Children's data discs lost in hospital blunder

A computer disc containing the data was sent to St Leonard's Hospital in Hackney but failed to reach the right department - even though it was signed for by hospital staff.

The disc contained the names, dates of birth and addresses of 160,000 children and there were fears the information could be enough for criminals to create fake identities.

Bosses at NHS London have ordered a city-wide inquiry into all data transfers in light of the latest security scare.

The blunder occurred when the disc was sent by courier to the Hackney hospital by BT, which operates the NHS's IT system, on 14 November.

It is believed the courier company used by BT did not check that it was signed for by the correct person and the disc never reached its intended destination in the IT department.

A spokeswoman for City and Hackney Primary Care Trust, which runs St Leonard's Hospital, said all deliveries of personal information had now been halted.

She said: "BT couriered a fully encrypted disc containing patient information to City and Hackney PCT.

"It was not received by the named recipient, and attempts by the PCT to find the disc have so far failed. All deliveries of personal information have been suspended in light of the breach."

Although the data on the disc was secured using a system known as 256-bit encryption, one of the most secure available, a team of researchers recently demonstrated the system could in theory be cracked in two weeks.

It is also believed that as the data on the disc will remain valid and useful to criminals for many years, advances in computing mean it could be read and used to defraud people in the future.

Ruth Carnall, chief executive of NHS London, said: "We take any breach of security very seriously.

"I understand that people may be worried that private data has been lost but all the data was fully encrypted and passcode-protected, and the risk of unauthorised persons viewing it is negligible. I have asked for an independent review of all NHS data transfer in London and procedures are in place to stop this from happening again."

It is the latest in a series of high-profile losses of data by government departments.

The Driver and Vehicle Agency in Northern Ireland yesterday confirmed it has lost the personal details of 6,000 people on discs being sent to its Swansea office and last month two discs containing the personal details of 25 million people were lost after HM Revenue and Customs sent them through the post unregistered and unencrypted.

BT today called for parents to remain calm over the latest incident. A spokesman said: "Patients should not be concerned because BT uses the highest levels of security to safeguard the data in its care.

"All NHS data sent by disc is fully encrypted to industry standards. We apply stringent controls in managing the complex encryption pass phrases necessary for unlocking the data.

"In this instance the encryption pass phrase would only have been released after one of two named individuals confirmed receipt. This was not confirmed so the encryption pass phrase has not been issued."

Graham Cluley of computer security firm Sophos said the information was more than enough to commit identity theft if it could be decrypted.

"It is a very easy and quick process for criminals to use this kind of information to apply for loans and credit cards, commit fraud and ruin somebody's credit rating in the process," he said.