AN organisation which provides services to people with learning disabilities and mental health conditions has been forced to apologise after losing service user's personal information.
Praxis Care Isle of Man, which is contracted by the Department of Social Care, announced on Friday that personal information relating to 107 users has been lost.
The information was contained on an un-encrypted memory stick which was misplaced on August 11 by a Praxis Care staff member who was transferring information from one computer to another.
Since August the organisation has been working closely with the Department of Social Care to identify what information had been lost and to meet personally with those people affected.
Andy Mayhew, a director of Praxis Care, said: "We recognise that we have let our service users down because trusting us with personal information is absolutely essential for us to understand the needs of the individual and to meet those needs.
"For most of the people the information is not detailed – it has things such as name, date of birth and perhaps the name of a worker who has been working with them.
"The most sensitive information is information about people's physical and mental health so there are some instances where it is very sensitive information indeed. That clearly extenuates the gravity of the incident."
Almost all of the 107 users affected have been visited personally by staff from Praxis and the Department of Social Care who have apologised "unreservedly" for the data loss.
Andy continued: "While again not taking away from the fact it shouldn't have happened in the first place I think generally speaking people have reacted maybe with better understanding than Praxis had maybe anticipated - we appreciate that.
"Clearly this is a major incident. Praxis Care has been operating for 30 years (12 years in the Isle of Man) and we haven't been involved in such an incident."
An investigation is currently underway to determine whether disciplinary action against the staff member involved is appropriate. Whatever the outcome of this Praxis has said lessons will be learnt going forward.
Andy explained: "What we have done subsequently is taken some action to safeguard against the reoccurrence.
"We have rolled out the use of encrypted memory sticks across the Isle of Man so there are no un-encrypted memory sticks in use in the Isle of Man as of now.
"We have reinforced the staff's awareness of the policy which is to treat memory stick information in the same way as paper based information which is under lock and key."
Praxis Care will also be making investing in the electronic storage of information as it doesn't have a fully centralised back up system.
Andy continued: "Ironically in the spring of this year we took a major investment decision to set up such a back up and that is in training and being rolled out. But clearly this wasn't in place in time to stop this.
"We've talked about whether we can bring forward the timescales of the investment programme and our chief executive has said very emphatically we will be prioritising that."
The Department of Social Care said it is unlikely that the lost memory stick is in the wrong hands but it says it will learn lessons from the incident.
Chief executive Chris Corlett said: "We've worked closely with the data protection supervisor who has advised us that, given the length of time, if it had fallen into the wrong hands and if somebody had found it and wishing ill intent either to publish the information or distress the individuals that would have happened by now in all likelihood.
"It's not to say it couldn't still come to light – that is possible - but the data protection supervisor has said based on experience from the UK and elsewhere that normally if its not found and used within a short space of time, usually the first two weeks, the likelihood thereafter diminishes substantially.
"Whenever you have an instance like this immediately you want to say what lessons can we learn and how can we ensure that similar breaches can't occur elsewhere.
"So we have re-instigated an immediate review of our own information security protocols inside the department and indeed with the other third sector partners that we work with in the Island. We're trying to ensure we have learnt lessons from this."
The loss of the memory stick has been reported to the police and the Data Protection Office. Any Praxis Care service users, both past and current, who have not been contacted are not affected by the information loss. A helpline has been set up for anyone who would like more information. The number is 0800 2061471.
