Health bosses order data amnesty

The memory stick belonged to a health worker

Health bosses have ordered a data amnesty after an employee lost personal information of 137 patients.

NHS Lothian launched the campaign to ensure all 28,000 staff understand the rules on storing sensitive data - and own up if they lost files themselves.

The move comes after a worker admitted losing a computer memory stick with copies of letters sent to Edinburgh GPs by NHS Lothian over two years.

The letters cover details of patients in the central Edinburgh from 2006.

Martin Egan, NHS director of health, said: "We take active measures to ensure that everyone is aware of our policies.

"But following the reported loss of a memory stick containing patient information we decided to launch a special campaign to drive home the message that data security is everybody's business.

"The rules on the issue are clear and simple, but people have to follow them if we are to keep information safe."

Face-to-face

The amnesty is among a series of plans to highlight the security issue. It allows anyone who has illegally stored sensitive information to come forward and have it disposed of safely without being disciplined.

The NHS is also taking a roadshow around hospitals and credit card-sized leaflets are being sent out with payslips.

All patients whose details are on the missing device are being contacted to have face-to-face interviews with NHS staff.

NHS Lothian refused to confirm what disciplinary action had been taken against the health worker who lost the files.

The health board informed the Scottish Government health department and the Information Commissioner on Friday last week.

Police were contacted on Monday after premises were searched for the missing memory stick.

The amnesty was announced as the government set out guidance to the NHS on data handling.

The report, published on Friday, stated: "It is important that all staff members are aware of and comply with all security measures put in place to protect all health records."

The report warns that people misusing data could be prosecuted under the Public Records (Scotland) Act 1937.

It added: "It is therefore essential that staff within the organisation with responsibility for records management comply with the policy otherwise they may be subject to disciplinary procedures."

E-mail this to a friend

Printable version