Student's flimsy bin bags blamed for latest NHS data breach
- Reference: 1718278207
- News link: https://www.theregister.co.uk/2024/06/13/nhs_bin_bag_data_breach/
- Source link:
An investigation was launched following the discovery of confidential medical data sprawled across a back alley in Jesmond, a pricier suburb of Newcastle in the North East of England.
The medical student is thought to have thrown the documents into their domestic waste, which was placed outside for collection, but through one means or another, the documents escaped to the freedom of an alleyway off Lonsdale Terrace only to be found by a passerby.
[1]
Cumbria, Northumberland, Tyne and Wear NHS Trust (CNTW) said it was confident that the documents were recovered.
[2]
[3]
It's understood that the documents and data belonged to at least two patients and included a letter sent to a patient's doctor marked "Private and Confidential." The information included personal and sensitive details about the patients.
The trust's deputy chief executive and executive medical director said the matter is considered closed and those affected have been contacted.
[4]
Dr Rajesh Nadkarni, told The Reg : "A medical student on placement with CNTW was in possession of confidential clinical information in the course of their placement work. We were subsequently informed by a member of the public that they found this information among household waste.
[5]London hospitals left in critical condition after ransomware attack
[6]NHS Digital hints at exploit sightings of Arcserve UDP vulnerabilities
[7]UK public voice fear over security in NHS data systems
[8]Nearly 1M medical records feared stolen from City of Hope cancer centers
"A full investigation has been completed, and we are assured that all of the confidential information held by the medical student has been recovered. We have been in contact with those affected by this breach of confidentiality, and are providing them with updates on the outcomes of this investigation.
"All medical students receive training on information governance, and students on placement with CNTW attend an induction and receive an information pack which stresses the importance of confidentiality, and our policies and processes which support this.
"We will ensure that the learning we gain from this investigation is acted on to improve our services. It is vital that people feel confident that their information is protected and handled appropriately at all times by us, and we will ensure that we learn from this incident to continue to do so for our communities."
We also asked if the student would face any punishment, but the trust wouldn't comment.
[9]
Although it certainly can't be considered the most catastrophic [10]breach the NHS has ever experienced, it's probably not the memory any student would want to leave behind at a potential future employer while on a work experience placement.
But the incident will almost certainly be raised as an amusing anecdote when delivering data governance training for at least the next few years. ®
Get our [11]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZmsXo32I2zNRPMmDxkQkiAAAANY&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXo32I2zNRPMmDxkQkiAAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXo32I2zNRPMmDxkQkiAAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZmsXo32I2zNRPMmDxkQkiAAAANY&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://www.theregister.com/2024/06/04/suspected_cyberattack_hits_major_london/
[6] https://www.theregister.com/2024/05/14/nhs_arcserve_udp/
[7] https://www.theregister.com/2024/05/13/uk_public_nhs_data_survey/
[8] https://www.theregister.com/2024/04/03/city_of_hope_data_theft/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZmsXo32I2zNRPMmDxkQkiAAAANY&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2024/03/28/nhs_scotland_cyberattack/
[11] https://whitepapers.theregister.com/
Medical training...
Worst case, this will come in handy for the medical student struggling with anatomy.
[1]https://supersimple.com/free-printables/skeleton-dance-worksheet-fill-in-the-blanks/
Icon: Head bone
Sir Lancelot Spratt would probably have a few choice words to say to this medic
[1] https://supersimple.com/free-printables/skeleton-dance-worksheet-fill-in-the-blanks/
"The worrying thing is whether the medical training was retained any better."
The medical training is theory taught in lectures and regurgitated in essays, then tested (more than once) for retention, then demonstrated in a practical setting, then performed by the student over and over until they get it right. The Information Governance training is a leaflet.
Inexcusable
Even if the bags did rip, why had the documents not gone through a cross-cut shredder? This is basics. Absolute, day one, apprentice trainee understudy shit.
Punish the student, and take their manager to task for not provising the training or failing to enforce it.
Re: Inexcusable
> Even if the bags did rip, why had the documents not gone through a cross-cut shredder?
Exactly this.
I was once a temp in a [paper] health records library, over twenty years on I still recall the rules we had to work under (and I expect in this post-GDPR world they've got much stronger)
Re: Inexcusable
Hey, it's end of term... don't want to turn up to the digs at the start of next term to discover the near sentient contents of hundreds of mouldy pizza boxes...
Chuck them all out... oh and all that paper as well
Re: Inexcusable
Knowing a few medical students as I do, many come across as arrogant "rules are for plebs" types. You know, just like the Marketing Director types who insist on forwarding business emails to their personal account so that they can "access them more easily while travelling" because the VPN is too much hassle. Or the politician who ignored the instruction to replace their SIM yet allowed the kids to run up a £15k bill watching football.
It's not stupidity. It's arrogance. And in my experience they will never accept that they are in any way to blame.
Yes, I'm in a bad mood after being reminded of the idiots I've had to work with.
Re: Inexcusable
How on earth were they in possession of *printed* copies of correspondence? And the fact that they then thought that they could put any kind of NHS papers in the bin afterwards?!?...
Re: Inexcusable
"Knowing a few medical students as I do, many come across as arrogant "rules are for plebs" types"
I'd hesitate to say "many", but I'd agree to a good extent. My daughter's a 3rd year med student, and she's encountered all manner of lazy entitlement and misbehaviour from a minority of the course. The standards for admission are too heavily biased towards excellent high school grades, the medical schools themselves arrogantly write off many people who would be excellent candidates and prefer people with excellent grades but without either the commitment to such a hard course, or the integrity or empathy to make good doctors. The course then has high drop out rates.
An interesting rule of thumb appears to be that if somebody has wealthy parents, they'll be a very poor choice as a medical student.
Re: Inexcusable
Having encountered a good few doctors in their larval stage when I was a student myself I've always found it hard to treat the final product as anything other than any other sort of graduate I might encounter.
Re: Inexcusable
I came here to post exactly this. Heads should roll, and not necessary the easy-to-blame student. This stuff never should have left the patient file or the doctor's desk without passing through the shredder. This shit is the basics . If they can't get that right, what else are they screwing up? Flinging X-rays to each other using Dropbox, perhaps?
Re: Inexcusable
As we don't know the underlying situation I'd be reluctant to accept some of the assumptions here. As a student the case notes might be part of an exercise taken home to work write up there. Cross cut shreds wouldn't be much use there and suitable shredders aren't going to be part of student digs furnishings. It's the thought that they should be disposed on in this way that's worrying.
TFA did specifically say training was given. Experience is a dear teacher but there are those who will learn at no other. I hope we can take it that this student has finally learned.
Re: Inexcusable
I have a feeling that the entire of Newcastle University’s medical school should do some shredding training. Like 1000 pages a day through a cross cut shredder that can only take max 10 pages at a time.
Seriously, this information breach is inexcusable in today’s day and age. I am a physician and have given handovers to junior doctors for on calls, but rules were that the paper sheet did not leave the hospital and were shredded as soon as out of date on the ward shredder. Would love to say that the EHR would mean a no paper copy would be possible, but our EHR has some uptime issues so paper is the fall-back plan.
The ICO is going to have sanctions on both the hospital and the University.
Re: Inexcusable
Indeed.
Ah, so, lessons learned, right ?
Yeah. Somehow, I don't feel all that comforted by the idea.
Wonder why . . .
Clinical staff never face punishment for what they do unless the publicity doesn't go away, or a senior clinical lead doesn't like them.
Kitty-based vulnerabilities are not new.
At my old address, many decades ago, I would tidy up the back alley. One week was a mess. Papers everywhere from one of the neighbours' bin bags, liberated by the local felines. Had a look at them as I assembled them to rebag. Details of arms deals - enough to invade a small island. Lists of weapons from some of the countries the Foreign Office no longer send Christmas cards to.
As this was when the [original] IRA were active, handed them in to the local plods. Heard nothing back. No cops visited the area. Presumably it was his legit side hustle. Who knows what your neighbours are up to on the sly?
Hasn't the UK completed the wheelie-bin transition yet? In garbage terms, the Pivot to Lids.
Slash bin
> The medical student is thought to have thrown the documents into their domestic waste, which was placed outside for collection.
And no doubt contained food waste that the local foxes smelled.
Though why a student had taken confidential documents away from their workplace is a question worth asking.
absolutely neglectful
Back in my youth as a dogsbody cashier in a high street bank all waste with any confidential information had to go into dedicated confi waste bins.
This wasn't just an information leaflet that was sent out and forgotten about; they would randomly check your non-confi bin a few times a week and if you got caught with so much as a first name written on a piece of paper you were fucked.
Actually taking this information out of the building with you to an unsecure location? fugeddabowdit
Even 20 years after i left that place I can't bin so much as an envelope without cross-shredding it first and putting into the compost. the training is just that ingrained into my soul
Actually a few years ago i caught a smackhead doing the rounds of the recycling bins kerbside one week. Chased him off and called the coppers out on him, but it suddenly all seemed worthwhile that I knew my stuff was just generic packaging
There's a good chance that this will have a bigger influence that the training on information governance and the information pack did. The worrying thing is whether the medical training was retained any better.