Is an (inaccurate) national adress database a treat to privacy and sometimes personal security?

[Ross Anderson]

Mary wrote:

>There was a good deal of discussion when PDS (the Personal Demographics Service
>http://www.connectingforhealth.nhs.uk/systemsandservices/demographics/pds )
>was introduced in the NHS on the risks that it could pose to people with
>good reason to conceal their addresses and contact details, including groups
>such as those with abusive ex-partners or families and anyone with a
>connection to Huntingdon Life Sciences. 

I have knowledge of a recent case where a woman turned up at A&E with
serious injuries after her ex-husband found her address from a
relative who was a ward clerk at a trust.

Neither the woman's GP nor A&E knew how to stop-note her on PDS, or
even that it might have been a good idea to do so.

This security failure is, I suspect, due to a perverse incentive on
the Department of Health. The Department does not want to highlight 
the fact that its PDS system is available to over 800,000 users and 
is thus insecure. Officials have spent a huge amount of effort trying
to centralise IT systems in the hope that this will help them 
manage the NHS better. They don't want to diss their own baby. But
virtually no-one else has the ability to educate doctors on the scale
and at the speed that would be advisable.

An interesting feature of this case is that the woman is now suing the
NHS for failing to advise her about PDS, the risk, and the
advisability of being stop-noted. I hope she wins a bundle, and that
it's public. That would finally cause trusts, GPs and their insurers
to pay attention.

Ross