Medical records sale scandal is 'data, not outsourcing issue'

Stuart Hodkinson, UK general manager, Courion said on Tuesday, 20 October 2009

The Tonight team should be commended for exposing a shocking abuse of NHS confidential patient data, but we must not fall into the trap of labelling this as just an NHS problem, as we have seen how lax controls and monitoring of both workers and their access to key systems can put data security at risk.

Organisations that lack the controls to manage user access often run into problems with staff acquiring access rights to data and software that may exceed their role, or gaining access to systems without detection. As well as the potential for malicious damage or data theft, the risk of accidental damage and deletion of data is raised considerably.

It is essential that clear processes and policies are in place not only for monitoring the physical activities at the offshore location, but also to ensure that access to key information systems by those offshore workers is appropriately managed, provisioned and monitored by IT.

Stuart Hodkinson, UK General Manager, Courion

Mark Miller, MD of Dictate.it said on Tuesday, 20 October 2009

Outsourcing business processes to India is a perfectly acceptable and highly cost effective way in which to manage patient records. This is particularly relevant for outsourced transcription of medical notes in the context of a growing shortage of medical secretaries in Britain. However, organisations that offer these service should be following best practice guidelines, in which the data is completely anonymous, identified only by patient numbers. If the system is managed in this way it is watertight as patients' names, demographics and contact information remain at the hospital and never leave the UK. This is how Dictate.it's outsourced transcription service works, enabling us to transcribe millions of lines of patient data for five years without a single leak."

Andy Jones, European director and GM of Xerox GS said on Friday, 23 October 2009

At Xerox we've been managing document outsourcing for 20 years, spanning a range of company sizes and sectors across the globe. We've worked hard to get where we are today - and it means that when a company approaches us to discuss their document management needs, they are talking with a company they know they can trust.

However, the people who create data breeches, like the one exposed by the ITV Tonight programme, tend to do so for their own personal gain - but there are some basic principles that, if followed, can help minimise risk.

If you are entering into a document management outsourcing contract, cover yourself and make sure you enter into a robust agreement that has a stringent SLA underwritten by financial guarantees. This should also include robust data security standards and procedures. But don't hide behind the contract. Go and find out for yourself, first hand, your role and the role of the outsourcer in ensuring the maintenance of a secure environment.

Outsourcing data processing doesn't absolve your responsibility to your customer's data, so get involved and find out what's really happening rather than just trusting the salesman's words.