Breach in Web security

Queen's University, Belfast is having to check all 1,500 medical photographs held on a pilot orthopaedic teaching database, which until last Friday was linked to the World Wide Web, after a complaint about patient confidentiality. Computer experts at the university will be checking for unauthorised access to the images.

The Institute of Medical Illustrators has complained to the university about one of the images, that of an unclothed female patient with a rare skin condition, whose face was clearly visible.

Images in the database, which is called Base for Orthopaedic Expertise (BONE), are stored on a Web server at the university. The images cannot be seen without the use of a confidential "uniform resource locator" (URL).

George Munroe, senior computer systems analyst with the project, said that it was unlikely anyone would have come across the images unless they knew the URL. "But in this case someone has. It may be that the URL was given to certain people for feedback or for evaluation of the project and it has probably leaked from that."

Dr Munroe said that he understood all the patients in the slides had given their consent for their use for teaching purposes. "Obviously that may not cover going on the World Wide Web, so we may have to restrict access to the orthopaedics department."

Simon Brown, chairman of the Institute of Medical Illustrators, and a medical illustrator at the Institute of Child Health in London, said that he had been alerted to the appearance of the photograph on the World Wide Web and had warned a contact at the university about the breach of confidentiality. He said it was immediately removed. "I remain concerned about any medical photographs being put on the Internet.

"Photographs taken in hospital by a medical photographer are part of a patient's case notes, just like ECG charts or test results, and should be regarded as confidential. But in this case the patient could have been identified."