According to the ICO, an unauthorised person gained access to a ward to obtain personal information of 14 patients in February of 2023. They did so by entering the ward at NHS, Fife, and were handed a document by a member of staff containing the personal information. 

The unauthorised person was even assisted in administering care to a patient, according to the ICO. Afterwards, the data was taken off site by the individual, and has yet to be recovered. 

The situation was further exacerbated since the hospital’s CCTV was rendered ineffective after a staff member accidentally turned off the wall socket connected to the CCTV prior to the incident. This has impeded the police’s efforts to identify the unauthorised person and recover the data. 

“Patient data is highly sensitive information that must be handled with the appropriate security. When accessing healthcare and other vital services, people need to trust that their data is secure and only available to authorised individuals,” said Natasha Longson, ICO head of investigations.

“Every healthcare organisation should look at this case as a lesson learned and consider their own policies when it comes to security checks and authorised access. We are pleased to see that NHS Fife has introduced new measures to prevent similar incidents from occurring in the future.”

Recommended reading

• Scots Students Land Cybersecurity Challenge Award
• Comment: How Fife Became a Hotbed for Tech Talent
• Scotland’s Fintech Skills Academy Hailed a Success

NHS Fife has since implemented new security measures. Among these are a system for documents containing patient data to be signed in and out, as well as updated identification processes to enhance the overall security framework.

The ICO expressed satisfaction with NHS Fife’s swift response in implementing new measures to prevent similar incidents from occurring in the future. As patient data security continues to be a paramount concern, organisations across the healthcare sector are expected to re-evaluate and reinforce their data protection practices.

This all comes on the background of the Systems Audit and Control Association (ISACA) calling physical security the most overlooked aspect of security for organisations, with incidents rising significantly in past years.