Tougher penalties planned for NHS data losses

The information commissioner has called for tougher penalties on NHS trusts and hospitals who lose patients' personal medical records.

Christopher Graham said fines of up to £500,000 could be imposed to counter what he called a "disturbing" culture in the health service. Millions of records are believed to have been lost by health organisations in data breaches, which include staff losing laptops, memory sticks and documents.

In an interview in the Independent Graham said: "There's just too much of this stuff going on. The senior management is aware of the challenge but the breaches continue. Whether it's a systemic problem in the NHS or an epidemic we have got to do something about it. Health service workers look after their patients very carefully but don't always look after their data very carefully."

Graham has requested a meeting with the chief executive of the NHS, David Nicholson, to discuss the problem. "It's a much wider problem and we do need some tougher penalties because the courts don't seem to regard it as a terribly serious offence," he added.

He made the comments as he revealed that five more health organisations had agreed to improve security following major data breaches – all can be prosecuted under section 55 of the Data Protection Act.

They included Ipswich Hospital NHS Trust, which saw a staff member misplace 29 records; East Midlands Ambulance Service NHS Trust; Lancashire Teaching Hospitals NHS Foundation Trust; and Basildon and Thurrock NHS Foundation Trust.

The commissioner was also investigating how the NHS North Central London Trust lost a laptop containing an estimated 8.3 million patient records.

Graham added: "It could either be deeply embarrassing and upsetting to people who are not well. But also it's a source of personal information which can be abused for all sorts of purposes about identify theft, blackmail or whatever. There's a market in the unlawful disclosure of personal information that's supposed to be protected by the Data Protection Act."