Rapid Responses to:

LETTERS: Matthew Daunt Security protection is needed when using USB sticks BMJ 2007; 335: 112 [Full text]

Rapid Responses: Submit a response to this article

Rapid Responses published:

congratulations on identifying a serious issue:how common is this problem?

Mary Hawking   (27 July 2007)

The Security of Patient Data On Portable Mass Storage Devices - an ongoing problem

Sven E Putnis, Andrew Bircher, Duncan Tennent   (17 November 2008)

congratulations on identifying a serious issue:how common is this problem? 27 July 2007
Mary Hawking, GP Kingsbury Court Surgery LU5 4RS Send response to journal: Re: congratulations on identifying a serious issue:how common is this problem?	Dr Daunt is to be congratulated on identifying a serious - and probably common - issue. One of the danger zones for patient care is the area where care is passed from one person or team to another - handover in hospitals, and discharge/admission between secondary and primary care. Obviously, the availability of electronic means of passing information needed for handover means that these will be used to increase efficiency and, hopefully, decrease the patient risk from inadequate handover information. So the issue is not only the security risks of allowing junior doctors (and others) to use their own initiative, but also how new methods of passing information are managed and made fit for purpose and secure. I am a GP, but I assume that the problem is universal within secondary care wherever there is a need for repeated rapid handovers: has this risk been considered in other Trusts and if so, where can more information on best practice be found? If it has not been considered, one can only wonder why not... Competing interests: None declared
The Security of Patient Data On Portable Mass Storage Devices - an ongoing problem 17 November 2008
Sven E Putnis, Trauma & Orthopaedic Registrar St Georges Hospital N51XD, Andrew Bircher, Duncan Tennent Send response to journal: Re: The Security of Patient Data On Portable Mass Storage Devices - an ongoing problem	Loss of computerised data remains an international problem affecting both industry and healthcare. Despite this survey published in July 2007 and the loss of 168,000 patient details in that same year(1), headlines continue to hit the news. In the last year tens of thousands of confidential patient details have been lost on stolen laptops in Colchester(2), Wolverhampton(3) and London(3). We surveyed 105 doctors at a large NHS Trust teaching hospital and found that 92 (88%) of the doctors held portable memory data storage devices and of these 79 (86%) held confidential patient information. Only 5 of the 79 memory sticks had password protection enabled. 74 (70%) of all the doctors surveyed were carrying unencripted confidential patient details on portable devices on their person. We have no reason to believe that clinicians in the NHS Trust surveyed carry patient data any differently from those across the UK or abroad. Over the last decade there have been numerous calls for a rapid expansion of the NHS Information and Communication Technology (ICT)(4). This was highlighted in the Wanless report(5), which called for a doubling of the NHS ICT budget, and led to a Department of Health National Strategic Programme entitled ‘Delivering 21st Century IT Support for the NHS’(6). The subsequent large increase in electronic data combined with the relative reduction in both the cost of digital storage and its physical size, has enabled individuals to carry much larger quantities of computerised patient information. On the 1st of April 2005, NHS Connecting for Health(7), came into operation. Its departmental objectives are to integrate new computer systems and services and prioritise the safe handling of patient data. Concerns regarding encription of data which were highlighted in our survey are addressed by the Connecting for Heath department, with a recent national procurement of an encryption solution for removable media(8). Doctors have always held a responsibility to use their patient’s medical details in a secure and confidential manner. Large volumes of data can now be stored in very small devices which therefore must have built-in security. Individual users should either purchase a proprietary encryption program or obtain one from their hospital trust. The consequences of a lost storage device is increasing and awareness throughout the entire health service needs to be equally raised. References 1. NHS ‘can be trusted’ over records. BBC News. 24 December 2007 2. Britten, N. Hospital manager suspended over stolen laptop with 21,000 patient records. The Telegraph. 30 Jun 2008 www.telegraph.co.uk/news/uknews/2223548/Hospital-manager-suspended-over- stolen-laptop-with-21000-patient-records.html 3. Kirkup, J. 30,000 NHS records lost as seven laptops stolen. The Telegraph. 18 Jun 2008. < www.telegraph.co.uk/news/uknews/2151996/30000 -NHS-records-lost-as-seven-laptops-stolen.html> 4. Delivering the NHS plan. DH Publications April 2002 5. Wanless, D. Securing Our Future Health: Taking a Long-Term View. HM Treasury Publication. April 2002 6. Delivering 21st Century IT Support for the NHS. DH Publications. June 2002 7. Connecting for Health accessed 10 Sep 2008 8. Trustmarque Solutions & NHS. www.trustmarque.com/Sectors/NHS.aspx accessed 10 Sep 2008 Competing interests: None declared