Password blunder blamed for prison data breach

The missing memory card mysteriously vanished in the prison

Another health trust has been blamed for losing the sensitive medical details of its patients - this time the records of 6,360 prisoners and ex-prisoners which were put on to a memory stick.

The health trust in question - NHS Central Lancashire - has blamed the mistake on “human error”. Its report into the matter found that the memory stick was encrypted but the password was written on a note attached to the card.

The USB stick was being used to back up clinical databases at HMP Preston when it was lost on 30 December. Despite a search the stick has not been found.

NHS Central Lancashire said procedures on data security had not been adhered to but that it had now taken action to remind staff of their responsibilities.

Prisoner surnames, their broad age range, prison number, cell location, prison clinic appointment times and review dates were all included in the information.

An “immediate and urgent” review of data policies was undertaken to ensure consistency regarding the use of USBs after the incident, the trust said.

All data sticks across the PCT were recalled and staff were reminded how to handle personal and sensitive information of patients and employees.

The Trust’s chief executive Joe Rafferty said: “There was a failure in the system which led to this incident happening and we have taken steps to make sure this doesn’t happen again.

“We are pleased that the Information Commissioner’s Office has recognised the swift action taken by NHS Central Lancashire following the information security breach and that, as a result, at present no formal action will be taken.”

Editor’s note: Yet another example of a health trust managing to lose its patients’ data (see previous post ‘Carers careless…..). I suspect they will not learn until somebody sues them for it, and then they will realise there are financial implications to their incompetence. For an example of how even a relatively small health trust will try to spin the facts have a look at its press release (link). Please post any suggestions that the password might have been. Fletch? Porridge? Doh?