Security Bullet In
Communiques from the security front, sir
Tuesday 12 August 2008, 4:03 PM
Colchester University Hospital sacks manager over lost laptop
An unnamed senior manager has been sacked by Colchester University Hospital after losing a laptop.
The manager had his laptop stolen from a car in Scotland in June. The laptop contained the confidential details of several thousand patients, as well as other less sensitive information, according to a Colchester University Hospital statement.
Colchester University Hospital declined to tell me the name of the manager, but said he had been sacked for "breach of security and patient confidentiality".
"If a laptop is taken off the Trust premises, it is supposed to be encrypted, and this one wasn't," said a Colchester University Hospital spokesperson.
The spokesperson also declined to say whether there had been any other factors which led to the manager's dismissal.
People being sacked for the loss of confidential information is rare, especially in the public sector. Ok, Paul Gray fell on his sword over the HMRC fiasco, but people aren't normally held individually accountable, usually because if information has been lost it is due to systemic failure -- HMRC being a case in point.
PGP Corporation's Jamie Cowper stated that encryption should be centrally managed, and that responsibility for data security should lie with the organisation, and ultimately with the board.
"Unless there is evidence of grievous misconduct, the responsibility for data security should lie with the organisation as a whole – and that means that in cases such as this, punishment should be top down rather than bottom up," stated Cowper.
The manager had his laptop stolen from a car in Scotland in June. The laptop contained the confidential details of several thousand patients, as well as other less sensitive information, according to a Colchester University Hospital statement.
Colchester University Hospital declined to tell me the name of the manager, but said he had been sacked for "breach of security and patient confidentiality".
"If a laptop is taken off the Trust premises, it is supposed to be encrypted, and this one wasn't," said a Colchester University Hospital spokesperson.
The spokesperson also declined to say whether there had been any other factors which led to the manager's dismissal.
People being sacked for the loss of confidential information is rare, especially in the public sector. Ok, Paul Gray fell on his sword over the HMRC fiasco, but people aren't normally held individually accountable, usually because if information has been lost it is due to systemic failure -- HMRC being a case in point.
PGP Corporation's Jamie Cowper stated that encryption should be centrally managed, and that responsibility for data security should lie with the organisation, and ultimately with the board.
"Unless there is evidence of grievous misconduct, the responsibility for data security should lie with the organisation as a whole – and that means that in cases such as this, punishment should be top down rather than bottom up," stated Cowper.
PreviousComments on this post
Good.. there are plenty of spare managers in our health service. I know this from the time I did some work with the mechanics for the london amulance service.....sometimes there would be as many as three useless managers squabling amongst themselves, whilst holding everything back. I would hope that people could adapt, and take a bit of extra care in todays publicity rich climate concerning the loss of data in its' various forms.
Whilst I admit to having no knowledge of the real situation, I can't help feeling that there was either one sacking too many, or about a dozen too few.
