8m health records go walkabout A London health authority has admitted losing a laptop which contains 8.6 million health records. The machine was lost three weeks ago, but has only just been reported missing to police and the Information Commissioner's Office. We've asked North Central London health board why it needed to store 8.63 million health records …
I can't believe that once again, private information has been pinched ("lost from a storeroom") - what a load of bullsh*t. Password protected can be got around; it needs proper encryption. I guess the saving grace (if true) is that no names were on there. As a slightly unrelated side note I did some work for the MoD but at lunchtime everyone disappeared leaving me alone with many computers with no screen saver passwords. I'm so glad we've got a good secure defence strategy.
Well... you don't *have* to say anything.
Especially for a lightweight story --- a Daily Fail worthy "blackmailer's starter kit", but on 8 million nameless records. Yes, a statistician can get some correlations out of it, but I'd like to see the resulting blackmail.
<<Dear Sir/Madam, as a male resp. female from London N7 you have a 12% resp. 9.5% chance of mental health problems, and 3.2% resp. 3.1% chance of diabetes --- give us £500 or we'll write a letter addressed to "Any Woman on this address" resp. "Any Man on this address".>>
So then you know how higher incidence of a complaint over others, next thing funding gets shifted?
It doesn't matter that 95% of statistics are utterly useless, it matters that you have them. With stats comes power, usually power to subvert funds from one application to another. The stats are total bollocks but if you're clever enough to blind those with the purse strings you get to drive a big car and live in a big house!
A postcode covers a very small segment of houses.
In those houses, there will be a limited amount of people with the correct ages and genders.
This information is generally available from a variety of places (council records etc).
Given the spread of data, you'll be able to determine the date at which the data was captured, giving you the definite ages of people now.
This kind of info is highly embarrassing for people who wish to keep past mental history away from the limelight, and other health information.
It's no great shakes to uniquely identify someone from a list like this.. Unless it's all been correctly pseudonymised, such that the laptops only contain tokens for the postcodes (and possibly ages) that can only be accessed by coupling the research back to an originating data set as the final point of calculation.
"All the laptops were password protected"
means - We created an account in Windows with a username and password of admin/admin.
"our policy is to manually delete the data from laptops after the records have been processed."
means - We require staff to spend time doing something boring and long winded, ensuring that no-one bothers.
"We have started an investigation into the issues raised by the loss."
means - We are paying a consultancy agency several hundred thousand pounds to recommend that we start using encryption.
This post has been deleted by its author
Erm, no.
Find someone with a nice embarrassing condition - now then - how many people share that postcode? Let's say 20. How many are men? Ok, let's say 8. How many are 43 years old? You do see where I'm going here, don't you?
Or maybe you'd like something a little more sinister - Pick a celeb, start with postcode etc etc. Would anyone put this past the tabloid press?
Not feeling quite so smug now, are ya?
Fines don't work (it will be the tax payer who ends up paying anyways) ; kick out the management and make an example of them all.
The story doesn't make much sense, "One of the machines was used for analysing health needs requiring access to elements of unnamed patient data. All the laptops were password protected and our policy is to manually delete the data from laptops after the records have been processed"
"The machine was one of 20 lost from a storeroom".. So why wasn't the data deleted? How many more machines are lying around that health authority with data on them?
Contrast the following statements:
"All the laptops were password protected and our policy is to manually delete the data from laptops after the records have been processed."
and
"The machine was one of 20 lost from a storeroom at London Health Programmes - a research body based at NHS North Central London"
So the machine was obviously inactive and stored. If the policy is to delete the data after processing, how the holy fuck could it have 8.6m records on it? Answer: their response is bullshit; said policy's an arse-covering piece of paper that no-one actually reads, let alone enforces. Dammit, how hard is it to DBAN a laptop when it comes back in and reimage it before reuse?
I stuck on this same point as well, why are there 8.6m records on a machine that isn't assigned to anyone and is stored? If the machine haven't been stolen, then you can be sure the _next_ user would have had access to those same records. For that matter... the stores people would have had access to that data if one of the staff wanted to use the machine for some _none officially_!
...given that Truecrypt and many commercial products do whole disk encryption; the disk is encrypted, and unscrambled when the user either provides the password or some form of token (biometric, smartcard, whatever). It's policy here now that all laptops are encrypted before issue, so yes, everything on the laptop *is* encrypted and then decrypted before being worked on. Whatever you may believe.
TrueCrypt and other file / container based encryption solutions only encrypt the files / directories you want. If an application saves data outside that path, it is unencrypyted.
My corporate has two HDD's, both encrypted with "Full Disk" encryption from Check Point.
Even the boot sector, page file, operating system, temp files area and empty space are encrypted - therefore there is no opportunity for sniffing information from anywhere.
Performance impact...? Well you need dedicated testing equipment to tell but it is between 0.5 to 2% - not enough for the user to notice.
strict data protection guidance...
delete the data from laptops after the records have been processed...
was one of 20 lost from a storeroom...
So why did a laptop in a store room have these records on it if they should be deleted after processing? Surely if it was in a store room it was no longer being used and should have had all data wiped?
I'm an NHS IT support worker. (Don't laugh!)
The Trust I work for was told several years back from the very top of the tree (the information overlords of the NHS) that ALL mobile devices are to be encrypted. Our Trust has carried this out, as I'm sure have lots of others (otherwise it's balls in the vice time) ... so how the hell has this happened.
Anon cos of concerns about my job.
Rather than fining the health authority, all the money used to pay the fine will come from the NHS money that is supposed to be for treatment. Give a few month's salary of the muppets who have responsibility of the laptop. Therefore they will have to explain to their families why they have no pay for a few months. This will drive the message into their brains.
Why don't they just use the McAfee end point software that the NHS centrally licensed some years ago? ( I know the agreement has ended, but the organisations still own the licenses! )
TrueCrypt is fine if you want everyone to be an administrator. Oh wait..... that's bad too.
Absolutely NO excuse for an unencrypted laptop though. Someone should be fired.
"The records contain no names but do include other identifying information like age, gender, postcode, medical history, hospital visits, HIV status and mental illnesses."
If this is the full postcode, then they are normally specific to about 15 houses. So it becomes rather easy to tie together age, gender and postcode, with other public data like the electoral roll, to get a list of 1 or 2 possible people for each record.
I was wondering how you could get any useful information just having a postcode, your mentioning full postcodes makes much more sense now. Being from OZ our post codes encompass (what sounds like) a much larger area and in many metropolitan areas could cover many tens of thousands of people.
..i dont let their staff keep records of me on their flaky system.
It explains why I recieved this letter today, the important part here being:
"I understand this is due to your reluctance to have any information recorded on our computer system, RiO. However I am concerned that this means we can no longer see you to assess you mental health needs, and inturn, cannot provide a service to you.
Although this is your choice and right to decide, I believe part of the criteria for residing at XXXXXX is that you have a Care Co-ordinator and are seen by the community mental health team for support"
AC writes: "If this is the full postcode, then they are normally specific to about 15 houses"
Fifteen? Heck, in some cases a UK postcode may be specific to just two houses!!! (I used to live in a detached house that shared its postcode only with next door).
Agree that it's not like in some other countries where the postcode is a whole district or even town, which makes this loss far more worrying than might otherwise appear to be the case.
No doubt by dragging to the windoze trash bin and thinking that's the end of it.
Others have pointed out that NHS rules are already there (dictat from on high) and as such the people responsible for this should be facing disciplinary action
Of course it'd take an extra paragraph in the data privacy law adding personal responsibility for this kind of loss to make most people sit up and take notice - being sent to some mandatory sleep session about data practices isn't as strong a wakeup call as being landed with a 5,000 pound fine.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
