Summary of 2012/13 incidents, lessons learned and recommendations
Type
Description
Actions taken locally and lessons learned
NCSP Recommendation for commissioners and
providers
Confidential
information
leak
Patient test result was
faxed to a private company
with a fax number that had
one different digit to the
GUM clinic’s fax number
 Obtained assurance from the company that fax
had been destroyed
 Double checking fax number
 Looking at more secure methods of
communication
 Following incident faxes with patient information
on are no longer sent. The treatment form, still
sent by fax only contains a lab number relating to
the patient and the receiving site is asked to
telephone the sender so that the rest of the details
can be provided over the phone.
Providers: Use secure communication where
possible, preferably electronically. This has the
added advantage of providing an audit trail.
If unavoidable to use a fax machine, then take
precautions such as ensuring someone is at the
other end to receive it. For more details see also the
security tips in relation to faxing personal data on
the Information Commissioner Office’s website.
Mail out to
under 16
Approx 1,400 15 year olds
received a letter inviting
them to take up an offer of
a chlamydia screen through
the NCSP, resulting in six
complaints.
 The cause of the incident was an error that
occurred when transcribing the request for the
letters to the official order form where the age
range was incorrectly entered as 15-24, rather
than 16-24.
 In future this part of the process is to be double
checked by a senior manager to prevent a
repetition of this incident.
 Working with communications teams to manage
the communications, including specific
communication for local religious community.
 Responded to complainants with apologies and
assurance it will not happen again
Providers/Commissioners: The NCSP has been
notified of an incident in relation to mail outs for
three years in a row. Therefore, when planning mail
outs, carefully review the process in place for
administering the mail out. Consider the potential
benefits and pitfalls thoroughly as return rates may
be low.
Type
Missing tests
Security and
confidentiality
breach in
chlamydia
internet test
request
website
Description
An incident in a laboratory
necessitated implementing
the back up procedure for
processing chlamydia tests
at another hospital
laboratory. Subsequently
two runs of test samples
were lost in transport to the
other site, which did not get
noticed until test results
were not forthcoming due
to difficulty with
sending/receiving result
sheet faxes. Patients had to
be recalled to provide a
new sample.
Patient received a negative
result, but using her postal
kit website unique number
she saw someone else’s
details and result alongside
her information on the
website.
Actions taken locally and lessons learned
NCSP Recommendation for commissioners and
providers
 Communicating with all providers of screening to
alert them of this error and offer advice and a
response to potential enquiries.
As this work was outside of the normal workload, it
Providers: Laboratories to review their back up
is not subject to the usual booking in and booking
procedures and ensure that:
out procedures in use at the lab, this will now be
 Transport arrangements are sound
implemented through looking at
 Administrative processes work effectively
 delivery and receipt process of samples
 Batch sizes match receiving laboratory sizes
 confirming with the back up laboratory that their
as much as possible
machine will be able to process the number of
samples per batch before they are sent.




Website service contacted and situation
explained
Patient contacted by website service and
reassured and given confirmation of result
Website team explored the issue and put the
technical issues right
Website team have provided a technical report
to the commissioners of what measures were
Providers/commissioners: Ensure that website
providers that offer internet testing comply with the
security standards; see for example:
 Information Commissioner Office’s Guide to
Data Protection, in particular principle 7, and
 Information Standards by the Information
Standards Board for Health and Social Care
Type
Description
Actions taken locally and lessons learned
taken to rectify the security risk, which they
accepted.
NCSP Recommendation for commissioners and
providers
Commissioners: Ensure that contracts specify that
the internet security requirements are being
adhered to.