A NON-ENCRYPTED laptop computer stolen from a Health Service Executive (HSE) office contains sensitive personal financial data on people who have approached community welfare officers seeking assistance.
The laptop containing the data was one of 15 computers stolen from HSE offices in Roscommon town at the weekend.
The office of the Data Protection Commissioner was not informed of the incident by the HSE. It learned of the theft via media reports yesterday morning. It was at that point that the commissioner’s staff contacted the HSE seeking information.
The deputy data protection commissioner, Gary Davis, told The Irish Times he was “surprised and disappointed” at the HSE’s delay in reporting the matter. Mr Davis said the HSE had been at the centre of a number of cases last September in which data was lost on computers and other devices.
Despite assurances from the HSE’s chief executive Prof Brendan Drumm at that time that all computers would be encrypted, the incident at the weekend showed this had not happened.
“Protocols have been broken here and we are carrying out our own investigation,” Mr Davis said.
His agency had legal powers of enforcement involving a fine of €3,000 in all cases where data was lost or computers not encrypted. This avenue might now be explored in relation to the HSE.
A spokeswoman for the HSE said the executive had been waiting for an incident report to be compiled by its staff before informing the commissioner’s office.
One of the two non-encrypted laptops contained sensitive personal financial information on members of the public who had contacted community welfare officers. The second non-encrypted laptop contained slides for a staff presentation, which did not contain sensitive information. The other 13 laptops stolen were encrypted and could not be accessed by whoever stole them.
The computers were stolen from the offices of the HSE’s department of primary, community and continuing care on Lanesboro Road, Roscommon town. Garda sources said HSE staff were satisfied the laptops were not missing when the last workers left between 5.30pm and 6pm on Friday. The theft was discovered at about 11.30am on Saturday.
Those responsible had been in at least 10 offices, from where they had taken the laptops and a DVD player. Gardaí said it was unclear where and how the thieves had gained access to the building. The HSE has reported the robbery to gardaí and a criminal investigation has begun. In a statement last night, the HSE said it was committed to ensuring the protection of personal and sensitive client data held on staff laptops and had begun the process of encrypting all laptops last September.
“A comprehensive encryption programme was undertaken to encrypt all laptops; special clinics and sessions were set up for all staff to have their laptops encrypted. The policy also includes direction that the relevant action is taken regarding failure to comply with the policy.”