Tag: Baroness Byford

The below Parliamentary question was asked by Baroness Byford on 2014-05-07.

To ask Her Majesty’s Government, further to the Written Answer by the Parliamentary Under-Secretary of State for Health, Dr Daniel Poulter MP, on 18 March (HC Deb, 574W), how many of the 145 serious data breaches reported for acute trusts were the result of theft; how many individuals were involved; how many trusts were implicated; and how many trusts were involved in more than one such breach.

Earl Howe

In the period from 1 June 2013 to 14 March 2014 where details of serious incidents have been reported through the Health and Social Care Information Centre (HSCIC) Incident Reporting tool there have been 21 breaches reported by acute trusts under the categories of either ‘lost or stolen’ hardware or paperwork. Seven of these are verified as theft and 14 are possible thefts but this has not been proven. 19 trusts each reported a single incident and one reported two.

The numbers of individuals affected are indicated in the volume column of following table.

ID (IG Incident log look up number)	Lost or Stolen?	Volume (estimate in some cases)
IGI/1581	Lost/Stolen	29
IGI/1558	Stolen	15
IGI/1564	Lost/Stolen	132
IGI/1746	Lost/Stolen	20
IGI/1497	Lost/Stolen	38
IGI/1421	Stolen	46
IGI/1599	Lost/stolen	7
IGI/1316	Stolen	416
IGI/1255	Lost/Stolen	23
IGI/1256	Stolen	2
IGI/1251	Stolen	15
IGI/1206	Lost/stolen	13
IGI/1015	Lost/stolen	27
IGI/1160	Lost/stolen	1
IGI/947	Lost/Stolen	7
IGI/879	Lost/Stolen	15
IGI/730	Lost/Stolen	17
IGI/1385	Lost/Stolen	4
IGI/663	Stolen	100
IGI/493	Stolen	115
IGI/533	Lost/Stolen	5,000

The below Parliamentary question was asked by Baroness Byford on 2014-05-07.

To ask Her Majesty’s Government whether persons whose National Health Service data has been compromised are informed of that fact; and, if so, what remedy or compensation is available to them.

Earl Howe

National Health Service organisations are individually responsible for managing incidents where patient data has been compromised. Guidance provided by the Health and Social Care Information Centre is that data subjects should be informed when personal data about them has been lost or inappropriately placed in the public domain, unless the cost of doing so would be prohibitive or the risk to those concerned is judged to be minimal. Where there is any risk of identity theft it is strongly recommended that this is done.

There are no central guidelines on remedies or compensation. Individuals whose data has been compromised may make a complaint through local NHS complaints procedures or if they believe that an incident resulted from a breach of data protection requirements they may report this to the Information Commissioner. In some circumstances individuals might seek redress through the Civil Courts.