NHS data security: Lessons to be learned

Compulsory audit

As a result of the NHS’s poor reputation for handling data securely, in February 2015 the ICO gained the power to force any public healthcare organisation to a compulsory audit, the extension of a power that previously applied only to central government.

But it is not a power it expects to use often, says Louise Byers, the ICO's head of good practice. “We usually ask for consent before imposing an order,” she says. “We have spoken to a number of NHS trusts about an audit in the [2015/16] financial year, and so far all have consented. We always want to engage with people constructively.” 

Byers says the ICO would force an audit only if an organisation refused a voluntary one and appeared to be risking non-compliance with information law. But it is a useful option to have, she points out. “Having the power incentivises organisations.”

So why has healthcare been singled out for attention? “We wanted to improve public confidence,” says Byers. “We have received a high number of complaints about NHS organisations and, through audits, we have identified a number of areas where practice can be improved. The NHS is a good area for the ICO to focus its efforts.” 

We have received a high number of complaints about NHS organisations and, through audits, have identified a number of areas where practice can be improved

Louise Byers, ICO

Byers adds that in a consultation run by the Ministry of Justice, the vast majority of responses from the NHS supported the ICO's new powers.

Common data breaches

Kai Winterbottom, the ICO’s group manager for good practice, says the most common data breaches in NHS organisations include personal data being posted or faxed incorrectly to individuals or third parties; the loss and theft of paperwork; emails being sent to the wrong recipients; loss and theft of unencrypted devices; and a failure to redact third-party data in documents before their release.

Some of these incidents are linked to the fact that the NHS continues to make substantial use of paper records, despite health secretary Jeremy Hunt directing the English health service to move towards paperless status. 

“It is important to understand that NHS trusts are extremely large and complicated organisations, with thousands of staff in multiple sites,” says Winterbottom. 

“They have to be quite open environments, as the public need access and the NHS is still quite heavily reliant on paper. It helps if organisations know what data they hold and where it is, ensure staff have an awareness of security and receive regular training, and that there are clear guidelines on taking records off-site.”

Winterbottom does not think a switch from paper to digital automatically solves security issues – but, if done with due regard to data protection, it can make a significant contribution. He mentions a trust that has issued community-based staff with fully-encrypted laptops to use on the road, asset-tagged and accessing trust systems through a virtual private network. 

As well as providing secure access to systems, the arrangement allows staff to spend more time with patients and less in the office, where they would previously have collected and returned paper records. 

There are risks with digitisation of records. The ICO recommends organisations should conduct a privacy impact assessment

Kai Winterbottom, ICO

“That is an example of how technology can be used by a trust to mitigate the risks of paper-based records and improve the delivery of frontline care,” says Winterbottom. 

“There are risks with digitisation of records. The ICO recommends that organisations should conduct a privacy impact assessment.” 

Staff training vital

Staff training is also vital. Other good practice includes enforced, regular changes of passwords and control of USB device usage, both of which Winterbottom describes as “fairly easy wins”. He also recommends a consideration of data protection at board level, in policy changes and in new projects.

The ICO also sometimes identifies NHS organisations that are doing good work, and two that were singled out last year were Solent NHS Trust, which provides community and mental health services in Hampshire, and Plymouth Hospitals NHS Trust. Both have implemented a range of measures to improve information governance.

This includes measures around printing. Plymouth Hospitals moved to a managed print service in 2012, in which staff use a key fob and a PIN to retrieve their printing. “This was primarily a cost-saving initiative, but the trust also realised benefits in the reduction of governance incidents associated with misdirected printing,” says Lee Budge, director of governance at the trust.

Solent’s information governance manager, Sadie Bell, says the trust is about to implement personal identification numbers (PINs) for printing. “This eliminates the risk of someone else collecting personal or confidential printing and information being placed at risk,” she says. 

And although Solent still holds some paper records, most information is held in an electronic patient health record that requires a smartcard for access, with levels of access based on an individual’s role.

All staff have to complete an online annual information governance refresher course

Sadie Bell, Solent NHS Trust

Plymouth is also moving to reduce its paperwork, with some departments planning to move to digital case notes later this year or early in 2016. 

“This has been supported by a complete upgrade of the trust’s datacentres and investment in single sign-on and client-side technology to ensure clinical staff can access systems quickly, reliably and at the point of care,” says Budge. 

Restricts use of USB devices

The trust also restricts the use of USB devices, allowing only designated encrypted ones; secures iPads and the like with a centralised mobile device management system; and is bringing in a virtual clinical desktop, so clinical data is not held on mobile devices.

Training is another important element of securing information, according to Solent's Bell. “All staff have to complete an online annual information governance refresher course,” she says. “Some 95% of staff are trained every year and the target is closely monitored by the trust’s board. We also target and support specific areas within the trust, tailoring training at a service level.” 

Each of Solent’s eight service lines has its own information governance representative.

Plymouth Hospitals includes information governance in its corporate induction, annual updates and junior doctors’ training. “An hour-long seminar is used to discuss various scenarios and the consequences of data breaches,” says Budge. It also reminds staff of the issue through newsletters, daily emails, posters and even screensavers.

Budge says incident management is an important aspect of protecting information, with the information governance team checking all incidents reported across the trust. “Incidents are scored and serious incidents require a formal root cause analysis report,” he says. “The area where the breach occurred is always involved in this report and is therefore involved in identifying the learning.” 

Plymouth Hospitals requires a manager from the relevant department to inform anyone whose data has been wrongly disclosed, and reports serious breaches to the ICO.

Culture of openness

“We have worked hard to promote a culture of openness and transparency in reporting and responding to information governance issues,” says Budge. “We see this as the critical first step in ensuring that we learn from our mistakes, rather than blame people for them. In doing this, we ensure that staff take ownership for identifying and implementing the actions required to address the root causes of incidents. 

We have worked hard to promote a culture of openness and transparency in reporting and responding to information governance issues

Lee Budge, Plymouth Hospitals NHS Trust

“In the past, too many incidents were put down to human error and no further action was taken, so we now ensure that staff understand the consequence of poor data handling, patients are sent an apology and, above all, patient care is not compromised.”

Bell says Solent NHS Trust has the ability to lock down and restrict certain information at a patient’s request. “While this is more common in mental health services, the functionality is available to all services and patients,” she adds.

Bell says the trust benefits from continuous monitoring and improvement of its information governance arrangements, and has champions in each service to check things are working and to raise specific concerns. 

“Analysis of service line activity and data flows is undertaken quarterly to assess areas of good compliance, so that best practice can be shared,” she adds.