************************************************************
The following is issued on behalf of the Hospital Authority:
The spokesperson of Kowloon East Cluster (KEC) made the following announcement today (March 24) regarding the loss of a USB flash drive containing patient data recently:
A doctor of KEC's Ophthalmology Department noticed on March 20 that her personal USB flash drive was found missing. The device contained some work related files and the personal data of 47 patients, including their names, ID numbers, sex, age and operation records. The relevant data are not exported or downloaded from HA's Clinical Management System. The flash drive could not be located despite repeated searching. The doctor reported the incident to the hospital management and the Police on March 23. On the same day (March 23), the incident was also reported to Hospital Authority (HA) Head Office through the Advanced Incidents Reporting System, while the Office of the Privacy Commissioner for Personal Data was informed. The hospital immediately started to contact all concerned patients. So far a total of 33 patients have been informed with sincere apology from the hospital. We have also explained that no personal medical records are involved in this incident and the incident would not affect patient's treatment. We will continue our effort in contacting the remaining patients. The hospital has not received any enquiries or reports related to the leakage of the patients' data.
According to the HA and KEC's established guidelines on the proper use of removable electronic storage devices, any hospital staff requiring to use removable electronic storage device for operational needs should apply for the approval of the Hospital Chief Executive of the respective hospital. Initial investigation indicated that the staff concerned had not complied with the data security guidelines. KEC is setting up an independent panel to thoroughly investigate the incident. If there are human errors identified, we will take appropriate disciplinary action in accordance with the prevailing human resources policy of HA.
KEC expresses deep regret and concern about the incident. We would like to apologise once more to all concerned patients. Staff members have been reminded again to strictly follow the established protocol on protecting data and privacy of patients. By way of background, KEC has already established a comprehensive set of guidelines including the proper use of removable electronic storage devices, and has been providing regular training sessions for staff of all grades and ranks on protection of patient data and privacy.
Ends/Tuesday, March 24, 2009
Issued at HKT 21:47
NNNN
