HSE fined over 'profound disarray' of patient files stored in Donegal
Breaches in Letterkenny and Mullingar lead to a nationwide inquiry where files found were ‘destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged’
A Data Protection Commission (DPC) inquiry has fined the Health Service Executive €645,000 for inadequate storage of paper records at its facilities, including St Conal’s in Letterkenny.
The first breach was notified to the DPC in October 2023, at St. Loman’s Hospital in Mullingar, Co Westmeath, with the second, a month later, when individuals gained unauthorised access to paper records stored and retained in the New Building in St. Conal’s Hospital in Letterkenny.
The inquiry has announced its final decision into the HSE’s processing of personal data contained in paper records, which are stored and retained in the HSE’s external storage facilities.
Breaches were captured on camera in videos uploaded to social media by intruders, which highlighted that medical records were stored.
The DPC said files were “destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged.”
“The location is also a former disused psychiatric hospital which is contaminated with severe mould,” the DPC say of St Conal’s.
They added: “Following commencement of the Inquiry in May 2024, and as part of the Inquiry process, authorised officers from the DPC carried out 12 site inspections nationwide.
“The purpose of the site inspections was to ascertain whether the issues identified in the breach notifications were isolated incidents, or whether the issues were systemic, regarding the retention and storage of personal data contained in paper records, held by the HSE, in its external facilities.
“The DPC’s findings identified data protection failings concerning the physical conditions of HSE document storage facilities and the integrity of the documents held within those facilities.”
Deputy Commissioner Graham Doyle said: “During the site inspections, the DPC observed significant issues with documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged.
“The DPC discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner. There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations.”
The DPC’s decision, which was notified to the HSE on August 25, finds that the HSE infringed the principle of integrity and confidentiality; failed to ensure appropriate security of the personal data contained in paper records stored and retained by the HSE in its external facilities; failed to implement appropriate technical and organisational measures, including proper records management processes, mechanisms and controls, to ensure a level of security appropriate to the risk; infringed the principle of storage limitation of GDPR by failing to retain personal data contained in paper records in a form which permits identification of data subjects for no longer than is necessarily failed to notify a breach to the DPC without undue delay, and within 72 hours of becoming aware of it; infringed GDPR by failing to communicate to the data subjects, the personal data breaches which occurred at St Loman’s Hospital and St. Conal’s Hospital.
The HSE said it accepts the findings of the DPC investigation and added that it will comply with all the recommendations.
"We are sorry this has happened and we apologise to patients and the people who use our services for data breaches at St Loman’s and St Conal’s sites and for our non-compliance with paper record retention and record management policies and procedures," a spokesperson said.
"Both facilities, while no longer used for clinical activity, had continued to operate as storage sites.
As well as the fine, the DPC imposed a reprimand and several corrective orders. The DPC will publish the full decision in due course.