South London healthcare trust has admitted to losing two unencrypted memory sticks containing sensitive personal data about patients.
The data breaches occurred in separate incidents. In the first breach, the device contained data relating to around 600 maternity patients, according to an undertaking signed by the trust with the Information Commissioner's Office (ICO). A data controller employee downloaded the data on to a personal memory stick in order to do some work at home.
"Due to not having received up to date information governance training, the employee was unaware that an encrypted device issued by the data controller should have been used," says the undertaking.
In the second incident, the lost memory stick contained the names and dates of birth of 30 children, and full audiology reports for a further three children.
The ICO said that in both cases the data was put at "unnecessary risk" by not being encrypted. However, it added that both devices were later found, and said it was unlikely that they were readily accessible during the time they could not be located.
According to the undertaking, there were also a further two incidents at the trust, but these related to data breaches involving paper files.
The trust has now agreed to encrypt portable and mobile devices including laptops and other portable media used to store and transmit personal data. It has also pledged to make sure that staff are appropriately trained and made aware of the data controller's policy for the retention, storage and use of personal data.
"The data controller shall implement such other security measures as it deems appropriate to ensure that personal data is protected against unauthorised and unlawful processing, accidental loss, destruction, and/or damage," adds the undertaking.
This article was originally published at Guardian Government Computing.
Guardian Government Computing is a business division of Guardian Professional, and covers the latest news and analysis of public sector technology. For updates on public sector IT, join the Government Computing Network here.