ICO censures trust over data loss

The junior doctor had used the stick to record brief details of patients' conditions and medication before handing them to the next doctor on shift. However, he accidentally took the stick home and lost the unprotected device on a train journey. It has not yet been recovered. An enquiry by the ICO found the junior doctor was not aware of the trust's data protection policies and did not have access to email to receive policy reminders and updates. It also revealed that the trust's policies on the use of USB sticks were not clear and no technical measures were in place to prevent misuse of portable devices. East and North Hertfordshire's chief executive Nick Carver has signed a formal undertaking with the ICO to ensure the trust's policy on the use of portable devices is clear and communicated to all staff. He also agreed to provide training to staff with access to confidential information, to monitor compliance with security procedures and to introduce safeguards to prevent a similar breach in the future. Mick Gorrill, head of enforcement at the ICO, said: "Storing sensitive personal data on unencrypted data stick is a risk trusts should not be willing to take. If it is vital to store information for handover, this must be done with the highest security measures in place. "Furthermore, it is vital that employees are fully aware of processes which could have prevented this incident from occurring. I am pleased that the trust has agreed to take practical and effective steps to ensure such an incident does not occur again."