NHS trusts 'put records at risk'

Two NHS trusts in Sussex and Surrey have been found in breach of the Data Protection Act.

Sussex and Surrey NHS Trust was found to have left a ward handover sheet on a bus and had two laptop computers, which had not been encrypted, stolen.

Epsom and St Helier NHS Trust was found to have insecurely stored hospital records for nearly two years after data was transferred between hospitals.

The details were released by the Information Commissioner's Office.

The trusts were among five found to be in breach of the Act with some of the information classified as sensitive personal data.

In a statement, Sussex and Surrey NHS Trust said it took data protection very seriously and had fully investigated each incident.

'Rigorous training'

"The trust has put in place measures to minimise the risk of incidents like this recurring, including using encryption software, rigorous staff training and regular reminders on the use of patient information and its confidentiality," it said.

Epsom and St Helier NHS Trust said it took the confidentiality of patient information "very seriously" and had ensured it had "robust systems in place to protect patient data".

It said the information was in an area not normally accessible to the public.

"In February it was brought to our attention that a number of patient notes had been left outside a storage area rather than being locked away safely," a statement said.

"We recognise the seriousness of the incident and immediately after it was reported, the notes were moved to a secure location and a full investigation was launched."

The trust added that it had revised the way in health records were retained and destroyed, in line with 2009 Department of Health guidelines.