Hull breach dampens launch of SCRs

Monday, November 16, 2009

The security of summary care records (SCR) has come under the spotlight after NHS Hull admitted a former employee viewed patient records without authorisation.

Hull's data breach was revealed on the same day as NHS London announced the roll out of SCRs for every person in London.

In a statement, NHS Hull admitted the former employee accessed electronic medical records between May 2008 and June 2009. The individual concerned was only authorised to view anonymised versions of patient records held by local GPs as part of his/her work on the Secondary Uses Service – a tool to monitor how healthcare is delivered, helping trusts to prioritise their efforts.

A total of 358 patients across 20 GP practices have been affected by this, the trust said. It added that all patients involved have been notified in writing and given a point of contact for more information and support. All of the affected GP practices have also been informed.

Kath Tanfield, director of performance, governance and informatics for NHS Hull said: "We take patient confidentiality very seriously and are disturbed to find that patient confidentiality rules have been breached in such a manner.

"It is shocking to us that an individual who takes on a public service role and who agrees to abide by strict confidentiality agreements should go on to abuse their position and violate patients' rights to privacy.

"Patients and the public rightly expect all health service employees to protect and respect their personal information. They have every right to be outraged by this individual's actions, and as the organisation who employed this person, we too feel appalled and let down by their behaviour."

NHS Hull said it has conducted its own review and is cooperating fully with the police investigation which is now underway.

The trust has refused to confirm which system the culprit was using but it was known that the employee used a smartcard to log in and gain access to the records.

The data breach was revealed not long after NHS London announced SCRs will be rolled out across London.

SCRs offer a summary of a person's medical history, which would be used by health practitioners in an emergency situation. The basic information includes any medication or illness that could affect treatment. Eventually the NHS will also provide all patients with an electronic detailed care record (DCR) too. This will be the full patient record, with all medical treatment logged. The DCR will initially only be accessible to your local GP, but other health practitioners may get access if given permission.

Health minister Mike O'Brien said: "Having the right information at the right time can make all the difference to patients' experience of urgent care. Summary Care Records can improve the quality and safety of treatment provided as well as increasing people's comfort and reassurance."

He added: "Moving the NHS from good to great needs improvements such as this."

Responding to the launch of SCRs, Dr Grant Ingrams, chairman of the British Medical Association's GP IT committee said: "Evidence from the early adopters suggests that the information campaigns to inform patients about the Summary Care Record had been ineffectual. We must learn from this experience and ensure that PCTs in London provide appropriate readily accessible information to all patients so they can make an informed choice."

Ingrams added that it was important for doctors in London to be fully informed about the programme as they will need to advise their patients.

All patients will be written to informing them of the change in service and giving them the choice to opt out of having an electronic health record if they wish.