Information Commissioner's Office
 Printable version
|
Data breach at Welsh health board after patient details sent to wrong address
The Information Commissioner’s Office (ICO) has found Betsi Cadwaladr University Health Board in breach of the Data Protection Act after sensitive information was sent to the wrong address.
The information was disclosed when eight letters about patients were sent to one of the people affected in July 2013. The letters should have been sent to a GP’s surgery. Six of the letters included sensitive medical information relating to the patients’ treatment.
An ICO investigation found that the employee responsible for the mistake hadn’t received any form of data protection training. While the health board had introduced mandatory data protection training for all staff in April 2013, by February 2014 only 6.5% of staff had received it. The health board informed the ICO that it did not anticipate providing the training to all of their staff until April 2015.
ICO Assistant Commissioner for Wales, Anne Jones, said:
“We accept mistakes can happen, but organisations must make sure employees handling sensitive personal information are given the necessary training to carry out their role. Betsi Cadwaladr University Health Board failed to do this.
“The health board has now signed an undertaking committing the organisation to improving the training provided to its employees. This includes prioritising staff who manage sensitive information as part of their core role, or who work in a lead information governance role within the organisation by ensuring they’ve received data protection training by 30 September 2014. The health board will also make sure their staff complete refresher training every two years.
“These improvements will significantly reduce the risks of a future breach occurring and help to keep patients’ information secure."
View this news release in Welsh
Notes to Editors
1. The Information Commissioner’s Office upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
2. The ICO has specific responsibilities set out in the Data Protection Act 1998, the Freedom of Information Act 2000, Environmental Information Regulations 2004 and Privacy and Electronic Communications Regulations 2003. In Scotland, freedom of information is a devolved matter and Scottish public authorities are subject to the Freedom of Information (Scotland) Act 2002 which is regulated by the Office of the Scottish Information Commissioner in St Andrews.
3. The ICO is on Twitter, Facebook and LinkedIn. Keep up to date on the ICO blog and e-newsletter. Our Press Office page provides more information for journalists.
4. The Freedom of Information Act (FOIA) provides individuals or organisations with the right to request official information held by a public authority. The Environmental Information Regulations (EIR) provide access to environmental information. The ICO’s policy on enforcing public access to official information and the powers at its disposal are set out in its Freedom of information regulatory action policy.
