NHS trust sends data CD to landfill

The personal information of 1.6 million people has been put at risk after a CD was sent to a landfill site by an NHS trust by mistake, a watchdog said.

The Eastern and Coastal Kent Primary Care Trust put the CD, which contained the name, address, date of birth, NHS number and GP of about 1.6 million people, in a filing cabinet during an office move.

But no one told staff who sent the cabinet to the landfill site and it has not been recovered, the Information Commissioner's Office said.

The trust said it would now take action to bring in clear policies and procedures for when moving office, improve staff training and boost security against unauthorised and unlawful processing, accidental loss, destruction and damage of personal records.

An undertaking signed by the trust's chief executive Ann Sutton read: "The Information Commissioner was provided with a report by the data controller informing that a filing cabinet containing personal data had been sent to landfill during a move of office premises.

"The filing cabinet contained a CD holding the address, date of birth, NHS number and GP practice code of approximately 1.6 million individuals.

"When planning the office move the security of the CD was considered and it was deemed appropriate to store it in the filing cabinet concerned.

"Although communication was established with the project manager co-ordinating the move, the existence of the CD was not communicated leading to the disposal of the filing cabinet.

"It was also found that the team concerned were not up to date with their information governance training and had not accessed relevant guidance on how to dispose of the CD.

"The data controller did take steps to attempt to retrieve the filing cabinet once discovered missing, however the cabinet had already gone to landfill and was unable to be recovered.

"It has been noted that the data controller has taken substantial remedial measures to prevent the reoccurrence of such an incident."

Nick Pickles, director of the Big Brother Watch campaign group, said: "It is incomprehensible that the personal data of 1.6 million people can be casually left on a CD in a filing cabinet - and once again highlights how lax controls on personal information are.

"We can only hope it was encrypted, but even that is not clear in this case."

He went on: "This kind of incident should not be able to happen. Changing policies now is too little, too late."

Information Commissioner Christopher Graham warned in July that a culture change was needed within the health service to ensure that patients' personal information was kept secure.

The security of the most sensitive personal data remains a "systemic problem" within the NHS, he said.

Policies and procedures to keep the information safe may already be in place, but they are not being followed by staff on the ground, he added.

Today, a spokeswoman for the Information Commissioner's Office said: "While there is no evidence to suggest that any of the data was accessed, this case highlights that clear policies and procedures should be put in place to support staff when handling personal information as part of an office move.

"These policies should be communicated to all relevant staff.

"We are pleased that Eastern and Coastal Primary Care Trust has now taken action to make sure that the personal information they handle is kept secure."

But Chris McIntosh, chief executive of data security firm ViaSat UK, said losing so many details in such a way "strays beyond carelessness and firmly into negligence".

"Whether the CD is lost forever or ends up in the right or wrong hands may still be unknown, but the stark fact is that the personal details of over 2.5% of the UK's population have been lost and could possibly end up used for identity theft," he said.

PA