NHS trust fined over staff data breach

Employees with the Torbay Care Trust (TCT) in Devon found details of their sexual orientation and religious beliefs were published online, alongside their name, date of birth, pay scale and National Insurance number. It did not contain any patient or clinical data, the trust said.

TCT was handed a £175,000 penalty yesterday, following the investigation by the Information Commissioner’s Office (ICO), which described the data breach as “serious” and “extremely troubling”.

The ICO said the trust published the information in a spreadsheet on its website in April 2011, and only spotted the mistake when it was reported by a member of the public 19 weeks later.

It was estimated that the spreadsheet was viewed 300 times during that period, although investigators were unable to identify all of those who accessed the information.

The ICO’s investigation found that the trust had no guidance for staff on what information should not be published online and had inadequate checks in place to identify potential problems.

Stephen Eckersley, ICO head of enforcement, said: “The fact that this breach was caused by Torbay Care Trust publishing sensitive information about their staff is extremely troubling and was entirely avoidable.

“Not only were they giving sensitive information out about their employees but they were also leaving them exposed to the threat of identity fraud.

“While organisations can publish equality and diversity information about staff in an aggregated form, there is no justification for unnecessarily releasing their personal information. We are pleased that the trust is now taking action to keep its employees’ details secure.”

Apologising to staff, TCT chief executive Anthony Farnsworth said: “This was an organisational issue, in which the absence of sufficient checks within our processes made an error possible.”