ICO slams NHS after two more data breaches

The Information Commissioner's Office (ICO) has spoken out against the NHS for a second time, after two more Trusts reported serious data breaches in the past three weeks.

At the end of last month the ICO complained to the Department of Health (DoH) over data breaches in the NHS highlighting a total of 14 Trusts and other health organisations that had experienced data control problems in the previous six months.

However, despite the warning, the ICO has again had to speak out against two further Trusts who reported severe breaches.

The first NHS Trust was Stoke-on-Trent, which came under fire for having potentially destroyed or misfiled about 2,000 paper physiotherapy records.

The second was Basingstoke and North Hampshire, which emailed hundreds of patient records using an unsecured email account to a department that had "no business need to have access to the excessive amount of clinical records".

According to the ICO, roughly one in four of all Data Protection Act (DPA) breaches in the UK are committed by the NHS.

Mick Gorrill, head of enforcement at the ICO, said in a statement: "Everyone makes mistakes, but regrettably there are far too many within the NHS."

"Health bodies must implement the appropriate procedures when storing and transferring patients' sensitive personal information. We have taken a number of steps to explain the importance of personal data to NHS bodies and help them comply with the law. We will continue to do so."

The implication the NHS seems to need continually reminding of the importance of data protection measures is clear, but the ICO has stopped short of issuing a fine to either Trust implicated in the most recent breaches despite ICO deputy commissioner David Smith promising it was simply a matter of time before the maximum 500,000 penalty was applied.

While no fine has been forthcoming, both Trusts' chief executives have had to sign formal undertakings promising that in future they will process personal information in line with the DPA.