|
|
 |
| |
David Sloman outside the Whittington Hospital, where the discs were lost |
Identity theft warning as hospital discs go missing
Thousands of staff are put on alert after payroll information is lost in post
AN investigation has been launched after eight weeks were allowed to pass before thousands of medical staff were told confidential details had been “lost in the post”.
Four CDs containing National Insurance numbers, names, addresses and payroll information vanished from Whittington Hospital’s post tray on July 22.
The Highgate hospital provides the payroll service for Camden and Islington primary care trusts and Camden and Islington NHS Foundation Trust, which supplies mental health services.
In total, almost 18,000 staff employed over the past seven years are affected by the bungle.
The information is more than enough for fraudsters to open bank accounts, take out loans and apply for passports or driving licences – but it still took eight weeks before staff were told and a further week before they were informed by letter.
A hospital spokesman confirmed: “The discs were put in a department post tray on July 22. However, the matter was not appropriately reported up within the organisation until Friday, September 5.”
Gasps of disbelief followed an announcement at a staff meeting at Camden PCT headquarters in St Pancras Way on Tuesday that the confidential information had been missing since July 22.
Wendy Wallace, chief executive of Camden and Islington Foundation Trust, said: “It has been a matter of days since we knew about it.”
More than 40 angry staff arrived at the impromptu meeting, held after a few hours’ notice. They bombarded Ms Wallace and a spokeswoman from the PCT with concerns about their finances and the threat of identity fraud.
Although the CDs were password-protected, they were not encrypted, as most confidential data are in major organisations.
Ms Wallace advised staff that current bank accounts were unlikely to be plundered, but that “strange things may come through the post”.
A fraud specialist, brought to the meeting by the PCT, warned staff that the details lost by the hospital were “enough for people to steal your identity”.
An investigation into the eight-week delay has been launched by hospital chief executive David Sloman, who has suspended a member of staff.
Hospital policy states all personal information should be dispatched from the payroll department by courier.
The discs were being sent to a Warwick-based company, McKesson, which manages the hospital’s payroll services and was updating its IT system. They were lost after being left in the post tray in the hospital’s payroll department.
McKesson said it had not received the package and Mr Sloman maintained there was “no evidence it has left the hospital”.
The hospital confirmed the suspended staff member was aware of the rules, after contributing to an audit earlier this year. All staff were told of the confidential information procedure via the hospital’s internal website.
Union chiefs have said they would not like to see a low-level worker take the blame for what may be found to be a systemic failure at the hospital.
A hospital spokeswoman said Whittington staff higher up the chain of command could be disciplined following an internal inquiry.
Mr Sloman said: “The information was sent by a staff member who did not follow trust policies and procedures. We have no evidence the discs have left the hospital. The passwords would be extremely difficult to break.
“We have had external help with governance to make sure this cannot happen again and we believe our system is robust.”
He added: “I would like to apologise to all staff. They have been let down by this incident. No bank details were on the discs and we believe this was a one-off incident.
“The police have advised us the risk to staff is minimal.”
He added that staff had “seemed quite sanguine” when he met them on Tuesday morning.
Current staff wishing to find out more should contact currentstaffhelpline@whittington.nhs.uk |
 |
|
|
|
| |
| |
|
|
|
