back to article NHS Digital booking website had unexpected side effect: It leaked people's jab status

An NHS Digital-run vaccine-booking website exposed just how many vaccines individual people had received – and did so with no authentication, according to the Guardian. The booking page, aimed at English NHS patients wanting to book first and second coronavirus jabs, would tell anyone at all whether a named person had had zero …

  1. Pascal Monett Silver badge

    "run vaccine checks on the status of random people with no authentication"

    Well thank goodness you're out of the EU now - that would have been a prime violation of GDPR.

    But you've taken back control, so there's no problem, right ?

    1. Anonymous Coward
      Anonymous Coward

      Re: "run vaccine checks on the status of random people with no authentication"

      'Well thank goodness you're out of the EU now - that would have been a prime violation of GDPR.'

      From:

      https://ico.org.uk/for-organisations/dp-at-the-end-of-the-transition-period/data-protection-now-the-transition-period-has-ended/the-gdpr/

      'The GDPR is retained in domestic law now the transition period has ended'.

      It might change but for now it is still the same.

      And of course now we've left we have £350 million a week extra in our economy (do we fuck) and it will all be spent on the NHS as promised on the bus (even if we had it it wouldn't have been).

      And yes, technically we've taken back control. What power we have to do with that control is up for debate.

      Early days but I'd say we have much less influence than our 'Leave' politicians promised.

      I voted to remain as I saw almost no benefit in leaving.

      I've seen nothing to change my mind on that.

      Stay well Pascall.

      1. Anonymous Coward
        Joke

        Re: "run vaccine checks on the status of random people with no authentication"

        "I voted to remain as I saw almost no benefit in leaving.

        I've seen nothing to change my mind on that."

        But what about all that fish? We've won the Battle of St Helier!!! Cry ‘God for Harry, England, and Saint George!’

        1. Dave 15

          Re: "run vaccine checks on the status of random people with no authentication"

          So there is no benefit in being able to invest in our own industry, decide our own policies, decide whether to send troops somewhere or not, our own taxation, our own laws?

          If there isnt why the hell did our forefathers fight the French, Spanish and Germans to maintain our independence? We may just as well have let the Nazis come in and decide who was allowed to breed or not.

          Now I do agree that BoJo signing the stupid trade agreement (under pressure from pro europeans) fucked up the leave. Frankly I dont want to stay aligned to a block that doesnt import anything anyway and even confiscates lorry drivers cheese sandwiches as if they were an import to be resold (hell, the Dutch, Germans and even the French known nowt about cheese, their tasteless rubbery offerings are inedible).

          I have a suggestion for those who want to be ruled by Brussels and the inevitable large scale bribery (they are NO better than the UK MPs and civil servants about being bribed - I have worked on lobbying in Brussels and it is a case of crossing palms with the requisite amount of presents), go and move to the EU. Its not difficult, a little paperwork and you are there. I doubt my grandad would have wanted to stop anyone moving to Nazi Germany, he just wanted to stop Nazi Germany coming to the UK, something Heath forgot all about

    2. Anonymous Coward
      FAIL

      Re: "run vaccine checks on the status of random people with no authentication"

      You people are pathetic, we left, you lost, get over it !

      1. Anonymous Coward
        Anonymous Coward

        Re: you lost, get over it !

        Do you think that choice of words would work on Scottish nationalists?

        +

        Just asking for a friend, obviously.

        1. Dave 15

          Re: you lost, get over it !

          Frankly it should, they had a vote just a couple of years ago and lost. However the bitch from the north cant stop her mouth flapping. It seems that the Scottish cant stop voting for her and her high tax, mismanaging bunch of thugs.

          However, I think it is not a matter of Scottish independence, Scotland is currently part of the UK, its a UK matter. The referendum should be a UK wide thing - just as the EU referendum was. This may be an approach the awd bitch should back, I can pretty near guarantee that if you include the English in the vote then Scotland will be independent the following day. There is of course the money the Scottish need to pay for their share of the debt and the relocation of the naval and airforce facilities. The setting up of a currency of their own. And if the awd biddy does get her way your independence will not last for long and you will become an insignificant part of the EU to be told what to do by the Germans - they are not nearly as nice as the English, you wont get as much money for a start, you will be forced to use the euro and then cripple what is left of your industry and way of lie by obeying German started rules. Good luck with it.

          1. codejunky Silver badge

            Re: you lost, get over it !

            @Dave 15

            "And if the awd biddy does get her way your independence will not last for long and you will become an insignificant part of the EU to be told what to do by the Germans"

            Thats if the EU would allow a demic like Scotland into their membership. They would be taking on a hell of a deficit for people who will only complain for more free stuff.

            The only reason I can see the EU accepting Scotland would be to get another border close to the English. Then it will be like watching ROI trapped in EU stupidity (see vaccine) while just over the border they are can see what they need.

      2. Anonymous Coward
        Anonymous Coward

        Re: "run vaccine checks on the status of random people with no authentication"

        Only winning from now on! Time to cry haddock and let slip the cods of war?

      3. Hubert Cumberdale Silver badge

        Re: "run vaccine checks on the status of random people with no authentication"

        Wow. That is some supreme cuntery right there.

        1. Anonymous Coward
          Anonymous Coward

          Re: "run vaccine checks on the status of random people with no authentication"

          Plenty of that further down too.

    3. Anonymous Coward
      Anonymous Coward

      Re: "run vaccine checks on the status of random people with no authentication"

      As has been said, we're still have to follow GDPR.

      I voted to remain. Worked at the referendum. Then the cunt local councillors who voted to leave and won, had the cheek to ask me to take a photo of them all celebrating. Wanted to say fuck off but I liked my job. And them being bent fucks would of, illegally, convinced management to fire me. And cause management has no spine and I'm convinced is on the take (now finally leaving) would of gone along with it, despite it being a massive breach of the Councillor Code of Conduct.

      1. Hugo Rune
        Headmaster

        Re: "run vaccine checks on the status of random people with no authentication"

        Don't know if I should upvote for the comment or downvote for the two "would of".

      2. Robert Carnegie Silver badge

        Re: "run vaccine checks on the status of random people with no authentication"

        You could have done a lovely picture with your thumb in the front.

      3. Dave 15

        Re: "run vaccine checks on the status of random people with no authentication"

        management on the take? illegal activities? You make it sound the preserve of some politicians. Let me correct you, they are ALL on the take, ALL illegal, ALL lining their own pockets/feathering their nest. If you arent then you should get straight on the bandwagon... ALL your colleagues are, even the bloody cleaner. This country is corrupt from the top politician down to the lowliest. The ONLY way in the UK (or indeed the EU) of getting on is to bribe the right person. Gift a few shares to Hancock and his sister and magically a contract will come your way, not linked of course not! Or maybe let him have a few shares and he will order another 60 million doses of vaccine - when we already had 5 times as many vaccines as people - just because doing so increases the price of the shares he owns.

    4. codejunky Silver badge
      Facepalm

      Re: "run vaccine checks on the status of random people with no authentication"

      @Pascal Monett

      I guess the problem could be the rush to get a method of booking for vaccination. The EU dont have that problem. They need to get some vaccine first.

      1. Anonymous Coward
        Anonymous Coward

        Re: "run vaccine checks on the status of random people with no authentication"

        S'all right. The French are so scared of the vaccines that they have a quarter of a million unclaimed slots for vaccination.

        1. codejunky Silver badge

          Re: "run vaccine checks on the status of random people with no authentication"

          @AC

          "The French are so scared of the vaccines that they have a quarter of a million unclaimed slots for vaccination."

          It amused me that after all the propaganda from the French and Germans and people turning down the AZ vaccine that the EU would have such a tantrum to get more. Instead of wasting vaccine they could have redistributed away from the complaining countries.

  2. spireite Silver badge

    "people should not be using it fraudulently"

    .... that alright then.....

    Can I check if 'er indoors has been to my local 'clinic' *wink* on another site?

    1. JassMan

      Re: "people should not be using it fraudulently"

      OTOH this is a great opportunity to do a vaccine passport on the cheap without spending millions on yet another useless app which can only run on 2 specific OSes. They just need a bit more security on the site such as NI number and NHS number and it could then be used to show you don't need to quarantine for 14 days when you come back from a green list country.

      Sorry I forgot, the government isn't interested in making life easier for Joe Public, just looking for new ways to spaff millions of quid on their chums.

      1. HelpfulJohn

        Re: "people should not be using it fraudulently"

        "OTOH this is a great opportunity to do a National Identity Card on the cheap without spending millions on yet another useless app and without the peasants noticing and rioting."

        There, fixed that one for you.

        "Track and Trace" will never go away. "Temporary, Emergency Powers" never seem to.

  3. Howard Sway Silver badge

    people should not be fraudulently using the service

    This is an original attitude towards information security : saying "now don't you come in here and look at all this personal data and misuse it, or I'll be somewhat miffed!".

    1. Martin Gregorie

      Re: people should not be fraudulently using the service

      Unfortunately, waving their hands in the air while feebly whining that "people should not be fraudulently using the service" seems to be typical of almost everybody who has been put in charge of NHS medical data for the last two decades. Just how big a clue stick do we need to clobber them with before they realise that a British citizen's medical data is PRIVATE and not theirs to do what they like with.

      The people charged with protecting medical data are subject to GDPR penalties if they sell it, give it to PeterTheil because he's a mate or to the spawn of Google because that seems like a good idea after a few pints, so why have none of these people been charged under GDPR, which has now been incorporated into UK law, and sacked?

      Bastards, all of them.

      1. HelpfulJohn

        Re: people should not be fraudulently using the service

        A question if I may?

        Exactly whom would you sack?

        The "policy", if that is the correct description for the ongoing malignant incompetence that is the NHS's method of handling personal information, has been in place for decades, through more than one change of government and quite a few Ministers. It is entirely possible that the Civil Servants implementing said cock-up have also changed, moved to private practice and retired.

        So what hot body would you like to sack, jail and otherwise inconvenience?

        Hint, it ain't *all* Boris's fault. He may have picked the latest tranche of bosses and he may loosely oversee grand patterns of "policy" but the actual running of the service is a mass, group effort.

        So, whom should we go after?

        N.B. I love UKLand's N.H.S., they have kept me alive, abated my suffering and helped my loved ones for "free" on many occasions and I genuinely owe them my life. At the receiving end, some of them, many of them, are truly wonderful people. But ... as an organisation it could stand to be improved a little.

        Nothing's perfect.

    2. Andy Non Silver badge

      Re: people should not be fraudulently using the service

      Or even positively peeved.

      1. Andy The Hat Silver badge

        Re: people should not be fraudulently using the service

        It's in the same vein as "people should not steal sweets or sell drugs and stuff that doesn't belong to them".

        Whoever made this comment needs sacking for incompetence. Whoever manages this system wants sacking for allowing them to say (or even think) it in public.

        1. HelpfulJohn

          Re: people should not be fraudulently using the service

          It's actually true, we should never fraudulently use *any* service. Nor should we steal, kill, lie, hurt anyone or do all of the other bad things.

          We should, indeed, be excellent to each other.

          We should all be wise, honest, truthful, kind, generous and genuinely nice people. Some of us manage this much of the time, some even manage it all of the time. Everyone should.

          But that is not the way of the world.

          It should be but their are too many evil sods running around loose. That is why a web-site holding private data *must* be tightly secured.

          Because not everyone is so nice as us. :)

  4. Anonymous Coward
    Anonymous Coward

    Was it set up for a fat fee

    by a spotty teenage friend of Boris or Dom?

    1. Anonymous Coward
      Anonymous Coward

      Re: Was it set up for a fat fee

      I read it as 'fat free', and thought to myself - why should they be excluded from vaccinations, and subsequent data leakage?

    2. teebie

      Re: Was it set up for a fat fee

      Presumably this is the Accurx system (the description matches the accurx system I used, and it has an NHS address).

      The Accurx directors are 30-40 years old, but I don't know if they got the contract through the normal tendering process (in other words, I don't know if they are Matt Hancock's neighbors)

  5. iron Silver badge
    FAIL

    There is no UK vaccine booking website

    There is no UK vaccine booking website just as there is no UK NHS. As usual El Reg can’t see beyond the borders of England and Wales.

    Here in Scotland we don’t use your vaccine booking website, we get a letter in a blue envelope with an appointment roughly 7 – 10 days later.

    But hey don't let actual facts get in the way of your FUD.

    1. H in The Hague

      Re: There is no UK vaccine booking website

      The article states:

      "The booking page, aimed at English NHS patients wanting to book ..."

      I don't think it refers to "UK booking site".

      1. Robert Carnegie Silver badge

        Re: There is no UK vaccine booking website

        That's what it says now. But it also refers to "Jane Brit". Anyway people cross the border... or, used to.

        However, it is only an issue if you go in without your NHS patient number. Unless that is equally open.

        It doesn't know about me. I checked.

        I got an NHS Scotland letter in a blue envelope which provided me with a secure-ish login code - name and PIN basically. However, using this online (vs by phone) entailed working out which Health Board area I am in, which is often a bit difficult. I suppose I could have shopped around.

        I understand also that after telling everyone to expect their blue envelope, it turned out that the blue envelopes weren't ready... nobody's perfect.

        1. Anonymous Coward
          Anonymous Coward

          Re: There is no UK vaccine booking website

          I understand also that after telling everyone to expect their blue envelope, it turned out that the blue envelopes weren't ready

          Won't matter. In the Salmond-Sturgeon People's Independent Republic of Alba English viruses won't be allowed to cross the border anyway.

          1. Robert Carnegie Silver badge

            Re: There is no UK vaccine booking website

            The latest news is that Moray Council has too many Covid cases, so they are booking extra vaccine appointments and so you may get a phone call number withheld to arrange it... oh well. If they say to meet them in a dark alley at about midnight, ask for a more convenient time. I did! ;-)

    2. Hubert Cumberdale Silver badge

      Re: There is no UK vaccine booking website

      You've got something on your shoulder there, mate.

    3. HelpfulJohn

      Re: There is no UK vaccine booking website

      I'm in England. I didn't use no site. I just got a phone call from a nurse at the local GP practice offering me a slot for each tiny stabbing.

      I accepted both with gratitude.

      I got poked twice.

      Note: the nurse sounded tired and overworked but that may have been me projecting.

  6. Kane
    Thumb Up

    Silkie Carlo

    What a wonderful name!

  7. hoola Silver badge

    All well and good...

    So having found this loophole has it been closed?

    In order to book you either need your NHS number or Name (as registered at the GP), DOB and Post Code.

    If you have already booked appointments then you cannot proceed without the reference number so unless I am mistaken you only know if someone has not had a vaccine booked through this service.

    Many people will have received letters with an appointment or letter with a phone call. Are these also in the same system?

    1. William Towle
      FAIL

      All well and good? If only

      > In order to book you either need your NHS number or Name (as registered at the GP), DOB and Post Code.

      Everything ties in AFAICT.

      Although ... after my first NHSvaccine text message I didn't yet have the number and used personal details to query which centres would be available once I had the number.

      On a second site visit -after receiving notice of NHS ID- it was suggested I'd made bookings and not turned up, rather than merely having let a session expire(!!) ... and later still -prompted by the NHS reminder that I had yet to see suitable location options- tried again and made the booking.

      Meanwhile, in both NHSvaccine messages it was suggested my GP would also be in touch, which hasn't happened despite their surgery having been made available for the jabs. Not that they haven't been in touch, just that what I was sent was yet another survey URL that didn't go to my email address (despite recording a preference to that effect) rather than anything critical. Several times over. After being rudely woken at 6am on four consecutive days by the latest batch I replied with "STOP" and was pleasantly surprised to find that worked.

      On top of the travel fiasco *this* is not happy news having already concluded "at least there's something working"... :(

  8. ItWasn'tMe
    FAIL

    Queen of Carnage

    One wonders if someone has branched out from her 'can't track and don't trace' day job?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like