NHS Fife has been rapped after an “unauthorised” person wandered into a hospital ward, gave care to a patient and then made off with more than a dozen people’s personal details.
The woman was able to gain access to a ward at St Andrews Community Hospital in February.
A report from the Information Commissioner’s Office (ICO) found she did not undergo an identity check.
As a result, she was able to assist in giving care to one patient.
The woman was also handed a document containing the personal information of 14 people – which has never been tracked down.
Data taken from NHS Fife hospital not recovered after CCTV blunder
A statement from the ICO said: “The data was taken off-site by the person and has not been recovered.
“While the hospital had CCTV installed, the wall socket with the CCTV had been accidentally turned off by a member of staff prior to the incident.
“The police have not been able to identify the person or recover the lost data, hindered by the lack of CCTV footage.”
The nature of the care given to the patient, and the type of information taken, has not been revealed.
The watchdog concluded that NHS Fife did not have “appropriate security measures” in place for personal information, and there was also a lack of staff training.
The ICO says since the incident, NHS Fife has introduced a system for documents containing patient data to be signed in and out, as well as an updated identification process.
Other hospitals are now being urged to improve their standards of data protection.
‘People need to trust that their data is secure’
Natasha Longson, head of investigations for the ICO, said: “Patient data is highly sensitive information and must be handled with the appropriate security.
“When accessing healthcare and other vital services, people need to trust that their data is secure and only available to authorised individuals.
“Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to security checks and authorised access.
“We are pleased to see NHS Fife has introduced new measures to prevent similar incidents from occurring in the future.”
ICO makes recommendations to NHS Fife after ‘unauthorised person’ breach
As part of its reprimand, the ICO has recommended that NHS Fife could improve its data protection compliance by:
- Improving the overall training rate, in line with current legislation
- Developing guidance or a policy in relation to formal ID verification
- Reviewing all policies available from their intranet, ensuring that they are all up-to-date and accurate, with archived versions clearly marked
- Revisiting the data breach reporting process and ensuring relevant personal data breaches are reported within 72 hours
A spokesperson for NHS Fife said: “Earlier this year an individual purporting to be a member of agency nursing staff attended St Andrews Community Hospital.
“The individual was only on a ward for a short period of time and left shortly after being challenged by a member of the nursing team.
“While the person was never alone with any patient, they did have access to a handover document containing information relating to patients on the ward.
“NHS Fife and Fife Health and Social Care Partnership, who operate the facility, immediately reported the incident to Police Scotland and also referred the incident to the Information Commissioner’s Office.
“The patients involved and their families were informed of this breach of security.
“We acknowledge the findings of the Information Commissioner’s Office, and have apologised to those involved.
“A range of additional measures were put in place shortly after the incident to prevent such a matter from occurring again in future.
“We have since carried out a significant adverse event review and a working group has been established to implement the recommendations of both the information commissioner and the findings of our own review across the entirety of NHS Fife.”
A Police Scotland spokesperson said: “Around 3.40pm on Wednesday, 1 February, 2023, we received a report of a woman posing as a member of staff at St Andrews Community Hospital, St Andrews.
“Inquiries have been carried out and nobody has been arrested.”
Earlier this year, an independently run Newport GP practice referred itself to the ICO after a data breach involving patient invoices.
Conversation