************************************************************
The following is issued on behalf of the Hospital Authority (HA):
The spokesperson of Kowloon East Cluster (KEC) made the following announcement today (April 12) regarding the loss of a USB flash drive containing patient data:
A female doctor (Resident) of United Christian Hospital (UCH)'s Obstetrics & Gynaecology Department noticed on April 11 that her personal USB flash drive was found missing. The device is not encrypted or password protected. The device contained eight patient data records, with four scanned image of fetal heart tracing record containing one patient's name and ID, and a powerpoint presentation file containing seven patients' names, ID numbers and case summary for internal clinical discussion within the department. No patient's personal contact information is included and the relevant data are not exported or downloaded from HA's Clinical Management System.
The flash drive could not be located despite repeated searching. The doctor reported the incident to the hospital management and the Police on April 11. On the same day (April 11), the incident was also reported to Hospital Authority Head Office (HAHO) through the Advanced Incidents Reporting System while the Office of the Privacy Commissioner for Personal Data was also informed today (April 12). We immediately started to contact all concerned patients. So far five patients have been informed with sincere apology from the hospital. We have also explained that the incident would not affect patient's treatment care. We will continue our effort in contacting the remaining patients. The hospital has not received any enquiries or reports related to the leakage loss of the patients' data.
According to HA and KEC's established guidelines on the proper use of removable electronic storage devices, any hospital staff requiring to use removable electronic storage device for operational needs should apply for the approval from the Hospital Chief Executive of the respective hospital. Since patient names and ID numbers are not required for clinical discussion, initial investigation indicated that the staff concerned had not complied with the data security guidelines. UCH together with HAHO have formed an independent panel to investigate the incident. If there are human errors identified, we will take appropriate disciplinary action in accordance with the prevailing human resources policy of HA.
KEC's management was disappointed to learn about the incident and found it unacceptable. Since the loss of USB flash drive happened in March, we have requested all departments to review all stored data and delete unnecessary stored personal data in electronic storage devices and stressed the importance of protection of personal data and privacy to all staff through emails, forums and training workshops. We requested all staff to attend training sessions on protection of personal data and privacy. UCH issued a safe card to all staff on March 31 and all computer screens with HA's Clinical Management System have been placed with a safe card, as a reminder to protect personal data and privacy. The hospital and her department have repeatedly reminded the concerned doctor on the importance on protection of personal data and privacy through different channels. The concerned doctor has also received the safe card issued by UCH.
UCH expresses deep regret and concern about the incident. We would like to apologise once more to all concerned patients.
Ends/Sunday, April 12, 2009
Issued at HKT 19:58
NNNN
