Insecurity of medical data
Computer technology continues to advance, and one of the biggest forms of advance has been in the storage of data.
Early mainframe computers
had huge magnetic drums onto which data were stored, while many “home” computers,
such as the BBC Micro, of blessed memory, used the kind of tape cassettes
on which music could be recorded.
We then had a variety of discs, from
floppy (referring to the circle of magnetic tape within the disc) to
CDs and now DVDs — all with massive increases in storage capacity
within a small space.
The latest storage format is the USB stick, which
is inserted into a vacant universal serial bus (USB) port on a computer.
These offer the ultimate (so far) in convenient, portable data storage.
A letter in a recent BMJ, from a doctor at a large teaching
hospital, describes how a junior doctor’s USB stick, containing
confidential patient information and much medical data, was stolen.
This has profound
implications, not just for “patient confidentiality” (whatever
that really means) but most importantly it offers yet another route whereby
identities can be stolen for criminal purposes.
A survey of 50 junior
doctors in that hospital revealed that 30 of them used USB sticks for
storing patient data; most sticks had no encryption or even a password,
so anyone could access the data. Presumably, discipline will be tightened
over this potentially devastating loss of personal data.
However, this
poses another problem. It is extremely easy to download data from any
computer using a USB stick. It would take only seconds to copy a large
database, and no one would be any the wiser as there is no immediately
obvious trace left of the theft.
Some organisations (the “A”-level
examination boards, for instance) now forbid the carrying of USB sticks
and mobile telephones with cameras (most of them nowadays) into the secure
areas of their offices. Should the NHS not take a rigorous stand over
when it is acceptable to use these devices?
Also, are you certain that
no one could go into your dispensary armed with a USB stick and steal
your patient data? Not only would this breach patient confidentiality,
but would also allow a rival (or potential purchaser of your business)
unprecedented access to your business data.
Back to Top
|