A care provider is reported to have lost a memory stick that held sensitive personal information about patients from Northern Ireland and the Isle of Man.

It has been revealed that the material contained within the memory stick was unencrypted, but contained sensitive information relating to patients’ care and their mental health.

Praxis Care Limited is thought to have lost the material in August 2010 but the details have only just publicly emerged. The memory stick was lost on the Isle of Man which contained information about 107 residents and 53 patients in Northern island. All of those whose information was on the memory stick have now been informed.

The Information Commissioners Office (ICO) has warned the provider that the incident has breached the Data Protection Act, and has ordered them as a consequence to improve their procedures.

Since the loss, the company assert that they now ensure that all portable devices are encrypted, and has reportedly updateded its method of disposing of sensitive material.

Christopher Graham, the UK Information Commissioner, labelled the incident “unacceptable”, adding that the memory stick was surplus to requirements as some of the patient details stored on the device were out of date. He asserts that the ICO will continue to work closely with other data protection regulators where it is clear that a data breach extends across national boundaries.

Commenting on the incident, Praxis Care said they were confident that by increasing security and encrypting information, the risk of future information loss will be greatly reduced.

In order to comply with ICO standards, Trusts must ensure they have the correct systems in place to assist clinicians in capturing and sharing information to a high level without compromising safety. Therapy Manager is an Electronic Patient Record (EPR) system which captures every element of the patient journey from Referral through to Discharge. Access is password controlled and gives managers the ability to restrict access rights to different data and functions within the EPR. Furthermore, every intervention is time and date stamped against the clinician who performed each action, ensuring a fully audit-able trail of who is responsible for the printing or downloading of patient information.

Original Source BBC News

About Pathway Software

Pathway Software (www.pathwaysoftware.com) specialises in the design and development of patient information systems for Allied Health professionals.

Its flagship product, Therapy Manager, is an Electronic Patient Record (EPR) system specifically designed for Therapy Services to provide decision makers with the ability to track and manage clinical activity and analyse cost of care by patient, episode or service. The system also demonstrably reduces administration time and the costs of managing Therapy Services.

A recent report has revealed that NHS staff breached data protection policies five times a week on average over the past three years, with some posting patient information on Facebook.

The privacy campaign group Big Brother Watch used Freedom of Information Act requests to  reveal at least 806 separate incidents at 152 NHS Trusts in which patient medical records were compromised over this three year period.

44 Trusts did not respond to the information request and 55 provided a partial response or refused to release the information, with some citing data protection issues. The writers said that this was “unacceptable”, citing that “it is questionable at best for trusts to use the Data Protection Act to withhold details of data breaches when those NHS employees involved have failed to show the same respect for the privacy of patients or the law.”

Patient information was posted on social networking sites in 23 incidents, including one at Nottingham University Hospital NHS Trust in which a medical staff member posted a picture of a patient on Facebook. In 129 cases, NHS staff were found to be accessing or disclosing the medical details of a colleague or family member. Another 57 incidents involved confidential information being stolen, lost or left behind by staff where paper records, laptops and memory sticks were involved.

Many of the problems involved paper records, which were not adequately concealed or secured, implying that they were not protected from access by those with insufficient permissions. In February, records relating to the treatment of 18 patients of the  Coventry and Warwickshire NHS Trust were found in a communal waste bin at a residential apartment block. In May, a member of the public found details of a patient’s sensitive medical procedures and test results in a bin outside Coventry University Hospital.

102 NHS staff members were dismissed as a result of the breaches.

Big Brother Watch Director Nick Pickles said the research highlighted that the NHS was failing  to ensure confidential patient information is protected. “The information held in medical records is of huge personal significance and these cases represent serious infringements on patient privacy,” he said.

An Information Commissioner’s Office (ICO) spokesman said the ICO recently issued a joint letter with NHS chief executive, Sir David Nicholson, warning the health service about the importance of complying with the Act.

“We continue to work with organisations from across the NHS to improve the security of patients’ information and will consider taking action where it is clear that an organisation has failed to meet its legal obligations,” he said.
In order to ensure that security breaches do not occur, Trusts must ensure they have the correct systems in place to assist clinicians in capturing and sharing information to a high level without compromising safety. Therapy Manager is an Electronic Patient Record (EPR) system which captured every element of the patient journey from Referral through to Discharge. Access is password restricted and gives managers the ability to restrict access rights to different aspects of the patient EPR. Furthermore, every intervention is time and date stamped against the clinician who performed each action, ensuring a fully audit-able trail of who is responsible for the printing or downloading of patient information.

In order to ensure that security breaches do not occur, Trusts must ensure they have the correct systems in place to assist clinicians in capturing and sharing information to a high level without compromising safety. Therapy Manager is an Electronic Patient Record (EPR) system which captured every element of the patient journey from Referral through to Discharge. Access is password restricted and gives managers the ability to restrict access rights to different aspects of the patient EPR. Furthermore, every intervention is time and date stamped against the clinician who performed each action, ensuring a fully audit-able trail of who is responsible for the printing or downloading of patient information.