GP Mary Hawking comments on "NPfIT security warning after NHS staff view celebrity record"

Mary Hawking writes:

The only thing surprising about this incident is that anyone should be surprised! Ross Anderson [of the Cambridge University Computer laboratory] pointed out the risks in 1995…

I *would* be interesting to know more about this incident – including whether it actually occurred.

The report was put in by Primary Care Trust but occurred in a hospital, and involved 50 staff accessing the patient record, the implication being that many of these accesses were inappropriate, and that 50 staff accessing the record was in excess of the usual number needing access: in a complex case, 50 might be conservative..

Why is the PCT involved?

I thought this sort of access by people without a legitimate relationship was to be dealt with by the employer, i.e. the hospital trust.

The story may well be true – vulgar curiosity (and worse motives) exist everywhere – and controlling access in an environment where there may be no time to authorise a legitimate relationship in a cardiac arrest must be a nightmare, both organisationally and technically: doesn’t explain the PCT’s involvement

My reply:

North Tees Primary Care Trust has declined to give any detail on the incident. Its spokesperson said it was cited in a paper to the Board of the Primary Care Trust as an a good example of breaches in security that the trust needed to take action to avoid.

The briefing paper to the trust board said:

Update 2007 – 2011


The National Programme for IT (NPfIT) is underpinning the modernisation of the NHS. The main difference between IT in the past and IT now is that these systems must be supporting clinical need…

Clinical Records

The long term strategy is to move all Community Services onto electronic patient records by 2011. GP Practices also must under GPSoc move to NPfIT compliant systems for patient records …

Information Security

… As more and more staff and clinicians rely on IT systems in their day to day work the need to be able to rely on systems being available grows. This important area of work is often forgotten in the higher profile of other more glamorous areas of IT but it remains the rock that IT relies on.

A new security risk to be monitored has been identified as part of the Care Records Guarantee (CRG). This risk is around staff inappropriately accessing patient’s records who are not part of their case load. It was noted in an audit that a recent admission of a celebrity to a hospital had revealed over 50 staff viewing the patient record. To meet the CRG staff should only access records of patients with whom they have a legitimate relationship. All systems provide an audit trail of records staff have accessed when using their smart cards. Trusts have to demonstrate that regular audit of this is undertaken and have disciplinary procedures in place to deal with breaches.”

A spokesperson for the trust told me that the incident happened elsewhere but no details were provided. A national newspaper journalist who followed up the story and rang NHS Connecting for Health, which runs part of the National Programme for IT [NPfIT] said he was given the impression that the incident did not actually occur.

The incident did, in fact, happen. Details to follow.


NPfIT security warning after NHS staff view celebrity record

Alert as NHS staff see celebrity’s file – Channel Four News website