Slashdot Mirror
NHS Fined After Computer Holding Patient Records Found On eBay
judgecorp writes "NHS Surrey, part of Britain's health service, has been fined £200,000 when a computer holding more than 3000 patient records was found for sale on eBay. The system was retired, and given to a contractor who promised to dispose of it securely for free, in exchange for any salvage value... but clearly just put the whole system up for sale."
The government fine itself?
The NHS fine should be doubled for stupidity.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
If prism will be selling their old computers too?
This exact leak of data will happen repeatedly. A cloud provider goes under, machines get sold, the buyer is free to do what they want with the data on them, even if it is a torrent of people's personal and banking info.
In theory, the auction site should blank the machines... but what's a blank? A fdisk is still recoverable.
It does not matter if a contract was not signed, there was still an agreement. All that signing a contract means is that the agreement is provable and, hopefully, responsibilities clearly defined. Here: there does not seem to be a dispute as to who should have deleted the data (destroyed the disks), it is the contractor they should pay every penny of the fine.
All of the above written without knowing exactly what was agreed!
FTFA:
We should not have to tell organisations to think twice, before outsourcing vital services to companies who offer to work for free.
Relevant Dilbert
"I bless every day that I continue to live, for every day is pure profit."
well duh, obviously this was the highest salvage value they could arrange.
world was created 5 seconds before this post as it is.
Fining the NHS is pointless, it only harms the NHS itself... Those responsible don't care because its not their money.
They should fine the contractor instead, as it was his laziness/incompetence that caused this.
http://spamdecoy.net - free throwaway anonymous email - avoid spam!
Q: Why is starting a comment in the Subject: line incredibly irritating?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
I don't really get this. The NHS contracts out the disposal of the machines to a private contractor, who then royally screws up, and it's the fault of the NHS?
Surely the responsibility lies with the contractor?
FTA:
This seems to me an argument that the NHS cannot outsource or subcontract anything.
What is NHS Surrey supposed to do in this scenario? Use in-house people to analyse the machines to make sure there is no data remaining before disposing of them?
Or just keep data-disposal services in-house? Personally, I think this would be a great idea, but it goes against the dogmatic 'privatise absolutely everything possible' trend in the UK.
Except they didn't work for free: they worked for the salvage value. I can't really see how the low value of the contract proves fault.
dd if=/dev/zero of=/dev/hda bs=1M
Or something equivalent. It's not hard to blank out a hard drive, just time consuming.
Your records aren't secure or private in the first place, no matter where you live or get health care. I've had 5+ sets of digital AND paper records just magically go missing from several hospitals. The doctors didn't get really care, they just re-ran the tests and in one case the re-run results also went missing. If you believe in an illusion of privacy and security with your countries health care system then you've been fooled.
Of course there's still a small risk that important data has gone to a bad sector which is no longer mapped and thus also not rewritten in the process.
However if confidential data is stored strongly encrypted (as it should be), then as long as your key is reliably wiped out, it doesn't really matter if the rest of the data is still there. Nobody will be able to read it anyway.
Well, unfortunately "should be" is entirely different from "is" ...
The Tao of math: The numbers you can count are not the real numbers.
How hard is it to wipe a machine? I've never been a fan of the wasteful practice of physically shredding hard drives. But a simple policy is that you physically take every drive out of the machine, hook it up to a master machine, and run a reliable drive wiping program. As for the reliability of these drive wiping programs, I have not only not heard of something slipping by them, there is one company that sells hard drives that have been wiped with only zeros and has a cash prize if you can restore the data. So if you are doing a two pass random data wipe you are way ahead of the state of the art.
I am fairly certain I could set up a drive wiping station (with a multi drive connector) for about $200. Then if you occasionally did get a drive with a weird issue where you couldn't wipe it then you use the hammer next to the station and bonk the drive a few times and throw it in a special box for physical destruction.
This is not rocket surgery.
None of the NHS trusts I've worked for are using Windows 3.1 or CRT monitors, except for maybe esoteric lab equipment which isn't worth upgrading. I agree that NHS informatics is generally a mess, but the hardware isn't generally as bad as you're making out.
The 'text mode DOS crap' is probably a proprietary pathology lab system, and it's likely not DOS at all but a unix running over telnet. Old but super fast and efficient, and not easy to upgrade without replacing expensive lab gear that interfaces with it well. You may also be seeing EMIS, or similar, a GP health informatics system that's again super-fast and reliable. There is an upgrade path to a Windows clients and more modern backend but most areas are following a phased rollout. As for path results - GPs can phone and get the results within 24-48hr, but it's not practical to do for every patient.
In theory, the auction site should blank the machines
At least here in the UK, there is no law that would require them to do so as far as I am aware. The only obligation to destroy the data rests with the data controller, who in your scenario is not even the cloud provider. The cloud provider may have undertaken to do so on behalf of the data controller, but I am uncertain if such an obligation would survive the company being declared insolvent: at such a time, recovering the maximum possible revenue for the company's creditors becomes the highest legal priority; honouring existing contracts is relegated to a distinct second place.
When are all these organizations going to learn that NO DATA should ever be on a mobile device? All access should be done through virtual desktops from secured, managed devices using strong authentication and mandatory access controls, period. This is not rocket science and the technology has been available for years. They only have themselves to blame.
This also only works "in theory". The list of drives with hopelessly broken "SATA secure erase" implementations is a long one.
I still don't understand how this kind of breach of data security is even possible. The real question is why the records access system even allows data to be downloaded to a local hard drive for access - surely each PC should contain an operating system and whatever client application is necessary to access medical records. There should never be a need for a local copy to be made - remember these PCs are connected to the hospital's network. It simply shouldn't be possible to export records from the system unless they are suitably anonymised - and access to this export function should be restricted to those involved in research programmes. Fining the NHS trust for allowing the breach does nothing to solve the real problem - that the records storage and access system permits records to be downloaded in the first place. Get the IT requirements right at the design stage and most of these problems go away.
The sad thing is that every disk drive sold this century has a low level secure erase function built in, but practically no-one knows about it. You can activate it with hdparm.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Even better. Use /dev/random instead of /dev/zero. Good luck to anyone trying to recover that data.
Why is /dev/random better? They should not be able to retrieve the data if the drive has been zeroed?
I knew it existed for SSDs, didn't know it also applied to hard drives too.
You see what I did there?
Shutting down free speech with violence isn't fighting fascism. It IS fascism!
/dev/random is slightly better because on a hard drive, the data band is surrounded by guard bands, areas of unused magnetic surface that separate them from the next track. Head positioning and magnetic footprint aren't 100% accurate, so these guard bands get a little magnetic influence from the data written on the data band. If the data band is erased with zeros, the guard bands are not scrambled and can be used to recover the data that had leaked onto them before. If you write random data on the data bands, the leakage into the guard bands will also scramble up the leaked magnetic patterns from the previous data.
Coat [at least] one side with glue.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
The contract should include a clause stating that the contractor must abide by the contract? Should it perhaps include another clause stating that the contractor must abide by the clause stating that the contractor must abide by the contract?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
I did not know this. Thanks for enlightening me!
It is the full responsibility of the NHS to make sure patient data isn't leaked. This means it is almost criminal to outsource it, and if they do outsource it, it must be audited. But if they are even too stupid to wipe the hard drives before handing the machines over, they are just incapable of working with sensitive data.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!