 You don't need to be an 'investor' to invest in Singletrack: 6 days left: 95% of target - Find out more
Two points really,
1. Relying on someone to paste a massive list of recipients in the BCC box rather than the To or CC boxes surely can't be a system robust enough to satisfy the requirements of the data protection act?
2. Even if it had been put in the correct field, it's an easy process to find all the header data to see the full recipient list is it not?
Yep.
I'm on the local ccg mailing list and they did this. Not a big issue to me as its not diagnostic specific. Just people who want to be kept updated about their plans. But still a breach of the DPA. I did send a polite email telling them this...
IT systems in the nhs are totally unstandardised. Policy seems to be locally produced as and when required. There's plenty of options to send out bulk emails confidentially. Including a fantastic nhs mail system that lost its funding this April. We used to use it for bulk emails, sms appointment reminders and bulk sms messages to opted in staff to cover shifts. It was free for us to use sadly gone now...
Blimy. That beggars belief. I have no reason in my job to know about that kind of regulation, but just knowing there's a Data Protection Act should be enough of a clue for a responsible manager to get proper, professional advice.
They're couching it at 'human error', basically blaming the person who sent it out and accepting praise for acting responsibly after the fact. Wazzocks.
tthew - Member
2. Even if it had been put in the correct field, it's an easy process to find all the header data to see the full recipient list is it not?
Short version: Not as far as I know, unless you have access to the originating server.