IRELAND'S Health Service Executive (HSE) has been fined €645,000 over data protection failings after paper records were found contaminated by animal droppings and destroyed by mould.
According to the Data Protection Commission (DPC), physical documents were also found stored in disused bathrooms and a shipping container inside a turf shed.
DPC Deputy Commissioner Graham Doyle said the findings showed a 'significant risk of unauthorised access to and disclosure of sensitive medical information by third parties'.
'Profound disarray'
The DPC launched an inquiry into the HSE's processing of personal data contained in paper records stored at external facilities following two personal data breaches.
In late 2023, intruders gained unauthorised access to documents stored and retained in St Loman's Hospital in Mullingar, Co. Westmeath and St Conal's Hospital in Letterkenny, Co. Donegal.
Both sites are former disused psychiatric hospitals, the former contaminated with asbestos and the latter with severe mould.
Videos uploaded to social media by the intruders highlighted that medical records were stored and retained in both facilities.
The DPC inquiry saw inspectors examine 12 HSE sites across the country to determine whether the data breaches were isolated incidents or an indication of wider systemic issues.
The inquiry findings identified data protection failings concerning both the physical conditions of the storage facilities and the documents themselves.
"During the site inspections, the DPC observed significant issues with documents damaged or effectively destroyed by mould, contaminated by animal droppings, covered in rubble or detritus, rotting due to the storage environment or water damaged," said Mr Doyle.
"The DPC discovered storage areas in such profound disarray and neglect that the records contained within them could not be deemed to be filed in any organised or accessible manner.
"There were records stored in disused bathrooms and cubicles, a shipping container in a turf shed, rooms without functioning lighting or heating, as well as derelict buildings at a number of disparate locations.
"The retention of records by the HSE in an insecure manner beyond the period where they should be retained gives rise to an ongoing significant risk of unauthorised access to and disclosure of sensitive medical information by third parties.
"There is also the risk of records not being available for other medical care or other legal or regulatory reasons."
Audit
The DPC found that the HSE had failed to ensure the security of data, including identification details of subjects, and failed to implement proper record management processes.
It also failed to notify the DPC within 72 hours of learning about the data breaches at St Loman's and St Conal's.
As well reprimanding the HSE and issuing fines totalling €645,000, the organisation has also been ordered to carry out a complete audit of its storage facilities and ensure they are fit for purpose.
This includes the 'immediate and safe destruction' of paper records containing personal data that are no longer necessary for the purposes for which they were originally retained.
Everything from irishpost.com and the print edition is available on the Irish Post App — plus more! Download it for Android or Apple IOS devices today.
