Landmark judgement as NHS trust breaches data protection rules

Warning over importance of data security as Welsh trust is first to be fined for mix-up

The case for replacing paper medical notes with secure electronic patient records was strengthened this week when a Welsh health board became the first NHS organisation to be fined following a serious data protection breach.

Aneurin Bevan Health Board (ABHB) was fined £70,000 by the Information Commissioner’s Office (ICO) after a sensitive report containing explicit details relating to a patient’s health was sent to the wrong person.

The damage and distress caused by the loss of a patient’s medical record is obvious, therefore it is vital that organisations across this sector make sure their data protection practices are adequate

The error occurred when a consultant emailed a letter to a secretary for formatting, but did not include enough information for the secretary to identify the correct patient. The doctor also misspelt the name of the patient, which led to the report being sent to a former patient with a very similar name.

A subsequent ICO investigation found that neither member of staff had received data protection training, and that the organisation did not have adequate checks in place to ensure personal information was sent to the correct person. These poor practices were also used by other clinical and secretarial staff across the organisation.

The penalty is particularly notable as unlike previous penalties which had involved the loss of personal data relating to a significant number of individuals, this case involved a single misaddressed letter.

The ICO was particularly critical of the fact that the board had not implemented robust systems to guard against letters being sent to the wrong recipient.

Organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO

Stephen Eckersley, the ICO’s head of enforcement, said: “The health service holds some of the most sensitive information available. The damage and distress caused by the loss of a patient’s medical record is obvious, therefore it is vital that organisations across this sector make sure their data protection practices are adequate.

“Aneurin Bevan Health Board failed to have suitable checks in place to keep the sensitive information they handled secure. This case could have been extremely distressing to the individual and their family and may have been prevented if the information had been checked prior to it being sent.

“Organisations across the health service must stand up and take notice of this decision if they want to avoid future enforcement action from the ICO.”

The facts of this case make an illuminating case study, or cautionary tale, for staff at all levels

ABHB has signed an undertaking to address the concerns expressed by the ICO during its investigation. This includes ensuring all staff are made aware of, and trained on, the organisation’s policies on the storage and use of personal data, that there is appropriate and regular monitoring of compliance with policies on data protection and IT security, and that new checking processes are introduced across all sites to confirm a patient’s identity before personal information is sent out. The board has confirmed it has already introduced some of these measures.

Advising trusts to check their own policies and improve training and safeguards where necessary, Chris Alderson, a partner at healthcare law experts, Hempsons, said: “Medical correspondence is particularly hazardous because of its confidential and highly-sensitive nature, and there is a high risk that any misaddressed correspondence will be read by the recipient, especially if they have a name very similar to the intended addressee.

“Trusts need to review the arrangements they have in place to ensure that correspondence is sent to the intended recipient, and in particular to ensure that letters containing confidential and sensitive personal data are checked against at least one unique identifier, such as hospital number or NHS number, before dispatch. To avoid a repeat of the Aneurin Bevan case, all staff also need to have appropriate training in information security, and in particular must be alert to the potential harm that will follow a failure to keep information secure.

The facts of this case make an illuminating case study, or cautionary tale, for staff at all levels.”

Companies