ICO slams University Hospital of South Manchester for DPA breach

The University Hospital of South Manchester has breached the Data Protection Act by losing sensitive personal information relating to the treatment of 87 patients, the Information Commissioner's Office said today.

The breach occurred after a medical student at the trust copied data onto a personal, unencrypted memory stick for research purposes while on a placement at the hospital's burns and plastics department. The student then misplaced the memory stick in December 2010.

Having investigated the incident, the watchdog said that the hospital assumed the student had received data protection training at medical school – as a result it did not provide the induction training usually given to its own staff.

The hospital has agreed to take significant steps to ensure that such personal information assessed by students at the hospital is kept secure. This includes making sure all students on work placements are aware of data protection policies.

"This case highlights the need to ensure data protection training for healthcare providers is built in early on so that it becomes second nature," said Sally Anne Poole, acting head of enforcement at the ICO. "Medics handle some of the most sensitive personal information possible and it is vital that they understand the need to keep it secure at all times, especially when they are completing placements at several health organisations."

The Trust said it had "now taken action to ensure that contractors are made aware of its existing policy on the use of personal data, which states that staff should not store patients' information on their personal computers".

In a separate case, the ICO said a further undertaking had been signed by the London Ambulance Service, which breached the Data Protection Act after a personal laptop was stolen from a contractor's home. The laptop contained contact details and transport requirements relating to 2,664 patients who had previously used the patient transport service.