ICO criticises NHS trust for lax IT security

The Information Commissioner’s Office has criticised lax IT security arrangements at an NHS trust that could have allowed its staff and those at two other trusts to have access to restricted sensitive information they had no authority to see.

An ICO investigation of NHS Birmingham East and North’s systems found that the files in question, which were on a shared network, held information relating to thousands of individuals, including members of staff and patients.

The files were not easily accessible and some security measures were in place. However, the watchdog said the file security at the trust was inadequate in general.

Following the breach of the Data Protection Act, the trust’s chief executive, Denise McLellan, has signed an undertaking to ensure adequate measures are in place to prevent unauthorised access.

The Trust has also agreed to establish comprehensive policies regarding the storage and usage of personal data and give staff appropriate training on how to follow them.

The ICO’s Acting Head of Enforcement, Sally-Anne Poole, said: “It’s vitally important that IT networks storing personal information have robust security measures in place. Whilst nobody outside of the Trust environment was able to access the files, problems with the security of the network still led to a situation where sensitive information was potentially available to NHS staff that did not need it to carry out their daily role.”