STI error and stray specimen pots among 340 data protection breaches reported by HSE

Darragh Mc Donagh

A total of 340 data protection breaches were recorded by the Health Service Executive (HSE) last year.

The breaches included one incident in which a hospital department that deals with sexually transmitted infections “inadvertently” sent a text message containing a patient’s personal and health data to a third party.

Another breach occurred when specimen pots and paperwork from a laboratory in Kilkenny were accidentally sent to unintended recipients last April.

The HSE also reported a breach in October after the “intentional misuse of data” was discovered, which affected patients of the adult mental health services in the east of the country.

In February, a breach occurred when a member of a HSE safeguarding and protection team – which supports vulnerable adults at risk of abuse – left a document containing service users’ data in another individual’s home in Ennis, Co Clare.

A week later, another breach occurred in Limerick when a video of a service user was inadvertently shared with a third party by staff at a primary care centre, according to records obtained under freedom of information laws.

Mayo University Hospital reported a data protection breach last year after medical notes relating to a patient were “inappropriately viewed” by an employee.

In August, a referral letter containing an individual’s health and personal data was mistakenly attached to an information sheet and handed to another patient by an employee working in older people’s services.

Similarly, a “sensitive document” relating to a psychiatric patient in Dublin North West was accidentally enclosed in a letter to another individual, and a text containing sensitive data was sent to a third party by a member of the ambulance service in the same area.

There were a large number of incidents in which documents containing personal data were reported missing. In September, two emergency department charts were lost in September at Our Lady of Lourdes Hospital in Drogheda.

Missing medical records were found by a third party at Cork University Hospital, and a patient list was found by a staff member in the grounds of University Hospital Kerry in February.

In May, a patient of acute adult mental health services photographed documents containing sensitive data relating to another service user while they were left unattended.

The HSE has said it takes all breaches of data protection seriously and every incident is fully investigated to establish how they occurred. Preventative measures are then put in place to reduce the risk of recurrence.

“The HSE continuously monitors arrangements to ensure compliance with data protection law and GDPR principles to ensure the security and confidentiality of the personal information of all our patients and service users,” they added.