(sensitive information). Hand written notes (P2) with name at top of paper, but no other PID, no sensitive information. Hand written note (P3) with a first name only, no other PID plus a carer’s first name and address. IGI/4729 SOUTHERN HEALTH NHS FOUNDATION TRUST 01-Dec-15 30 Member of staff used Outlook email to communicate patient sensitive information, and sent it to the wrong individual via NHSmail. Email sent was a conference call sheet that contained the following PID – 16 Patient names – First name and surname – Each patient had sensitive data recorded regarding their current care in the form of current situation column and also an action taken column. Email sent was a conference call sheet that contained the following PID – 14 patient names – first name and surname – Each patient had sensitive data recorded regarding their current care in the form of current situation column and also an action taken column. 30-patient names in two emails – First name and surname – Each patient had sensitive data recorded regarding their current care in the form of current situation column and also an action taken column
Contacted by service which uncovered the incident. IGI/4142 WALSALL HEALTHCARE NHS TRUST 20-Nov-15 1 A parent telephoned to inform us that they had received a letter about their child but attached to the letter was another letter about a different child. The additional letter included the child's name, date of birth, address, hospital number and GP details. There was also a summary of the child's last appointment and advice given to the child's parents. The additional letter included the child's name, date of birth, address, hospital number and GP details. There was also a summary of the child's last appointment and advice given to the child's parents. IGI/4510 Western Sussex Hospitals NHS 20-Nov-15 20+ 20+ letters and other documents containing PCD were sent in error over a period of 3 months via courier to Serco, provider of finance services for the Trust. This includes letters in internal envelopes and for external post. Largely NHS patient data such as referral letters, discharge summaries, clinic letters, but also clinical IGI/4089 LEEDS AND YORK PARTNERSHIP NHS FOUNDATION TRUST 09-Dec-15 1 An appointment letter was sent to a service user, but was sent to the wrong address. Letter sent from the Gender Identity Service. The service had been aware of a change of address for this patient for some time and had previously Appointment letter for the Gender Identity Service.
corresponded to the correct, updated address. The new address had not been consistently updated in our systems, resulting in a recent letter being sent to the former home of the patient. IGI/4054 LEEDS AND YORK PARTNERSHIP NHS FOUNDATION TRUST 09-Dec-15 47 Rucksack lost from motorcycle whilst carrying out home visits. and notebook contained within contained data relating to mental health service users. Diary contained names of 47 service users, some with addresses, notebook contained team meeting notes about service users. and addresses of mental health service users, multi-disciplinary team meeting notes about service users. IGI/4048 ROYAL LIVERPOOL AND BROADGREEN UNIVERSITY HOSPITALS NHS TRUST 29-Oct-15 32 A patient Googled her name and was presented with basic details of her complaint to the Trust from 2013, with a URL attached to the Trust. This also included her full name, address, DOB and contact telephone number. Also contained in the search were 10 other complaints with the same data. There was no sensitive data, but I questioned (with HSCIC and the ICO) whether the fact that someone had complained about i.e. their appointment cancellation or clinical care and Patient data including name, address, DOB and contact telephone number. 2 Relatives of patients (who made complaint on behalf of patient) data included name, DOB, contact telephone and address (for 1 only) disciplinary
IGI/3966 NORTHAMPTON GENERAL HOSPITAL NHS 01-Dec-15 150 Spreadsheet emailed from Trust to CCG to indicate volumes to support business case. Patient data not removed - data required was numbers only. Spreadsheet contained approx. 150 patient names, PAS number, diagnosis, care plan Data required was numbers of patient only to support business case, whole spreadsheet was released and immediately reported on realisation of error. Additional risks - unsecure network used to release data. Patient name and PAS number of MacMillan Lung patients Diagnoses and care plan Dates of admission, discharge and (death where applicable) IGI/3989 SOUTH TEES HOSPITALS NHS TRUST 01-Dec-15 43 Doctor's handover sheet found by a member of the public and immediately handed over to a member of staff. Handover sheet lost by a junior doctor who reported it immediately to his senior. Handover contained first name, surname, age, gender, brief notes on current and past medical history, investigations and plan of care IGI/4496 AVON AND WILTSHIRE MENTAL HEALTH PARTNERSHIP NHS TRUST 19-Oct-15 1 Letter sent to wrong address PID
IGI/3949 TEES, ESK AND WEAR VALLEYS NHS FOUNDATION TRUST 06-Oct-15 1 Staff member was telephoned by third party to advise that they had received some paperwork for Client1 in the same envelope as paperwork relating to Client 2. This post was sent out by 'signed for' delivery. Third party returned paperwork by 'signed for' delivery. 1 patient - full assessment details including forensic history. IGI/3720 THE NEWCASTLE UPON TYNE HOSPITALS NHS FOUNDATION TRUST 30-Dec-15 1 Staff member accessed medical records. The of an employee contacted the Trust by letter. He had concerns that his ex-wife had accessed his medical records as she had mentioned his medical condition to a friend. HR requested the Information Security Team to run reports to find out if the lady had accessed the record. The reports showed that she had accessed his electronic patient record on Mermaid (the document management system) 18 times over a period of time. Patient electronic data
IGI/3595 Lewisham and Greenwich NHS Trust 09-Oct-15 18 The Trust was made aware of unauthorised disclosure / disposal of patient information by a member of the public. Lewisham and Greenwich NHS Trust (LGT) was made aware of the unauthorised disclosure / disposal of confidential information relating to neonatal care of babies treated in the Trust’s Neonatal Intensive Care Unit. A member of the public discovered Infection Control Checklists for Doctors used by the Trust within fly tipped rubbish in the Lower Sydenham area of London Borough of Lewisham. The records contain names, Dates of Births, Hospital numbers and various medical information relating to babies born in University Hospital Lewisham. In total data of 18 babies is recorded on these checklists. The member of the public contacted the local media who informed LGT about this breach. We since have received photographs of these records to aid the investigation of this incident. The paper records are Neonatal Intensive Care Unit Infection Control Checklists for Doctors: Dates of Births, Hospital numbers and Ventilation, Fluids / Feed, medicines, medical procedures and planned care activity.