate Partnerships Volunteer Events Coordinator – London

    Voluntary: Cancer Research UK: We’re looking for someone to support our award ...

    Ashdown Group: Head of IT - Hertfordshire - £90,000

    £70000 - £90000 per annum + bonus + car allowance + benefits: Ashdown Group: H...

    Day In a Page

    General Election 2015: Chuka Umunna on the benefits of immigration, humility – and his leader Ed Miliband

    Chuka Umunna: A virus of racism runs through Ukip

    The shadow business secretary on the benefits of immigration, humility – and his leader Ed Miliband
    Yemen crisis: This exotic war will soon become Europe's problem

    Yemen's exotic war will soon affect Europe

    Terrorism and boatloads of desperate migrants will be the outcome of the Saudi air campaign, says Patrick Cockburn
    Marginal Streets project aims to document voters in the run-up to the General Election

    Marginal Streets project documents voters

    Independent photographers Joseph Fox and Orlando Gili are uploading two portraits of constituents to their website for each day of the campaign
    Game of Thrones: Visit the real-life kingdom of Westeros to see where violent history ends and telly tourism begins

    The real-life kingdom of Westeros

    Is there something a little uncomfortable about Game of Thrones shooting in Northern Ireland?
    How to survive a social-media mauling, by the tough women of Twitter

    How to survive a Twitter mauling

    Mary Beard, Caroline Criado-Perez, Louise Mensch, Bunny La Roche and Courtney Barrasford reveal how to trounce the trolls
    Gallipoli centenary: At dawn, the young remember the young who perished in one of the First World War's bloodiest battles

    At dawn, the young remember the young

    A century ago, soldiers of the Empire – many no more than boys – spilt on to Gallipoli’s beaches. On this 100th Anzac Day, there are personal, poetic tributes to their sacrifice
    Dissent is slowly building against the billions spent on presidential campaigns – even among politicians themselves

    Follow the money as never before

    Dissent is slowly building against the billions spent on presidential campaigns – even among politicians themselves, reports Rupert Cornwell
    Samuel West interview: The actor and director on austerity, unionisation, and not mentioning his famous parents

    Samuel West interview

    The actor and director on austerity, unionisation, and not mentioning his famous parents
    General Election 2015: Imagine if the leading political parties were fashion labels

    Imagine if the leading political parties were fashion labels

    Fashion editor, Alexander Fury, on what the leaders' appearances tell us about them
    Phumzile Mlambo-Ngcuka: Home can be the unsafest place for women

    Phumzile Mlambo-Ngcuka: Home can be the unsafest place for women

    The architect of the HeForShe movement and head of UN Women on the world's failure to combat domestic violence
    Public relations as 'art'? Surely not

    Confessions of a former PR man

    The 'art' of public relations is being celebrated by the V&A museum, triggering some happy memories for DJ Taylor
    Bill Granger recipes: Our chef succumbs to his sugar cravings with super-luxurious sweet treats

    Bill Granger's luxurious sweet treats

    Our chef loves to stop for 30 minutes to catch up on the day's gossip, while nibbling on something sweet
    London Marathon 2015: Paula Radcliffe and the mother of all goodbyes

    The mother of all goodbyes

    Paula Radcliffe's farewell to the London Marathon will be a family affair
    Everton vs Manchester United: Steven Naismith demands 'better' if Toffees are to upset the odds against United

    Steven Naismith: 'We know we must do better'

    The Everton forward explains the reasons behind club's decline this season
    Arsenal vs Chelsea: Praise to Arsene Wenger for having the courage of his convictions

    Michael Calvin's Last Word

    Praise to Wenger for having the courage of his convictions