Watchdog slams trust over data standards

THE UK information watchdog has told NHS Birmingham East and North to improve its IT systems after an investigation revealed lax data protection standards could have led to its own staff and those at other nearby organisations inappropriately accessing patient data. The Information Commissioner's Office (ICO) launched an investigation in September after a management report submitted by the trust revealed the breach with data security in September 2010. The trust hosts the Birmingham Primary Care Shared Services Agency (BPCSSA), which also provides IT services to two other primary care trusts - NHS South Birmingham and NHS Heart of Birmingham. It was BPCSSA that was the subject of the investigation. A document published on the ICO website stated that the management report showed that staff at all three organisations could have viewed restricted electronic files held by the BPCSSA, although they could not have been viewed by members of the public. Although there were some permission systems in place, 'file security in general was inadequate', the document adds. A spokesperson for the ICO said the standardised care records had not been compromised, but that the files did contain some 'general high level information about patients'. However, the watchdog has decided not to take any further action as NHS Birmingham East and North has already taken unspecified remedial action. The trust has also pledged to ensure security measures are adequate, complete an Information Asset Register containing details of all information that is not publicly available, improve staff training, and produce comprehensive data storage and use policies.