Watchdog slams NHS data breaches

Health service highlighted as a data breach hotspot after reporting 140 incidents between January and April

The UK’s information watchdog has pledged to crack down on data security practices in the health service after 140 security breaches were reported by the NHS in the first four months of the year.

Mick Gorrill, the assistant Information Commissioner in charge of enforcement, told The Independent that a recent series of “inexcusable” data leaks within the NHS had become a cause of “great concern”.

The NHS reported 140 security breaches between January and April – more than the number of leaks in central and local government combined. This has led to the loss of the personal medical records of tens of thousands of people.

Over the past six months, the watchdog has taken action against 14 NHS institutions for breaching data regulations.

Gorrill said the NHS was “by far the biggest offender within the public sector”.

“There is a disconnect between the procedures laid down by managers and what happens on the ground,” he said. “We need a complete audit to try to change the culture.”

One example of a recent NHS data breach involved a GP who downloaded a complete patient database, featuring the medical histories of 10,000 people, to an unsecured notebook. The device was then stolen from his home.

Some computers containing medical records were left in skips, while other records were left on encrypted disks but with the passwords taped to the side.