https://www.theregister.com/2024/03/22/nmc_database_whistleblower/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Cloud Infrastructure Week Cybersecurity Month Blackhat and DEF CON Sysadmin Month The Reg in Space Emerging Clean Energy Tech Week Spotlight on RSA Energy Efficient Datacenters Vendor Voice Vendor Voice Vendor Voice All Vendor Voice Amazon Web Services (AWS) Business Transformation Amazon Web Services (AWS) New Horizon in Cloud Computing DDN Google Cloud Data Transformation Hewlett Packard Enterprise: AI & ML solutions Hewlett Packard Enterprise: Edge-to-Cloud Platform Intel vPro VMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [databases] Databases 54 comment bubble on white Whistleblower raises alarm over UK Nursing and Midwifery Council's DB 54 comment bubble on white Regulatory body insists it's on 'a journey of improvement' icon Lindsay Clark Fri 22 Mar 2024 // 10:29 UTC # Updated Exclusive The UK Information Commissioner's Office has received a complaint detailing the mismanagement of personal data at the Nursing and Midwifery Council (NMC), the regulator that oversees worker registration. Employment as a nurse or midwife depends on enrolment with the NMC in the UK. According to whistleblower evidence seen by The Register, the databases on which the personal information is held lack rudimentary technical standards and practices. The NMC said its data was secure with a high level of quality, allowing it to fulfil its regulatory role, although it was on "a journey of improvement." [databases] But without basic documentation, or the primary keys or foreign keys common in database management, the Microsoft SQL Server databases - holding information about 800,000 registered professionals - are difficult to query and manage, making assurances on governance nearly impossible, the whistleblower told us. [databases] [databases] The databases have no version control systems. Important fields for identifying individuals were used inconsistently - for example, containing junk data, test data, or null data. Although the tech team used workarounds to compensate for the lack of basic technical standards, they were ad hoc and known by only a handful of individuals, creating business continuity risks should they leave the organization, according to the whistleblower. [databases] Despite having been warned of the issues of basic technical practice internally, the NMC failed to acknowledge the problems. Only after exhausting other avenues did the whistleblower raise concern externally with the ICO and The Register. The NMC stores sensitive data on behalf of the professionals that it registers, including gender, sexual orientation, gender identity, ethnicity and nationality, disability details, marital status, as well as other personal information. The current UK law for data protection - it is being updated - comes under the Data Protection Act 2018, which incorporates the EU's General Data Protection Regulation (GDPR) as UK GDPR. [databases] Under GDPR, personal information should be "processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures ('integrity and confidentiality')." The whistleblower's complaint claims the NMC falls well short of these standards. The statement alleges that the NMC's "data management and data retrieval practices were completely unacceptable." "There is not even much by way of internal structure of the databases for self-documentation, such as primary keys, foreign keys (with a few honourable exceptions), check constraints and table constraints. Even fields that should not be null are nullable. This is frankly astonishing and not the practice of a mature, professional organisation," the statement says. * UK finance minister promises NHS PS3.4B IT investment to unlock PS35B savings * Oracle Cerner system implementation risks future patient deaths, coroner warns * Romanian hospital ransomware crisis attributed to third-party breach * NHS in Wales bets big on Microsoft with deal worth nearly half a billion For example, the databases contain a unique ten-digit number (or PRN) to identify individuals registered to the NMC. However, the fields for PRNs sometimes contain individuals' names, start with a letter or other invalid data, or are simply null. The whistleblower's complaint says that the PRN problem, and other database design deficiencies, meant that it was nearly impossible to produce "accurate, correct, business critical reports ... because frankly no one knows where the correct data is to be found." In a statement to The Register, Tom Moore, chief information officer at the NMC, said: "The integrity of our register is of paramount importance to us. Our records of all registered nurses, midwives and nursing associates are held securely with a high level of data quality. This enables us to fulfil our regulatory role and protect the public. "When it comes to the systems we use to analyse and report on our data, we're on a journey of improvement. Work remains actively under way in this area, including moving away from older technologies. This will allow us to better generate insight from our regulatory activities." The NMC told us it has measures for protecting personal data which are subject to scrutiny by internal audit partners. The ICO confirmed to us it has received the whistleblower complaint about the NMC. (r) Updated at 1512 UTC on March 22, 2024, to add Following publication of this article, a spokesperson for the NMC said its register was "organised and documented" in a Microsoft SQL Server database. They added the NMC had listened to and investigated the whistleblower's concerns and "provided them with a summary of our findings." "For clarity, the register of all our nurses, midwives and nursing practitioners is held within Dynamics 365 which is our system of record," the spinner continued. "This solution and the data held within it, is secure and well documented. It does not rely on any SQL database. The SQL database referenced by the whistleblower relates to our data warehouse which we are in the process of modernizing as previously shared." Get our Tech Resources # Share More about * Database * Health * Healthcare More like these x More about * Database * Health * Healthcare * SQL Server * United Kingdom Narrower topics * BBC * Brexit * British Armed Forces * ESA * Five Eyes * Government of the United Kingdom * London * MongoDB * MySQL * NoSQL * Parliament of the United Kingdom * Pfizer * PostgreSQL * Scotland * SQL Broader topics * EMEA * Europe * Microsoft * Oracle * Software More about # Share 54 comment bubble on white COMMENTS More about * Database * Health * Healthcare More like these x More about * Database * Health * Healthcare * SQL Server * United Kingdom Narrower topics * BBC * Brexit * British Armed Forces * ESA * Five Eyes * Government of the United Kingdom * London * MongoDB * MySQL * NoSQL * Parliament of the United Kingdom * Pfizer * PostgreSQL * Scotland * SQL Broader topics * EMEA * Europe * Microsoft * Oracle * Software TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like US to probe Change Healthcare's data protection standards as lawsuits mount Services slowly coming back online but providers still struggling Cyber-crime14 Mar 2024 | 3 PlanetScale ends free tier bid, sheds staff in profitability bid CEO defends decision in difficult tech market Databases11 Mar 2024 | 1 Oracle investors hear the magic word 'Nvidia' and boom! Buy, buy, buy Forget the piffle about real world results, let's look at the potential of wundertech Databases12 Mar 2024 | Developing AI workloads is complex. Deciding where to run them might be easier How Digital Realty is powering AI in the UK Sponsored Feature [databases] Change Healthcare registers pulse after crippling ransomware attack Remaining services are expected to return in the coming weeks after $22M ALPHV ransom Cyber-crime8 Mar 2024 | 2 Nutanix catapults IP theft sueball at DBaaS startup Tessell Claims former staff ripped off IP and even did demos for their new company on Nutanix computers Databases21 Mar 2024 | 1 London Clinic probes claim staffer tried to peek at Princess Kate's records First: Not being able buy a meat pie with a credit card. Now this Security20 Mar 2024 | 70 Voltron Data revs up hyper-speed analytics, leaves Snowflake in the dust GPU-based system offers high performance off Parquet files Databases19 Mar 2024 | 7 Home Office's shiny immigration system glitches causing delays Amid reports emerge of technical issues, immigration teams keep 24-year-old legacy system up and running Public Sector12 Mar 2024 | 25 World's first Neuralink patient enjoying online chess, long Civ 6 sessions While excited by the implant, Noland Arbaugh says it's not perfect and there's still work to be done Science21 Mar 2024 | 10 UK council won't say whether two-week 'cyber incident' impacted resident data Security experts insist ransomware is involved but Leicester zips its lips Cyber-crime21 Mar 2024 | 21 Britain enters period of mourning as Greggs unable to process payments First they came for McDonald's and I did not speak out because I have even worse taste in food Off-Prem20 Mar 2024 | 249 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2024 no-js