NHS staff have been ordered to improve their data handling after details on cancer patients went missing at an NHS Trust.

Ashford and St Peter’s Hospitals NHS Trust has pledged to improve data security, after it informed the Information Commissioner’s Office (ICO) of a data breach involving the loss or theft of three unencrypted USB sticks containing sensitive cancer patient information.

Each of the devices contained the full treatment and full diagnosis history relating to a number of patients. The information on the USB sticks was in Microsoft Word format, leaving the material easily accessible to anyone with a computer.

The Trust has signed an ICO undertaking confirming that the Trust will take a number of steps to ensure personal dats is kept securely. The Trust will ensure that staff receive the appropriate training and are aware of the hospital’s policy for the storage and use of personal data.

Mick Gorrill, assistant commissioner at the ICO, said, “I urge all NHS organisations to restrict and encrypt the amount of sensitive information stored on portable devices. In this case, our investigation found that there was a lack of understanding and awareness among staff of their responsibilities under the Data Protection Act."