************************************************************
The following is issued on behalf of the Hospital Authority:
The spokesperson of Queen Mary Hospital (QMH) made the following announcement today (April 20) regarding a hospital staff member who lost a USB flash drive containing patients' data:
A clerical staff member of the Department of Paediatrics discovered the loss of a personal USB flash drive on April 18. The device is not encrypted or password protected. It contains a data file with the names and identity card numbers of 19 paediatric patients. The data file was originally stored in a password protected desktop computer. The clerical staff member used the USB for one-off data file backup on July 8, 2010, shortly before the system upgrade procedure of the computer. The USB was then stored in the ward where the clerical staff member works.
The hospital management was informed of the incident yesterday. It was then reported to the Hospital Authority (HA) Head Office through the Advanced Incidents Reporting System. The hospital management has also reported the case to the Police and the Office of the Privacy Commissioner for Personal Data.
QMH has contacted all concerned patients or their families to inform them of the incident and to express apologies. The hospital has also given the assurance that the incident will not affect patients' treatment and care. So far QMH has not received any enquiries or reports related to the leakage of the patients' data.
The hospital is very concerned about the incident and has conducted an in-depth investigation. In accordance with HA's human resources policy, appropriate disciplinary action was taken against the clerical staff member.
According to HA's established guidelines on the proper use of removable electronic storage devices, any hospital staff member needing to use a removable electronic storage device for operational purposes should apply for approval from the hospital. The hospital will not allow any non-compliance with relevant guidelines. All staff have been repeatedly reminded of the importance of protection of personal data and privacy. All departments must also review stored data and deleted unnecessary stored personal data in electronic storage devices.
The hospital would like to express its deep regret about the incident and apologise once again to all concerned patients and their families.
Ends/Wednesday, April 20, 2011
Issued at HKT 18:55
NNNN
