Disaster recovery Toolkit

Patient details lost after NHS laptop theft

Kablenet.com

Published: 17 Dec 2007 16:25 GMT

Patient records which link to images of individuals' retinas were held on a laptop stolen from a GP's surgery in Wales.

Cardiff and Vale NHS Trust has admitted that a laptop computer was stolen from St Julian's GP surgery in Newport, Wales on 5 November.

Although the laptop does not contain any medical information on patients, it does hold details of clinic lists, which include patients' names, addresses, dates of birth and contact telephone numbers. The record links to an image of the patient's retina and, in some cases, the patient's NHS number is also recorded.

There is some uncertainty around the true scale of the incident, but some 950 patients have definitely been affected by the incident and the trust said it would write to each of them individually.

In a statement issued on Thursday, the trust's chief executive, Hugh Ross, said: "It is possible that further patient records, which were due to be deleted, may still be stored on the computer. The trust has no way of knowing if this is the case unless the laptop can be recovered."

Commenting on security measures, Ross said: "All trust computers are password-protected to an approved NHS standard to ensure that only NHS staff can access the system. In addition, there are a further two levels of security on this laptop before patient information can be accessed."

Read this

Feature: Cracking open the cybercrime economy

Hacking for fun has evolved into hacking for profit, and created a business model that is nearly as sophisticated as that of legal software

Describing the case as an isolated incident, Ross confirmed that an internal investigation was being carried out into all aspects of the trust's service, including security.

The trust said the incident was reported immediately to the police and the Diabetic Retinopathy Screening Service (DRSS), which screens a total of 150,000 patients across Wales. When the DRSS holds clinics in various locations in the community, staff upload relevant patient information onto laptops. Data is then deleted from the laptops and transferred to a central database once staff return to base.

The trust says that regularly purging patient information from laptops ensures that only a limited number of patient records are stored on these computers at any given time.