Nursing home fined for data breach after laptop with patients' details stolen

A nursing home in Northern Ireland has been fined after a data breach.

The Information Commissioner's Office (ICO) launched an investigation after an unencrypted laptop containing the details was taken home by a member of staff at Whitehead Nursing Home, Co Antrim, and then stolen in a domestic burglary.

The computer held medical information on 29 residents, including mental and physical health and "Do not resuscitate" status.

It also stored data relating to 46 staff, including reasons for sickness absence and information about disciplinary matters.

Fining the home £15,000, the ICO said it had found "systematic failings" in data protection measures at Whitehead Nursing Home.

Ken Macdonald, head of ICO Regions, said: "This nursing home put its employees and residents at risk by failing to follow basic procedures to properly manage and look after the personal information in its care.

"Today's fine shows we can and will act against any organisation we feel is not taking seriously its duty to look after the personal details it has been entrusted with.

"In a world where personal information is increasingly valuable, it is even more important to ensure the security of data is not overlooked."

Organisations are legally bound to have measures in place to keep the personal information they hold secure.

Mr Macdonald said the nursing home did not have any policies in place regarding the use of encryption, homeworking and the storage of mobile devices or provide enough data security training.

"Our investigation revealed major flaws in the nursing home's approach to data protection," he said.

"Employees would have expected any details about disciplinary matters or their state of health to have been kept safe.

"Likewise, residents would not have expected their confidential information to have been stored on an unprotected laptop and taken to an employee's home.

"Whitehead Nursing Home had totally inadequate provisions for IT security and procedure and poor data protection training."