Personal data belonging to 1.6 million patients which was stored on a CD was mistakenly sent to a landfill site by an NHS organisation, it has been revealed.
According to the Information Commissioner’s Office, the Eastern and Coastal Kent Primary Care Trust had a CD full of personal information like names, addresses, dates of birth, NHS numbers and GP belonging to 1.6 million patients.
The CD was stored in a filing cabinet; which the staff was not aware about. The staff sent the filing cabinet to a landfill site during an office move. The ICO claims the lost CD has not been recovered yet.
“When planning the office move, the security of the CD was considered and it was deemed appropriate to store it in the filing cabinet concerned. Although communication was established with the project manager coordinating the move, the existence of the CD was not communicated, leading to the disposal of the filing cabinet,” said the CEO of the trust, Ann Sutton.
The trust has decided to create guidelines outlining how to handle sensitive data during an office move and provide better training to employees to enhance data security.