Despite uncovering thousands of cases of patient information being wrongly disclosed to third parties a recent review into the sharing of medical records with private sector companies endorses the practice.
The Daily Telegraph reports that the review, conducted by Sir Nick Partridge found that “tens of thousands of records were wrongly passed to third parties”. However Sir Nick argued that the proper checks and balances were now in place.
This is not the first time questions have been raised about the NHS’ ability to keep patient data secure. Earlier this month Big Brother Watch published NHS Data Breaches, a report into the subject (PDF). It found that data security is an ongoing problem, over the last four years patient confidentiality had been breached at least 7,255 times.
The major issue to be resolved is the level of deterrent the Data Protection Act 1998 poses to individuals who are intent on breaking its provisions. Currently the courts can only hand down a fine to those guilty of maliciously breaching the terms of the Act.
The current sanctions regime lacks teeth. In one case an ex-Barclays employee broke the Data Protection Act 23 times and was fined £2,990, a mere £130 per offence. To make matters worse, at present no record of a malicious breach is held on an individual’s criminal record, meaning they could, potentially be given access to personal data in a future job and commit the same offence.
This problem could be easily remedied by using existing powers to impose a prison sentence of up to two years for serious cases. By making this change the Government would show that it takes the privacy of its citizens seriously. It is a move that has been backed by the Information Commissioner’s Office, the Joint Committee on the Draft Communications Data Bill, Lord Leveson as well as the Home Affairs and Justice Select Committees.
The data that is held in our medical records is amongst the most personal and private information it is possible to hold on a person. This is why it is vital that tough sanctions are put in place to punish those who seek to misuse their access. Just is important is the need for staff to be fully aware of their duties when it comes to protecting patient privacy.
