Tag Archives: Training and education

Dunelm Medical Practice

Posted on by

What

Loss of sensitive personal data.

How much

Two records.

Why

Two patient discharge letters were mistakenly sent to an unrelated third party organisation.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that Electronic Discharge letters are only sent by secure email, where possible and that staff are suitably trained.

Reason for action

Records were transmitted by fax and incorrect numbers were used.

When

01 July 2011.

Links

View PDF of the Dunelm Medical Practice Undertaking (Via ICO Website)

View PDF of the Dunelm Medical Practice Undertaking (Breach Watch Archive)

East Midlands Ambulance Service NHS Trust

Posted on by

What

Loss of sensitive personal data.

How much

One record.

Why

Information relating to a patient was mistakenly faxed to the wrong recipient.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that staff are sufficiently trained in the usage of and policies relating to the fax machine.

Reason for action

The wrong number was mistakenly inserted into the fax machine.

When

01 July 2011.

Links

View PDF of the East Midlands Ambulance Service NHS Trust Undertaking (Via ICO Website)

View PDF of the East Midlands Ambulance Service NHS Trust Undertaking (Breach Watch Archive)

The Ipswitch Hospital NHS Trust

Posted on by

What

Loss of sensitive personal data.

How much

29 records.

Why

A member of staff lost patient’s records in a public place.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that personal data is kept sufficiently secure and that staff are made aware that the removal of such data without clearance is unacceptable.

Reason for action

The member of staff had recently joined the organisation and received no information governance training. This followed a similar loss of data the previous year.

When

01 July 2011.

Links

View PDF of the Ipswitch Hospital NHS Trust Undertaking (Via ICO Website)

View PDF of the Ipswitch Hospital NHS Trust Undertaking (Breach Watch Archive)

Surrey Council

Posted on by

Breach details

What Loss of sensitive personal information on three occasions.
How much 241 records.
When May – June 2010
Why Records were accidently sent out in an email copied to a global distribution list, minutes of a confidential strategy discussion erroneously emailed to a newsletter distribution group. Additional records were erroneously emailed to an incorrect internal email group.

Regulatory action

Regulator ICO
Action Monetary penalty of £ 120,000
When 9 June 2011

Why the regulator acted

Breach of act Emails were unencrypted and sent to the wrong recipients.
Inappropriate organisational and technical measures.
Known or should have known The risk of incorrect drop down boxes being selected were “self evident”.
Likely to cause damage or distress Records related to special needs.

Links

View PDF of the Surrey Council Monetary Penalty Notice (Breach Watch Archive)
View PDF of the Surrey Council Monetary Penalty Notice (Via ICO Website)

North Lanarkshire Council

Posted on by

What

Loss of sensitive personal data.

How much

Six records.

Why

A home support worker’s bag which contained hard copies of records relating to vulnerable individuals was stolen.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that adequate security measures and implemented for hard copy documentation and that such documents contain the minimum amount of personal data necessary.

Reason for action

The home support worker’s bag was not locked and further investigation revealed that staff were given insufficient guidance about how to use and transport such documentation.

When

08 June 2011.

Links

View PDF of the North Lanarkshire Council Undertaking (Via ICO Website)

View PDF of the North Lanarkshire Council Undertaking (Breach Watch Archive)

Somerset County Council

Posted on by

What

Loss of sensitive personal data.

How much

One record.

Why

An employee working on two cases inadvertently enclosed one child’s assessment letter to the other family.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that procedures are implemented to record quality control checks prior to the distribution of documents.

Reason for action

The incident revealed a lack of sufficient checks and controls in areas of the data controller’s operations dealing with significant amounts of personal data.

When

13 May 2011.

Links

View PDF of the Somerset County Council Undertaking (Via ICO Website)

View PDF of the Somerset County Council Undertaking (Breach Watch Archive)

Borough of Poole

Posted on by

What

Loss on sensitive personal information on three occasions.

How much

Three records

Why

Faxes containing  personal information were erroneously sent to the wrong number.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that staff are sufficiently training in both the usage of and policies relating to the transmission of data via, fax machines.

Reason for action

Insufficiently clear instructions and training was provided to staff.

When

19 April 2011.

Links

View PDF of the Borough of Poole Undertaking (Via ICO Website)

View PDF of the Borough of Poole Undertaking (Breach Watch Archive)

University College London Hospitals NHS Foundation Trust

Posted on by

What

Loss of sensitive personal data.

How much

750 records.

Why

Loss of an unencrypted memory stick.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that portable media devices are sufficiently encrypted and that staff are trained in the transportation of such data.

Reason for action

Sensitive personal information should never have been transported off site in an unencrypted media device.

When

15 April 2011.

Links

View PDF of the University College London Hospitals NHS Foundation Trust Undertaking (Via ICO Website)

View PDF of the University College London Hospitals NHS Foundation Trust Undertaking (Breach Watch Archive)

Council for Healthcare Regulatory Excellence

Posted on by

What

Possible loss of sensitive personal information.

How much

Three records

Why

Discovery that some hard copy files relating to cases could not be accounted for.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that all correspondence regarding personal data is adequately protected and a permanent system for the logging of data is put into place.

Reason for action

It was impossible, due to insufficient data tracking, to be sure if the data had ever been received by the data controller, let alone lost.

When

15 April 2011.

Links

View PDF of the Council for Healthcare Regulatory Excellence Undertaking (Via ICO Website)

View PDF of the Council for Healthcare Regulatory Excellence Undertaking (Breach Watch Archive)

City of York Council

Posted on by

What

Loss of sensitive personal information.

How much

One record.

Why

The information was erroneously included with documentation sent to an unrelated third party.

Regulator

ICO

Regulatory action

Undertaking issued to ensure that documentation containing personal data is not printed when there is no need to do so.

Reason for action

The information was mistakenly collected from a shared printer by an employee who failed to check that the documentation was only for their case. A lack of quality control prevented this error from being discovered until it was too late.

When

05 April 2011.

Links

View PDF of the City of York Council Undertaking (Via ICO Website)

View PDF of the City of York Council Undertaking (Breach Watch Archive)