Watchdog raps NHS Trust for twice leaving medical information in public bins

Staff at an NHS Trust left patients’ medical information in public rubbish bins on two separate occasions, an investigation by the Information Commissioner’s Office has found.

The first incident involving University Hospitals Coventry & Warwickshire NHS Trust took place in February 2011, when records relating to the treatment of 18 patients were found in a communal waste bin at a residential apartment block.

According to the ICO, the information had been taken home by a member of staff and accidentally disposed of in a public bin along with other rubbish.

The second incident, which took place in May, saw a member of the public discover details relating to a patient’s sensitive medical procedures and test results. These were “allegedly found in a bin outside Coventry University Hospital”, the ICO said.

The ICO concluded that the NHS Trust’s policies and procedures on the use of personal information were not sufficient. Concerns were also raised during the watchdog’s investigation about the delivery and collection point for patient notes at one of the Trust’s hospitals.

"Although each separate incident did not involve a large quantity of personal data, they occurred with a two month period suggesting that the data controller did not take sufficient measures to safeguard the personal data it held," the watchdog reported.

"The Commissioner has taken into account the fact that a proportion of the personal data in question related to medical conditions and could potentially result in distress being caused to the individuals concerned."

The NHS Trust's chief executive, Andrew Hardy, has signed an undertaking in which it has agreed to review its policies on the protection and disposal of personal information. Staff will be trained to follow the updated guidelines and new procedures governing the handling of clinical data, while the Trust will also monitor compliance on a routine basis.

Sally Anne Poole, Acting Head of Enforcement at the ICO, said: “The fact that the trust lost sensitive personal information on two separate occasions within the space of two months is clearly not acceptable. Organisations across the health service must recognise that they hold some of the most sensitive personal data available and that it must never be disposed of in the same way as routine household waste.”