Dramatic cyberattacks may make the headlines, but in fact, simple human error accounts for more data breaches in the health sector than any shadowy figures.
In the first year of the Notifiable Data Breaches scheme, the Office of the Australian Information Commissioner (OAIC) advised that health service providers reported the highest number of incidents, around 20% of all breaches.
Of the breaches involving health service providers, more than half were due to human error.
We’ve reviewed the OAIC report and calls to Avant involving data breaches, and have identified the following key learnings.
Errors such as private information being sent to the wrong recipient accounted for one in 10 breaches reported to the OAIC.
This was also high on our list of reasons for calls — and the source of considerable angst. It is an easy error to make if you are emailing or texting patients.
We also had a number of calls where information was posted to incorrect addresses or information such as recall letters intended for several recipients was included in one envelope.
While many practices are cautious about sending sensitive information electronically, it is important also to check you have robust procedures in place for posting information.
Another emerging theme was the perils of autotext. This can be a problem in both email programs and word processing software, which may default to include recently or frequently used addresses.
This can contribute to the problem of information being sent to the incorrect address.
It could also lead to patient information in reports or referral letters being sent to the wrong provider.
Laptops, USBs, logbooks or physical files lost or stolen from homes, cars or public transport accounted for another significant group of calls.
While it is not possible to completely guard against theft, precautions such as having protocols for when and how patient information can be taken out of the practice, password protection and encrypting files, and locking devices can help.
Protocols for ensuring devices can be remotely located or wiped and ensuring regular and secure back-ups not linked to your system will mean you can wipe devices without loss of data.
Where the loss or theft involved physical files, these were often found discarded, so it is also important to report a loss.
Phones left unlocked or with no password protection and computers left logged on and unattended were another source of data breach.
Check the security settings on office computers and have appropriate controls on any devices that have access to patient information files.
Having multiple windows open and flicking through them might be convenient.
However, there have been reported cases where this practice has led to medication errors.
It has also resulted in the wrong patient information being inserted into referrals or pathology requests.
All these errors have the potential to lead to patient harm, as well as regulatory action and reputational damage.
In the first year of the Notifiable Data Breaches scheme, the OAIC has taken an educative approach.
However, it has indicated it will be more inclined to exercise enforcement powers in the future where necessary.
The good news is that many of these breaches are preventable and our experience is that the time taken to avoid having a data breach is definitely preferable to the time and stress of being involved in a breach.
Review your privacy procedures and make sure that everyone in your practice, including temporary staff and contractors, understands their responsibilities.
You need a data breach response plan. Whether or not you end up having to report a data breach to the OAIC, you will need to be able to respond promptly and document what steps you have taken.
Even the most secure systems can bevulnerable to human error. Remind staff about the need for secure passwords and the dangers of phishing and other scams to gain access to your systems.
If you are not sure who is asking for information, always check.
This article was originally published in AusDoc.PLUS on 27th June 2019.