5,600 patients' records 'lost' on memory stick (From Bradford Telegraph and Argus)

5,600 patients' records 'lost' on memory stick

7:40am Wednesday 29th April 2009 in News Exclusive By Claire Lomax

5,000 patients' records 'lost' on memory stick

A computer memory stick which it is feared contains the confidential medical information of thousands of Bradford hospital patients has been lost by a member of staff who has since resigned.

The information – which would include patients’ names, addresses, dates of birth, hospital numbers and details of their medical treatment – is thought to have been stored on a USB memory stick.

Now Bradford MPs have condemned the practice of allowing sensitive material like this to be put on to such devices.

The T&A understands the female administration worker at Bradford Teaching Hospitals NHS Foundation Trust breached policy by taking an insecure device off Trust premises and lost it in the library at Leeds Metropolitan University on April 21.

It was reported missing to hospital bosses the next day and an investigation was immediately started.

The Trust has worked with the university to try to locate the device and students have been identified who logged on to the computer from which it was lost. All but one of these students has been contacted but the device has not been traced.

Bradford Teaching Hospitals NHS Foundation Trust has now written to 2,650 surgical patients whose details could have been on the USB stick.

And it has written to some 3,000 other patients who featured in waiting list data which could also have been stored on it Foundation Trust chief executive, Miles Scott, said: “On behalf of the Foundation Trust, I would like to apologise to all those patients involved for the anxiety and inconvenience that has been caused.

“This is the first time such an incident has occurred within our hospitals and we are taking this matter extremely seriously.

“It is essential that we safeguard patient confidentiality and I am very sorry that our established procedures were not followed in this incident.

“An investigation has already been launched into the exact circumstances. We are determined to do whatever we can to prevent this from happening again.”

One patient affected, who did not want to be named, received a letter yesterday from the Trust.

He said: “You read about this kind of loss time and time again and it is frustrating.

“This is one of the reasons I contacted my GP several weeks ago and told him I am not prepared to go on a national patient database.

“The letter from the Trust says the memory stick may contain my name, address, date of birth and hospital number. If it falls in to the wrong hands it could be used for fraud.”

One pensioner, who did not want to be named, who received a letter said: “I panicked at first, and then I just felt disgusted that this had been allowed to happen. I got straight on to my bank to tell them and I’ve taken out an insurance policy against someone using this information to steal my identity, so it’s already costing me money.

“Whoever finds this device could do all sorts of damage with the information on it.”

Bradford North Labour MP Terry Rooney said: “It is obviously extremely distressing in terms of patient confidentiality.

“Why does an administrative member of staff need to have a memory stick with thousands of patients details on?”

Bradford West Labour MP Marsha Singh said: “Data going missing is not good enough as it is compromising patient confidentiality. The hospital management must carry out a review into who should have access to this sensitive information.”

Shipley Conservative MP Philip Davies said: “I have never been a big fan of memory sticks as it seems to me there is great capacity for it to be lost. We all make mistakes and things happen. There needs to be a review into whether the way details are stored is adequate.”

And Bradford South MP and Sports Minister Gerry Sutcliffe said: “We need an inquiry into this. These are personal details and information and we need to find out what has happened.”

The Foundation Trust’s IT security specialists have worked with the staff member who lost the stick to identify all patients whose details may have been held on the device and written to each of them, explaining the situation and apologising. If patients have not received a letter they are unaffected.

Mr Scott added: “The action we are taking is very much precautionary and is designed to offer reassurance to the community. “There is no risk to their treatment and care. Neither is there any evidence of the memory stick being stolen, or of the information being used or disclosed.”

The Foundation Trust has written to all staff reiterating its strict policy on home working and data handling, and their responsibilities under data protection laws.

• Comment