The Information Commissioner’s Office (ICO) has investigated an incident in which a CD holding charts of over 100 patients’ heart and lung scans together with their identity details were found at a bus stop.

The ICO investigated the circumstances surrounding the creation of the CD from which it appeared that the trust in question did not have scanner facilities to create these images and any CDs produced are automatically encrypted. In those circumstances it appears that the CDs must have been created by clinicians to whom the charts were released on request. However it appears that there was no system for chasing up return of these records.  

The ICO has agreed with the trust that patient records should be signed for before release and chased up for return after a week. It also recommended staff training in the handling of sensitive documents.  

This case highlights the need to ensure that robust systems are in place with regard to the release and return of records internally and to ensure that staff are properly trained in the handling of patient data.