Latest NHS laptop loss highlights need to protect data on portable elements of integrated IT systems

Reports that Huddersfield health officials have launched a high-level enquiry after a laptop containing 1,500 patient records was stolen has been met with incredulity.

Unlike most NHS laptop thefts, the notebook was not used as a portable and/or standalone device, but apparently formed an integral part of Calderdale Royal Hospital’s electromyography scanning system.

This probably means that the health trust didn’t apply its usual risk management procedures to the device, since it ostensibly formed part of the EMG patient scanning system. The data on the system should, however, have been encrypted, if only to prevent prying eyes looking at the patient records, especially since this was a scanner looking for a potentially serious clinical condition.

What the case highlights is the fact that patient data within the NHS needs to be protected at all times, preferably using encryption, but also, where the IT system has components – such as a laptop in this case – much higher levels of security clearly need to be employed.

Since the EMG scanner was located in a public place, namely a hospital, with members of the public wandering in and out, the laptop should have been both physically and electronically secured, to prevent theft. This clearly didn’t happen, meaning that that the trust’s patient data and IT security policies were broken on several fronts.

It’s no wonder that the local press in Huddersfield is reporting that the health trust has launched a full investigation. This wasn’t a routine case of a laptop being stolen due to a member of staff’s carelessness.

Managers should have performed a full risk analysis, and defended both the scanner’s portable component – in this case a valuable laptop – and even more importantly, the confidential patient data it contained. This is a serious lapse of NHS security policies.

Research carried out last year into portable data security threats – and which took in the views of 277 IT security professionals – showed that laptop and other portable data-carrying devices are the security equivalent of a ticking time bomb.

With 11 per cent of respondents to that survey having experienced a data breach early last year, it’s clearly a case of not if, but when, a laptop is likely to be stolen in a public-facing environment.

The fact that the laptop was probably classed as a medical scanner component, rather than a portable device, did not matter a jot to the thief. A laptop is a laptop, and laptops can – and do – go walkabout with annoying frequency.

Sean Glynn is Director of Marketing at Credant Technologies. Sean brings nearly 20 years of international marketing experience to his role at Credant, in which he oversees corporate, Web and partner marketing, product marketing, public relations and advertising. Sean was previously the Director of Field Marketing with Sophos, where he developed global marketing campaigns and coordinated the customer lifecycle program across nine subsidiaries worldwide. He has managed numerous marketing launches for both hardware and software for companies in Texas and Europe throughout his career and has in-depth experience within the data security industry. Sean received a bachelor of business studies degree from the University of Limerick in Ireland.