Another NHS Trust has misplaced an unencrypted USB stick containing sensitive data.
The East & North Hertfordshire NHS Trust has been found in breach of the Data Protection Act after the device was lost on a train.
A junior doctor accidentally took the stick home with him, according to the Information Commissioner's Office (ICO), which discovered the doctor in question had not been made aware of the Trust's data protection policies.
Furthermore, the doctor did not have access to email to receive policy reminders and updates, whilst no technical measures were in place to prevent misuse of portable devices.
The stick, which was passed between doctors, contained brief details of patients' conditions and medication.
"Storing sensitive personal data on unencrypted data sticks is a risk Trusts should not be willing to take," said Mick Gorrill, head of enforcement at the ICO.
"If it is vital to store information for handover, this must be
done with the highest security measures in place. Furthermore, it is vital that employees are fully aware of processes which could have prevented this incident from occurring."
The Trust's chief executive has subsequently signed an undertaking to ensure policy on portable device use is clear. The body is also now required to regularly monitor compliance with security procedures and implement appropriate safeguards.
The NHS has been under the spotlight numerous times for losing devices. A recent case saw Royal Wolverhampton Hospitals NHS Trust rapped by the ICO for leaving a CD at a bus stop.
However, despite numerous incidents, the ICO has still yet to impose a fine on the NHS.
Stewart Room, partner in Field Fisher Waterhouse's Privacy and Information Law Group, said the undertaking ordered on the East & North Hertfordshire NHS Trust was vague.
"The undertakings were on non-specific issues. If they were on the specific USB matter, they would be much more effective," Room told IT PRO.
Room said it "beggars belief" the NHS is still using unencrypted USB drives.
"[The NHS] is being dealt the loosest form of sanction," he added.
"At some point the NHS is going to be fined, but when are we going to do that?"
Room also pointed to the repeated use of undertakings, rather than fines, claiming it was "like Groundhog Day."
