Disaster easily averted? – Data confidentiality and the hospital desktop computer

Highlights

• Patient confidentiality is vital.

• Hospital staff are poor at securing data on the desktop computer.

• Training and awareness can only improve matters so far.

• Systemic changes are required to prevent disasters.

Abstract

Objective

We specifically identified the hospital desktop computer as a potential source of breaches in confidentiality. We aimed to evaluate if there was accessible, unprotected, confidential information stored on the desktop screen on computers in a district general hospital and if so, how a teaching intervention could improve this situation.

Design

An unannounced spot check of 59 ward computers was performed. Data were collected regarding how many had confidential information stored on the desktop screen without any password protection. An online learning module was mandated for healthcare staff and a second cycle of inspection performed.

Setting

A district general hospital.

Participants

Two doctors conducted the audit. Computers in clinical areas were assessed. All clinical staff with computer access underwent the online learning module.

Intervention

An online learning module regarding data protection and confidentiality.

Results

In the first cycle, 55% of ward computers had easily accessible patient or staff confidential information stored on their desktop screen. This included handovers, referral letters, staff sick leave lists, audits and nursing reports. The majority (85%) of computers accessed were logged in under a generic username and password. The intervention produced an improvement in the second cycle findings with only 26% of computers being found to have unprotected confidential information stored on them.

Conclusions

The failure to comply with appropriate confidential data protection regulations is a persistent problem. Education produces some improvement but we also propose a systemic approach to solving this problem.

Introduction

Privacy is the right of an individual not to have their personal information exposed while confidentiality is limiting access to information to authorized individuals only [1]. In the context of a hospital, confidentiality is the principle of keeping secure and secret from others information given by or about an individual in the course of a professional relationship [2]. In keeping with the General Medical Council (GMC) Good Medical Practice guidelines, patients are entitled to expect that information about them will be treated and held in confidence by their doctors [3]. Failing to maintain confidentiality damages the doctor–patient relationship and is an ever-increasing source of complaints. The UK Information Commissioner's Office reported 12,985 data protection complaints during the year 2011/12 (with 10% being generated from the health sector) [4]. The US Department of Health and Human Services reported 9032 Health Information Privacy complaints in 2011 [5].

The Data Protection Act (DPA) of 1998 sets out eight principles for securely managing personal information [6]. While it does not articulate specific measures to be taken for compliance to be achieved there are published standards for best practice in this area (see Table 1) [7]. The information Commissioner's Office has the power to prosecute and issue fines of up to £500,000 to organizations found in breach of the Data Protection Act. A specific example is the £325,000 penalty notice served to Brighton and Sussex University Hospitals National Health Service (NHS) Trust following the discovery of personal patient data on hard drives sold on an internet auction site [4].

We identified the hospital desktop computer as a potential source of breaches in confidentiality. Regarding the storage of information the NHS codes of practice states: “It is essential, if the legal requirements are to be met and the trust of patients is to be retained, that the NHS provides, and is seen to provide, a confidential service” [8]. The hospital desktop computer is regularly in an open area accessible by all staff, patients and visitors. It is an ubiquitous piece of equipment in the modern workplace and essential to patient care both in primary and secondary care.

Concerns over maintaining confidentiality of patient information have been long-standing. In 1997 the Caldicott Report highlighted six key principles [9]:

• Justify the purpose(s) for using/transferring confidential information

• Only use patient identifiable information when absolutely necessary

• Use the minimum necessary patient identifiable information

• Access to patient identifiable information should be on a strict need-to-know basis

• Everyone must understand his/her responsibilities

• Understand and comply with the law

The legal requirements are laid out in the DPA. Part 5 of Schedule 1 states that “personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purposes or those purposes [6]. In this case this refers to the keeping of previous handover documents. These types of documents contain patient identifiable information, which is not of clinical use once the document, is out of date and should be erased on a daily basis.

Part 7 of Schedule 1 states that “appropriate technical and organizational measures shall be taken against unauthorized or unlawful processing of personal data” [6]. The storage of unprotected patient identifiable information on the desktop screen is a failure to take appropriate measures to protect sensitive data. The bare minimum of password protecting any file containing patient identifiable information would meet the legal requirements.

We aimed to evaluate whether there was accessible unprotected confidential information stored on the desktop screen on computers in a district general hospital. If this was the case we also wanted to assess the effect of an educational intervention on staff compliance with data protection.