NHS transplant service sent sensitive patient data over unencrypted pagers
NHS Blood and Transplant has acknowledged a personal data breach after sensitive information about transplant patients was routinely transmitted through an unencrypted pager network.
A BBC investigation found that messages included patients’ names and dates of birth, details of organs being offered or required, tissue matching scores and immunosuppression risk factors. NHSBT said it had not appreciated that the messages were unencrypted and has apologised for the breach. Pager communications are transmitted using radio signals and may be intercepted by anyone with suitable receiving equipment tuned to the correct frequency. Because recipients of the messages cannot be tracked, NHSBT has been unable to establish whether the information was accessed by unauthorised people or determine precisely how many patients may have been affected.
NHSBT has now stopped transmitting sensitive information through the pager network and begun an internal investigation. It has reported the incident to the ICO, which has confirmed that it is making enquiries.
Ann Bevitt, Partner at Cooley and author of the chapter on ‘Data Security, Cybersecurity and Breach Notifications’ in the forthcoming seventh edition of ‘Data Protection: A Practical Guide to UK Law’, said: “This incident clearly highlights the need for organisations to consider and assess security risks on an ongoing basis. It is not sufficient to treat compliance as a once-off obligation. Continuous review of the security aspects of technological systems is required on a continuing basis to ensure that personal data are adequately protected.”
For more information, see our course on Breach Management – Preparing for the Worst.
