The Information Commissioner’s Office (ICO) has issued a reprimand to University Hospitals of Derby and Burton (UHDB) NHS Foundation Trust after a computer system caused some patient referrals to be delayed or lost altogether.
It said the infringement first detected at The Florence Nightingale Community Hospital in Derby and in 2019 UHDB was informed by NHS England of an issue with the national digital platform where referrals dropped off the worklist after 180 days.
After 550 days, if not managed appropriately, the information would be lost to the hospital altogether. The complaint was made to the trust in January 2023 by a patient, then reported to the ICO.
Its investigation found that UHDB failed to implement a formal process or apply a suitable level of security when processing referrals. It also failed to have any formal oversight in place to ensure referrals were being effectively managed.
As a result, nearly 5,000 patients were affected. Of those, more than 4,100 experienced delays in their referral which had the potential to cause distress and inconvenience. The remaining 569 referrals disappeared from the system altogether, and some patients had to wait for over two years for medical treatment to be arranged.
Distress and disruption
Natasha Longson, head of investigations at the ICO, said: “This mishandling of data has caused unnecessary distress and disruption to patients, who should be able to trust their healthcare providers to look after their personal information properly.
“Trusts have a responsibility to their patients, and we cannot see any more mistakes of this kind. We are pleased to see the Trust has taken remedial steps towards patients impacted, as well as sharing learning throughout the organisation to ensure that these mistakes are not repeated.”
The reprimand notice acknowledges that UHDB has attempted to contact all the patients affected and created a new fully documented standard operating procedure that has been shared with relevant staff. It has also centralised the process and applied robotic process automation.
