- Patient data uploaded to server in USA during NHS trust’s implementation of electronic record system
- Incident at Gloucestershire Hospitals referred to the Information Commissioner’s Office
Patient data held by a hospital trust was erroneously sent to and stored on a company’s server in USA, amid problems with a new electronic patient record system.
The incident at Gloucestershire Hospitals Foundation Trust, which has been reported to the Information Commissioner’s Office, occurred in October, according to the trust’s board papers.
Data relating to 56 patients at the trust was uploaded to an internal server in USA run by Intersystems, which provides the TrakCare software, the November board paper states.
Three trusts in the south west are implementing the TrakCare system under a single deal.
The data, which included identifiable information about 19 patients, was stored on the server for four days, it says.
As it was stored on one of Intersystems’ internal servers, the information was not in the public domain and could not be accessed by unauthorised users.
The incident occurred after an “internal configuration setting caused an incorrect set of information to be transferred”, a report to the trust’s board said.
Trust chief executive Deborah Lee said that once the error was discovered the information was removed immediately.
The report added changes have been made to the system and tested to ensure the mistake cannot happen again.
A trust spokeswoman said that affected patients had not yet been told about the incident. She said it was awaiting the ICO’s response before informing them.
Intersystems said it did not want to comment.
A spokeswoman for the ICO said: “We are aware of an incident involving Gloucestershire Hospitals Foundation Trust and are making enquiries.”
- Article updated at 09.21am on 30 November to amend a grammatical error.
Rollout problems
The TrakCare software is being rolled out at three trusts in a collaboration called SmartCare. A number of difficulties have been experienced in the rollout.
Yeovil Hospital FT launched the system in June 2016, and Gloucestershire and Northern Devon Healthcare Trust followed in December 2016 and April 2017 respectively.
Implementation has not been smooth, particularly for Gloucestershire and Northern Devon, which suspended reporting referral to treatment performance in February and July respectively.
Last week, Gloucestershire hosted an exercise aimed at speeding up its TrakCare recovery plan, which included visits by staff from NHS Digital and North Tees and Hartlepool FT. The North East trust deployed TrakCare two years ago.
Gloucestershire chief executive Deborah Lee said TrakCare will “enhance care for our patients” when it is fully implemented, which is expected to be in 2019.
However, “while considerable progress has been made”, she acknowledged the deployment of TrakCare had affected operational performance at the trust’s hospitals. She stressed there had been no impact on patient care.
Meanwhile, Northern Devon, which provides acute and adult community services, has received help from NHS Improvement’s intensive support team to address “data quality issues” and “backlog of data entry”, according to its board papers.
The trust initially planned to start reporting RTT data again in September this year but this has been pushed to January.
TrakCare is being rolled out across all areas of the trust but the most complex issues have occured in relation to outpatient attendances and the referral to treatment pathway.
Andy Ibbs, Northern Devon’s director of operations and strategy, said: “Although we have worked hard to make the launch of our electronic health record system as smooth as possible, a change of this magnitude will always cause some disruption as staff settle into this new and very different way of working.
“During NHSI’s visit… they noted that we have an appropriate plan to validate and correct data quality errors, and they have provided some additional actions we can take to manage our planned waiting lists.”
He described TrakCare as a “fantastic development”, which starts the trust’s journey towards an end to paper based notes, referrals and forms.
A Yeovil trust spokesman said the trust has not suspended RTT reporting at any time during implementation, nor needed help from NHSI or NHS Digital.
However, there is a “key risk of capital overspends into next year” as a result of an “extension of the programme timescales”. The spokesman said the trust had not fully calculated the impact. Full rollout is expected to be achieved by summer next year.
In Yeovil’s emergency department, there is a risk patients’ discharge summary records are not being completed and cannot be accessed by GPs, according to its board papers. “There are daily reviews of discharge summaries to identify issues or gaps and enable chasing up of summaries to ensure compliance,” the spokesman added.
The three trusts chose Intersystems as their electronic patient record provider in 2014 in a deal worth up to £60m over eight years.
In March, the company also won a major contract to implement TrakCare at three trusts in Liverpool including a “digital exemplar”.
The software is commonly used in the Scottish NHS.
4 Readers' comments