Medical practice loses 8,000 patient details on unencrypted USB

A Welsh medical practice has been named and shamed by the Information Commissioner's Office (ICO) for breaching the Data Protection Act.

Back in March, a staff member from Lampeter Medical Practice downloaded a database containing 8,000 patient details onto an unencrypted USB stick before sticking it in the post.

It may have been sent recorded delivery but the USB stick never made it to its final destination the Health Board's Business Service Centre and has now been accepted as lost.

"It is unnecessarily risky to download 8,000 personal details on to a memory stick," said Sally-Anne Poole, enforcement group manager at the ICO, in a statement.

"It is imperative that staff are made fully aware of an organisation's policy for securing personal data and any portable device containing personal information should always be encrypted to prevent it being accessed in the event of loss or theft."

The head of the practice, Dr Rowena Mathew, has admitted the fault and signed a declaration to the ICO saying from now on she will ensure all portable devices are encrypted, take all physical precautions to keep data protected on such devices and train all staff to know what security policies are in place.

This latest incident has again highlighted the issues within the NHS when it comes to data breaches.

During the InfoSecurity conference back in April, the deputy commissioner of the ICO, David Smith, claimed the NHS was the worst offender when it came to data security and was responsible for a third of all reported data breaches in the UK over the past two years.

In his keynote speech, Smith said: "[Many] would say 'this is confidential health information, surely they should be better than this?' but this is the largest employer outside of the red army and this is hardly a command and conquer structure."

"There is a real, real, real challenge there but it is worrying that still we see these losses," he said.