***********************************
The following is issued on behalf of the Hospital Authority:
A spokesperson for Queen Elizabeth Hospital (QEH) made the following announcement today (February 24) regarding a hospital staff who lost a USB flash drive containing patients' data:
A staff of the Department of Pharmacy discovered the loss of a non-encrypted nor password-protected personal USB flash drive on February 18 (Tuesday). It contains information of drug prescriptions, dispensing related documents as well as patient identifiable personal data involving 92 patients. The staff concerned started searching the USB flash drive in the Department of Pharmacy.
When the Department Manager of Pharmacy Department was notified of the incident on February 21 (Friday), more than 100 colleagues of Department of Pharmacy were immediately contacted, but still the USB flash drive could not be retrieved. The Department of Pharmacy informed the hospital management of the incident on the same day and it was then reported to the Hospital Authority (HA) Head Office through the Advance Incident Reporting System. The USB flash drive was believed to be misplaced in the restricted area of Department of Pharmacy. The hospital also considered the risk of exposing patient data to the public to be low. As of today, the USB flash drive has not been recovered. Therefore the hospital considers that it is necessary to report the case to the Police and the Office of the Privacy Commissioner for Personal Data.
QEH is currently contacting all concerned patients or their families to inform them of the incident and to express apologies. The hospital has also explained that the incident would not affect patient's treatment and care. So far QEH has not received any enquiries or reports related to the leakage of the patients' data.
The hospital is very concerned about the incident, and will conduct an in-depth investigation as well as follow-up in accordance with HA's Human Resources policy. According to HA's established guidelines on the proper use of removable electronic storage devices, any hospital staff requiring using removable electronic storage device for operational needs should apply for approval from the hospital. The hospital will not allow any non-compliance to relevant guidelines. All staff have been repeatedly reminded on the importance on protection of personal data and privacy. All departments must also review stored data and delete unnecessary stored personal data in electronic storage devices.
The hospital would like to express regret about the incident and apologise once again to all concerned patients and their families.
Ends/Monday, February 24, 2014
Issued at HKT 21:40
NNNN
