Manchester hospital loses patients' personal data
The Information Commissioner's Office (ICO) has found the University Hospital of South Manchester NHS Foundation Trust in breach of the Data Protection Act (DPA) after losing an unencrypted USB key containing patients' personal data.
Sensitive personal information relating to the treatment of 87 patients at the hospital was lost after a medical student copied data onto a personal, unencrypted memory stick - provided by the Trust - for research purposes.
The student was on a placement at the hospital's burns and plastics department at the time, and lost the stick during another placement in December 2010. Following an investigation, the ICO found that the hospital did not provide students with induction training, including DPA-related training, which it gave to its own staff. The hospital assumed that the student had received data protection training at medical school.
