Unencrypted data goes walkabout… again 

The UK privacy watchdog has criticised lax NHS data security as it announced it is taking action against a London hospital where two laptops were stolen.

The Information Commissioner’s Office yesterday announced it is taking enforcement action against Brent Teaching Primary Care Trust after two laptops were stolen last month.

The laptops containing the unencrypted details of 389 patients, including some medical details, were taken from a locked office in Central Middlesex Hospital on 14 January.

The ICO has required Brent PCT to sign a contract iPhone formal undertaking to encrypt all portable and mobile devices used to transmit personal information and to train staff in data security.

Mick Gorrill, assistant information commissioner at the ICO, said in a statement: “I am increasingly concerned about the way some NHS organisations are transferring sensitive records onto laptops and other mobile devices that are not encrypted.

“Organisations need to ensure they implement appropriate safeguards to ensure personal details about patients are processed securely.”

Brent PCT said it now provides laptop locks and encrypts data on laptop hard disks, prevents staff from downloading to portable devices, and has reminded staff of their responsibilities for data security.

CEO of Brent PCT Mark Easton said in a statement: “NHS Brent has made huge progress to date, and I am keen to ensure that the IT infrastructure meets our needs and that our staff are updated regularly on their individual responsibilities.”

Last month the ICO also took enforcement action against Abertawe Bro Morgannwg University NHS Trust and Tees, Esk and Wear Valleys NHS Foundation Trust for breaching the Data Protection Act.

An unencrypted laptop containing the sensitive personal data of approximately 5,000 patients, including some health records, was stolen from the Abertawe Bro Morgannwg University NHS Trust.

While at Tees, Esk and Wear Valleys NHS Foundation Trust an unencrypted memory stick containing sensitive personal information relating to patients and staff was lost.

In September last year silicon.com found that as many as 29 million people had had their records lost by Whitehall departments and other public sector bodies over the past 12 months.

From Silicon.com on laptop insurance and theft.

From The Economist, Feb 3rd, 2008

In Brazil, four laptops and two hard drives containing secret data on recent oil and gas discoveries by Petrobras, the state oil company, were stolen in what police regard as a case of industrial espionage.

From The Herald, Jan 21, 2008

More than 500 Ministry of Defence laptops and at least 23 PCs have been stolen since 1998, according to figures released in response to parliamentary questions.

Data on the hard drives of the missing computers included details of Britain’s deployment plans in advance of the 1991 Gulf War, contact information for the UK’s top military commanders and highly classified data on the new US-designed Joint Strike Fighter (JSF).

Another drive contained a comprehensive threat assessment for possible terrorist attacks on Heathrow, including the 62 most likely launch-points for anti- aircraft missiles targeting passenger jets on approach or take-off.

From the BBC, 19th January 2008

Police are investigating the theft of a laptop from a Royal Navy officer which had held the personal details of 600,000 people.

Police said the laptop was taken from a vehicle which had been parked in the Edgbaston area of Birmingham. It is believed there was no laptop insurance.

It contains data including passport numbers, National Insurance numbers and bank details.

They relate to people who had expressed an interest in, or joined, the Royal Navy, Royal Marines and the RAF.

Separately, hundreds of documents containing sensitive personal data have been found dumped on a roundabout in Devon.

Details of benefit claims, passport photocopies and mortgage payments were included in the confidential data found near Exeter Airport.

Updated: Defence minister Des Browne has admitted that the Ministry of Defence (MoD) has lost not one, but three laptops containing unencrypted information since 2005.